Getting Started with Multitenancy SAP BI 4.1

Transcription

1 September 9 11, 2013 Anaheim, California Getting Started with Multitenancy SAP BI 4.1 Christina Obry, SAP

2 Learning Points Learn how to successfully implement the SAP BusinessObjects BI platform in a multitenant environment Learn about different multitenant deployment models and key considerations for data security and content organization Discover how the Tenant Provisioning Tool allows you to streamline the onboarding of a new tenant, hence reducing error prone manual operations 2

3 Agenda Multitenancy Best Practices for SAP BusinessObjects BI Platform Multitenancy in and BI 4.1 Delegated Administration (BI 4.0 SP4) Custom User Attributes (BI 4.0 SP4) Tenant Provisioning Tool (BI 4.0 SP4) Tenant definition in CMC (BI 4.1) Limitation on concurrent logons per tenant (BI 4.1) Tenant ID in auditing record (BI 4.1) 3

4 Multitenancy Best Practices for SAP BusinessObjects BI Platform 4

5 Deployment options Application (BOE) Application (BOE) Application (BOE) Virtualization Application (BOE) Virtualization Application (BOE) Hardware Hardware Hardware Hardware Single-tenant Single-tenant Multi-tenant

6 Multi-tenancy best practice Data Storage and Schema Security Tenant management Application (BOE) Hardware Operation Customization

7 Data storage and schema BI Platform enables different deployment models Exemplified in three common models Mixed model or variations possible tenant BI content universe database Separate database with distinct semantic layer Separate database with shared semantic layer Shared database and semantic layer

8 Data storage and schema BI Platform enables different deployment models Exemplified in three common models Mixed model or variations possible Strong data separation Simpler database design More flexibility tenant BI content universe database Separate database with distinct semantic layer Separate database with shared semantic layer Shared database and semantic layer

9 Data storage and schema BI Platform enables different deployment models Exemplified in three common models Mixed model or variations possible Strong data separation Lower maintenance of semantic layer and BI content tenant BI content universe database Separate database with distinct semantic layer Separate database with shared semantic layer Shared database and semantic layer

10 Data storage and schema BI Platform enables different deployment models Exemplified in three common models Mixed model or variations possible Maximize resource sharing Lower maintenance of semantic layer and BI content tenant BI content universe database Separate database with distinct semantic layer Separate database with shared semantic layer Shared database and semantic layer

11 BI platform capabilities for multi-tenant data access Table switching by universe restriction Connection switching by universe restriction Universe restriction for row access User identity pass-through for database server side filtering Dynamic query via Universe variable on custom attribute where CompanyCode SI_CompanyCode )

12 BI platform application security Tenants encapsulated in user-groups and partitioned by BI platform folders Authorization controlled by Access Control List (ACL) User accounts typically managed by the containing business application Account created via BI platform SDK Single sign-on by establishing trust between the application and BI platform

13 Tenant management Standard tenant structure to lower administration cost Tenant Provisioning Tool to automate tenant on-boarding process Tenant definition in CMC SAP BI 4.1 Activities of tenant users logged in auditing database SAP BI 4.1 Some administration tasks can be passed back to the tenant Subset of Central Management Console functionalities

14 Operation Hot back-up of BI repository while system running Lifecycle management tool for selective archiving or restoration of tenants BI contents System monitoring to ensure system health and to take proactive action Customer defined condition and alerting Custom probe to check specific BI content or operation, can be tenant specific

15 Customization Common database schema with extension Additional generic database fields Universe restriction for hiding objects from other tenants Quick access to tenant specific BI contents Tenant specific BI launch pad home page Application UI customization BI launch pad style customizable (system wide at the moment)

16 Multitenancy in and BI 4.1

17 Custom User Attributes (1/3) Capability to define some attributes in the CMC that will be attached to each individual user These attributes can be filled manually in the CMC (Enterprise) These attributes can be filled from a LDAP or a SAP data source The CMS must have been configured to authenticate with this data source Define the attribute from LDAP / SAP data source to provide actual values

18 Custom User Attributes (2/3) New Page in the CMC to list and administer Custom User Attributes Value of Custom User Attributes for each user is displayed in the CMC, in the user properties dialog Administrator can explicitly enter the value for Custom User Attributes defined in the CMS repository Values retrieved from LDAP and SAP data source are displayed

19 Custom User Attributes (3/3) Attributes exposed in the Semantic Layer Available Use the internal name (prefixed with SI_) ( SI_TENANT ( SI_COUNTRY ) Can be used In any MDX/SQL Editor In Business Layer Filter In Data Security Profile and Business Security Profile for security filtering Substituted at Query Time

20 CMC Tab Access CMC application has a large number of tabs. For example CMC has a Folders tab for document management, a Users and Groups tab for user management, a Servers tab for server management, etc. In the previous version of BOE the delegated administrators would have access to all available CMC tabs. In, a system administrator now has the capability to hide any of the CMC tabs that a delegated administrator is not expected to use. For example a delegated administrator in charge of content management may have access to Folders and Users and Groups tab, while other tabs are hidden

21 Security Rights and CMC Tab Access Management of CMC tab access affects the visual appearance of the CMC user interface. Hiding of CMC tabs is not a security measure. It does not set or modify security rights on objects within tabs. To ensure that users cannot perform unauthorized operations on unauthorized objects (for example, manage servers through the Central Configuration Manager or third-party software based on the BI platform SDK), you must set appropriate security rights on objects (for example on server objects). Always set proper security rights on objects inside the CMC tab in addition to setting up CMC tab access. The Administrator user will always have access to all CMC tabs.

22 Enable Restricting CMC Tab Access

23 Managing CMC Tab Access

24 Managing CMC Tab Access (Cont)

25 Managing CMC Tab Access (Cont)

26 Managing CMC Tab Access (Cont)

27 Delegated Administrators User Groups To simplify CMC tab management you can create a set of delegated administrator user groups. You can grant CMC tab access by making an existing user or user group a member of a delegated administrator user group without configuring CMC tab access individually. The following user groups may be created, but it can be modified for specific business needs. User Group System Administrators User Administrators Content Administrators CMC Tabs Access Granted Grant access to all tabs. Grant access to Access Levels, Folders, Inboxes, Personal Folders, Personal Categories, Query Results, Sessions, and User and Groups. Set all other tabs to Inherited. Grant access to Calendars, Categories, Events, Folders, Instance Manager, Personal Categories, Personal Folders, Profiles, Query Results, and Universes. Set all other tabs to Inherited. Server Administrators Grant access to Servers and Applications. Set all other tabs to Inherited. Membership in multiple groups will result in the addition of rights, if the rights are set to Inherited.

28 Tenant Provisioning Tool Tenant Onboarding Process Tenants in a multi-tenants system have structural similarity. Tenant templates serve as model to manage tenants in a well defined and repeatable manner. Create an exemplar tenant in the system: Do once for all tenants Using standard tools such as CMC and Universe designer Run the Command line tool to add a new tenant

29 Tenant Provisioning Tool Automatable Operations Operations automated by the tenant provisioning tool Creating user groups Creating folders Setting ACL (Access Control List) on folders Copying documents and universes from template folder to individual tenant folder Adding universe restrictions for UNV only Creating connections Materializing tenant objects from template

30 Tenant Provisioning Tool Tenant Template Definition File Tenant template definition file describes the location of tenant template, and specifies run time options tenantname=companyabc templatetoken=$tenanttemplate$ templatecontentfolder =$TenantTemplate$_; templateuniversefolder =$TenantTemplate$ templateconnectionfolder =$TenantTemplate$ templatecategoryfolder =$TenantTemplate$ templateeventfolder=/custom Events/ $TenantTemplate$; Just an extract! optionincludeuniverses=false optionincludeconnections=false optionincludecategories=true optionincludeevents=true optionincludeaccesslevels=true optionuseshareduniverses=false

31 Tenant Provisioning Tool Provisioning After a tenant is created, the standard content (documents, universe, connection) can still undergo changes. New stock BI documents made available to tenants Changes to stock BI documents Changes to stock universe The tool does not handle the situation where a content copied to the tenant is modified by the tenant itself as well as by the central provider. In this case the tool would not attempt any merging of changes from two paths.

32 Tenant Provisioning Tool Tenant Template Template Folders User Group templates Template Documents

33 Tenant Provisioning Tool Run time Tenant_template_def.properties

34 Tenant Provisioning Tool Run time You run the tenant provisioning tool from the Command Prompt. When done it shows you what it created.

35 Tenant Provisioning Tool Run time Your Access Levels content before running the tenant provisioning tool. Your Access Levels content after running the tenant provisioning tool.

36 Tenant Provisioning Tool Run time Tenant specific content

37 Tenant Provisioning Tool - Supported Document Scenarios Direct to data: CR CR4Ent Shared database and semantic layer CR4Ent connected to single-source unx, pquery and BICS WebI connected to unv including universe restriction overload WebI connected to single-source unx, BICS (as of 4.1) Separate database with distinct semantic layer CR4Ent connected to single source unx WebI connected to unv and single-source unx (as of 4.1.) Separate database with shared semantic layer WebI connected to unv using universe connection overload / SAP BI 4.1

38 Tenant definition in CMC (1/4) SAP BI 4.1 Tenants that were onboarded via the tenant onboarding command line tool are now visible in a new Multitenancy tab in the CMC

39 Tenant definition in CMC (2/4) SAP BI 4.1 Ability to change tenant properties such as tenant name, concurrent user limit and associated user groups

40 Tenant definition in CMC (3/4) SAP BI 4.1 Ability to see which user or user group belongs to which tenant New Tenant column is filterable

41 Tenant definition in CMC (4/4) SAP BI 4.1 Ability to delete a tenant and all its associate infoobjects with the option to exclude certain infoobjects

42 Limitation on concurrent logons per tenant (1/2) Ensure service availability by limiting the number of concurrent users that a tenant can logon at a given time. Once the tenant's limit has been reached no further tenant s users will be able to log on until another tenant's user has logged out. SAP BI 4.1

43 Limitation on concurrent logons per tenant (2/2) SAP BI 4.1 Ability to set concurrent user limit at tenant onboarding time in the tenant definition file or via CMC UI # (Mandatory) Name of the tenant being added. tenantname=xyz # (Mandatory) Template token identifier used for tenant name replacing templatetoken=$tenant_template$ # (Optional) Number of concurrent users allowed for the tenant being # added. Defaults to -1 meaning unlimited in which # case the number of concurrent users for this tenant will only be # limited by what the BOE license key allows # for the entire system. When not specified, this option will be set to # default during the tenant's first on-board, # or unchanged during tenant's provisioning. # - Tenant specific info tenantconcurrentuserlimit=100

44 Tenant ID in auditing record SAP BI 4.1 Ability to track system usages by tenant using auditing functionality Applications can include tenant billing that depends on resources utilization. For example the following metrics can be used for billing: number of logons by a tenant, number of report views or refreshes, etc. Enable and configure auditing events that you are interested it. To determine which auditing event is generated by which tenant use 2 new lookup tables in the auditing database: ADS_TENANT and ADS_USER

45 New Tables SAP BI 4.1 ADS_TENANT table: Cluster_ID Tenant_ID Tenant_Name AWNaY20WHpGok DNah47WHhsKZ Company A ADS_USER table: Cluster_ID Tenant_ID User_ID User_Name AWNaY20WHpGok DNah47WHhsKZ SBUn83SZOw_91 John McGreg Joins should be performed between: ADS_TENANT.Tenant_ID and ADS_USER.Tenant_ID ADS_USER.User_ID and ADS_EVENT.User_ID ADS_TENANT.Cluster_ID and ADS_CLUSTER_Cluster_ID ADS_USER.Cluster_ID and ADS_CLUSTER_Cluster_ID

46 More Information Business Intelligence Platform Multitenancy Guide Enabling SaaS Solutions with Multitenant BI Best Practices (based on BI 3.1) Best Practices for BI 4.x Shared Service Deployments Overview of SAP BI 4.x Multitenancy Management Tool Delegated administration in User Attribute Mapping in BI4 - in depth

47 Questions? 47

48 Thank you for participating. Please provide feedback on this session by completing a short survey via the event mobile application. SESSION CODE: 0315 Learn more year-round at