Ranzal Practice Director, Chris Barbieri conducted this presentation at the recent ODTUG Kaleidoscope conference in Long Beach, California.

1. Security and Auditing in HFM
Chris Barbieri
Edgewater Ranzal

2. About Edgewater Ranzal
One of the Largest Hyperion
Practices in the U.S.
Oracle / Hyperion Platinum
Partner - Highest Status
15 Years
700+ clients Vertical Expertise with High-
1000+ projects Profile Clients from Coast to
Coast
Sound Project Methodology
Insures Project Success
“One Stop Shop” for ALL EPM
Implementation needs

3. Our Services
Business
Consolidation Planning
Intelligence
Data Project
Infrastructure
Services Management

4. Agenda
● Roles
● The verbs actions a user can perform
verbs:
● Review roles for:
● HFM
● Reporting and Analysis
● Shared Services
● Classes
● The nouns objects on which you can perform
nouns:
those actions
● Auditing and Reporting
● Who did what and when
what, when?

5. Shared Service Console
● Central module where most security
management is performed

6. Provision
● EPM System predefines tasks or collections
of tasks into Roles
● For now, let’s start with a user… Joe Admin
● Select the username, right-click, and Provision

7. Available Roles
● List of roles from registered products
● Presented either by product, or Application
Group
● All roles are listed and explained in the
hss_admin.pdf
● V25453-01EPM System Installation Documentation
EPM System Installation

8. Foundation Roles
● Roles are listed in
a hierarchy
● Called “Aggregate
Roles”
● Access to the
parent yields its
children
● Can have alternate
roll-ups
● Used in Reporting
and Analysis

9. EPMA Dimension Management
● Grant all users Shared Services “Dimension Editor
Dimension Editor”
role
● Select each dimension in the dimension library, and
choose “System” from category menu

10. Calc Manager
● Two HFM roles
● Rules Designer
● Rules Viewer
● One Shared services role
● …per product

11. Provisioning Manager
● Role for each application and product
● Allows the user to grant/remove role and class
access to other users
● Cannot provision themselves
● … unless they have the Shared Services
Administrator role
● Application Administrator does not allow
provisioning

12. Reporting and Analysis Roles
● Majority of roles relate to Interactive
Reporting / Production Reporting
● Appendix “A” in the hss_admin.pdf document
lists all of the roles, by product

13. FR Role Recommendations
Role Administrator Report Writer Viewer
Reporting and Analysis Yes
Administrator
Report Designer implied Yes
Explorer implied Yes Yes
● Administrator can do anything but provision
other users
● Report Designer still needs the Studio client
● Explorer grants access to the full list of reports
● … subject to the folder/object level access

14. Hyperion Financial Management
Roles: Administrator
● “Administrator role permits all tasks
Administrator”
● “ALL” access to all classes
● … but not Provisioning Manager
● Independent of access to the
“Administration” menu items
● These are not application specific
● Create Application
● Enable/disable connections
● Users on System, etc.
● EPM System configurator > Financial
Management > Configure Application Server

15. Configure HFM System
Administrators
● Application Security
● Creator Group
● Can create new Classic
applications
● Administrator Group
● Can be Native or External
group
● Almost always left at “*” =
EVERYONE / WORLD
● Must be changed later, as part
of security design process

16. Hyperion Financial Management
Roles: Power User
● Typical setup, excluding Process Management

17. Hyperion Financial Management
Roles: End User
● Typical setup, excluding Process Management

18. Secure at Group or User Level?
● Best practice is to apply security at the group
level
● Then manage group membership for the users
● This becomes a bad approach when
#Groups > #Users

19. Native or External?
● Users
● Leverage security policies from external providers
(MSAD/LDAP)
● Native has no password policy management
● Groups
● Greatest flexibility in Native groups
● Allows IT security to control users
● Hyperion admins are best suited to control access
● Place users into groups
● Provision or assign class access as needed
● Provide reports for auditing

20. Classes
1. Create classes
● Dimension in EPMA
● Create inside Shared Services module in
Classic
2. Assign to metadata or HFM documents
● Entities, Accounts, Customs, Scenarios
● Grids/ forms/ journals/ system reports
3. Assign access to the classes
● User or group must have at least one role
● If no other role applies, then grant Default role

21. Group Naming Schemes
● “Role” access for the various modules
● rg_EPMA_* for EPMA
rg_
● rg_HFMAppName_* for the HFM application
rg_
● rg_ReportWriters modify Financial Reports
rg_
● rg_Security for access to Shared Services
rg_
● HFM dimension access groups
● eg_HFMAppName_* = “entity dimension access
eg_ entity”
● dsg_HFMAppName_* = “data source dimension
dsg_ data source”
access (Custom4)
● sg_FMRLCA_* = “scenario dimension access
sg_ scenario”

22. Class Naming Schemes
● Prefix classes according to the dimension they
secure
● ec*: entity class
ec*
● ac*:
ac* account class
● c1c*..c4c*
c1c* c4c*: custom dimension class
● Where possible, use the dimension alias
● dsc*: DataSource class, instead of Custom4
dsc*
● sc*:
sc* scenario class
● dc*:
dc* document class
● Classes are only sorted alphanumerically
● Not searchable

23. Assign Dimension Groups to
Classes
● Right-click on HFM
application
● Assign Access Control

24. Select HFM Users / Groups
● Only users or groups
that have been directly
assigned at least one
role will show up
● If you use groups,
always use groups
● Dimension groups
Default”
must have “Default
role for the HFM app
● Users / Groups
selected here are
available for a report

25. Select HFM Classes
● Where the
alphanumeric
order, and the
class prefix
comes in
handy…
● Classes
selected are
available for a
report

26. Class Access Rights
Access Right Description
All Full read/write access to the data or objects to which this class has been
assigned.
Read Read rights to the data or objects to which this class has been assigned.
None No rights at all.
If “Enable Metadata Security Filtering” has been turned on for the application,
users with “None” access to a class won’t even see the member in a metadata
pick list, nor will they see an object with this class attached. If a user opens a
grid, form, or report for an intersection where they have “None” rights, HFM
will return “NoAccess” instead of the data value.
Metadata Overrides the Metadata Security filtering by allowing the member to be seen
in a pick list, though the user will be unable to view the contained data.
This setting is not common

27. Assign Class Access
● Pivot as you like
● Highlight rows/columns
● Change the Access Right for the selection
● Click the check mark to activate
● And save

28. HFM Role and Class Access Report
● Output to html, Excel, CSV, PDF

29. Sample Output

30. Shared Services Role Report
● Administration > View Report
● Show Effective Roles = Yes
● Shows what users inherit from group membership

31. Sample Output

32. Configure Auditing in Shared
Services
● Track changes in user
provisioning
● Track configuration
changes
● Not enabled, by default
● Enable this for all products
and applications
● Purge after so many days
● Save changes, restart
services

33. Shared Services Audit Reports>
>
Security Reports
● Authentication and security changes

34. Security Reports: Detailed View

35. Shared Services Audit Reports>
>
Artifact Reports
● Lifecycle Management selections

36. Shared Services Audit Reports>
>
Config Reports
● Changes to settings in Shared Services

37. Speed Tip for Multiple External
Providers
● Normally a user name is passed sequentially among
the external providers: MSADEast; MSADWest;
MSADEurope, etc.
● First, try using a Global Catalog
● Try using group filters to more quickly isolate the users
you want
● Advanced Filters on Groups
● Or go directly to a single provider

38. Data Audit in HFM
● Enable DataAudit on Account and Scenario
● Non-FDM only, please

39. Administration > Data Audit
● Captures
changes to
<Entity Currency>
only
● Small increase in
data load times
● No impact on
consolidation time

40. Task Audit in HFM
● Always enabled
● Captures lots of
information
● … but not
everything
● Administration >
Task Audit

41. Questions
Chris Barbieri
cbarbieri@ranzal.com
+1.617.480.6173
www.ranzal.com

42. Presentations
Calculation Manager: The New and Improved Application to Create Hyperion Planning
Business Rules – Monday, 11:15 am, Room 102C
Security and Auditing in HFM – Tuesday, 4:30pm, 101B
Best Practices for Using DRM with EPMA – Wednesday, 8:30am, 103A
Getting Started with Calc Manager for HFM – Wednesday, 8:30am, 101B
Advanced Topics in Calc Manager for HFM – Wednesday, 9:45am, 101B
Maximizing the Value of an EPM Investment with ERPi, FDM & EPMA – Wednesday,
11:15am, 101B
Taking your FDM application to the next level with Advanced Scripting – Friday,
8:30am, 101B
IFRS reporting within Hyperion Financial Management – Thursday, 10:30am, 101B

43. www.ranzal.com
Chris Barbieri
cbarbieri@ranzal.com
+1.617.480.6173
www.ranzal.com