cancel
Showing results for 
Search instead for 
Did you mean: 

Server group management

Former Member
0 Kudos

Hi,

When setting up an architecture where servers should be accessible only to a subset of the platform's users, e.g. geographically dispersed installations, SAP has always said to use server groups and assign the content (i.e. the reports) to the corresponding server group.

Example:

  • Reporting databases are deployed in Belgium and France
  • 2 hosts containing processing servers are installed in each of those countries
  • Reports are restricted to one of the two server groups

While this setup works fine for existing reports, what do you do with ad-hoc reports? E.g. a user creates a new Web Intelligence report against a universe that pulls data from the database in Belgium. As far as I can tell, there's no way that you can make that report use the processing server in Belgium. Instead, it will randomnly use a processing server that's available to handle its request.

Also, using server groups this way requires your users to set the processing server after they save the report for the first time, or create custom code based on the SDK that will assign the server group.

I've run into the same problem with deployments where there's a requirement to have processing servers dedicated to departments. As far as I can tell, there's no way to do this as there's no link between user and server (i.e. it's not possible to define which users or user groups have access to a server group).

I was hoping the multi-tenant feature in BI4 would provide some way around this, but it seems that's not how it works.

Any input regarding this type of setup is very welcome! Thanks.

Kind regards,

Kristof Speeckaert

Accepted Solutions (0)

Answers (2)

Answers (2)

0 Kudos

Though this is old thread.

I agree with Kristof and disagree with Ajay.

There could be additional setting Ajay may have done except what Kristof explained.

I cross checked from query results too and there is no deviation of any kind.

user is having full control on application, universe, connection, folders and reports.

user denied granular level on one of the server groups and full control on other.

All services from each node were kept under each server group.

did testing with SIA down for which user had access, reports kept refreshing.

Ajay, if there are additional settings kindly share.

CdnConnection
Active Contributor
0 Kudos


Speeckaert,

       You can also users / Groups to be assigned to certain Server Groups.  Example,create Belgium and France Users Group and then assign the groups to use their Server Groups.  This will also force all add-hoc processing to be done by their local servers.

Regards,

Ajay

Former Member
0 Kudos

Hi,

Thanks for your input.

I tried this in the past, but just to be sure, I did the following setup again (BI4 SP05):

  • Created two servers groups
    • Server group 1:
      • WebI Processing Server 1
      • Connectivity Adaptive Processing Server
      • WebI Adaptive Processing Server
    • Server group 2:
      • WebI Processing Server 2
      • Connectivity Adaptive Processing Server
      • WebI Adaptive Processing Server
  • Created one user group with one user in it
    • Denied access to server group 1 for the test group
    • The user group has full application and content rights

Scenario:

  1. Logged on using the BI Launch pad
  2. Opened and refreshed a sample WebI document
  3. Brought the Webi Processing server in group 2 down
    • Only the WebI processing server in group 1 is up and running and the user group has no access to this server group.
  4. Logged out and in again
  5. Opened and refreshed the same sample document

Based on your suggestion, I shouldn't have been able to open nor refresh the sample document in step 5, however it worked without a problem.

This would mean that granting/denying users access to servers/server groups does not prevent them from using the server, in this case for opening and refreshing a WebI document.

Here's the relevant paragraph regarding server group access rights from the Administrator Guide:

You can use rights to grant people access to servers and server groups, allowing them to perform tasks such as starting and stopping servers.

If your server team needs to perform regular server maintenance tasks that require them to shut down and start up servers, you need to grant them rights to the servers. You may also want to delegate SAP BusinessObjects Business Intelligence platform server administration tasks to other people. Or you may want different groups within your organization to have control over their own server management.

Judging from this information, assigning rights to server groups should be used from administrative access to the servers, not to decide who get to use the server from an end-user perspective. The latter should be done by assigning server groups to documents/reports. However, this leaves us with the same problem when dealing with ad-hoc reports.

Kind regards,

Kristof Speeckaert

CdnConnection
Active Contributor
0 Kudos

Krsitof,

      The best way to test the security if turn the other services off to make sure the workflow will work with the servers under the server group.  Depending on the type of report you may need other services like, DSL Bridge, Adaptive Connectivity Server. InPut, Output, &/or others.  

You must first confirm the existing workflow will work the servers within the server group, then you test security.

Regards,

Ajay

Former Member
0 Kudos

Hi Ajay,

The workflow (before denying access) was tested and worked; the problem is that it kept working even after denying the user group access to the server group containing the WebI Processing Server.

If the denying access to a server group would be able to prevent someone from opening/refreshing a report, I would've expected an error to appear instead. The next step would've been to add a second server group with an additional WebI Processing Server, to which the user group would have access. This would make it possible to open/refresh the report again.

Kind regards,

Kristof Speeckaert

CdnConnection
Active Contributor
0 Kudos

Kristof,

      I would suggest creating support case with SAP.  I have deployed 3 different Global solutions on BI 4.0 w/ SP4 and the solution work fine if deployed properly.

Regards,

Ajay

Former Member
0 Kudos

Hi Kristof,

Have you find a way with the implementation you specified? did it worked?

Please let us know.

Thanks

Paul