OBIEE 11G INSTALL GUIDE

OVERVIEW

This document provides a step-by-step guide through the install process of OBIEE 11G on a 64-bit Linux machine. The guide assumes that the install process has already taken place in a “lower” environment, and that security, RPD, and catalog objects have been upgraded to be compatible with OBIEE 11g. Therefore, some descriptions and scripts will be referenced that may not be applicable to a “from-scratch” OBIEE 11G upgrade.

PREREQUISITES

1. Additional Filesa. AMC_Security_20110915.py

This file is a WLST script to created against a prior environment upgrade to automate security migration. It contains commands to create all necessary Application Roles and associate them to appropriate Active Directory Groups in WebLogic.

b. AMCBI.rpd The upgraded OBIEE 11G rpd. This file will need to have its connection pools modified

as appropriate for individual environments.c. ‘AMC’ Catalog Folder

The upgraded OBIEE 11G web catalog.d. /u02/fmw/instances/instance1/bifoundation/OracleBIApplication/coreapplication/setup/user.sh

This file sets the proper lib path for ODBC drivers.e. /u02/fmw/instances/instance1/bifoundation/OracleBIApplication/coreapplication/setup/odbc.ini

This file contains ODBC connection information. Its database connections will need to be modified as appropriate for individual environments.

I. RCU

The Repository Creation Utility (RCU) sets up the database schemas to store repository information for your OBIEE 11G implementation. Each environment must have its own repository, so the RCU must be run prior to every new OBIEE 11G install. This repository is NOT the same as the rpd file that is managed via the BI Admin Tool. See RCU.doc for screen prints of the following steps.

1. Run the RCU utility. Once downloaded from Oracle and unzipped, the executable is ../rcuHome/BIN/rcu.bat

2. Welcome Screen: Click Next3. Create Repository: Select “Create” and click Next4. Database Connection Details: Enter the information for the database in which you would like to have the

OBIEE 11G repository schemas. Two new database schemas will be created in this database. Click Next.5. Select Components: Create a new prefix specific to the environment for which you are creating a new

repository. For example, DEV would be a good prefix for a development environment. Under Component, select “Oracle Business Intelligence”. Automatically, under “AS Common Schemas”, “Metadata Services” will also be selected, since it is required as well. “Metadata Services” and “Business Intelligence Platform” should be checked, and the schema owners should be PREFIX_MDS and PREFIX_BIPLATFORM. Click Next.

6. Prerequisites will be checked. Click OK.

7. Schema Passwords: For simplicity, it is recommended that the same password should be used for both schemas. Enter and confirm your desired password, and take note of it, as it will be required during the OBIEE 11G install. Click Next.

8. Map Tablespaces: Leave default tablespaces, or modify as necessary. Click Next.9. The tablespaces will be created. Click OK.10. Summary: A summary of your selections will be displayed for review prior to any schemas being created.

Review and Click Create.11. Completion Summary: A summary of the repository creation will be displayed. Review and Click Close.

II. JROCKIT JDK

The JRockit JDK must be installed for use by WebLogic and OBIEE 11G. See JRockit.doc for screen prints of the following steps.

1. Run the JRockit installer. Once the .bin file has been downloaded, navigate to its directory and enter the following.

chmod a+x jrockit-version-linux-x64.bin ./jrockit-version-linux-x64.bin

2. The installer will launch. Welcome Screen: Click Next.3. Installation directory: Install the JDK to ‘/usr/java/jrockit-version/’. Click Next.4. Optional Components: Click Next.5. The installation will occur. Click Done.

III. WEBLOGIC

The generic version of WebLogic should be installed. It will not initially create and domains or instances. This will allow us to later add OBIEE 11G to the generic WebLogic installation. See weblogic1035_generic.doc for screen prints of the following steps.

1. Completely shut down any OBIEE 10G implementation running on the machine on which WebLogic will be installed.

2. Run the WeLogic installer. Once the .jar file has been downloaded, navigate to its directory and run it using the previously installed JRockit JDK.

/usr/java/jrockit-version/bin/java –d64 –jar wls1035_generic.jar3. The installer will launch. Welcome Screen: Click Next.4. Choose Middleware Home Directory: Enter ‘/u02/fmw’. Click Next.5. Register for Security Updates: Uncheck the checkbox to receive updates and click Next.6. A warning about receiving updates will pop up. Click Yes to remain uninformed.7. Choose Install Type: Select ‘Typical’ and click Next.8. JDK Selection: ensure the the JRockit JDK previously installed is selected and click Next.9. Choose Product Installation Directories: Leave the default directories and click Next.

/u02/fmw/wlserver_10.3 /u02/fmw/coherence_3.6

10. Installation Summary: A summary of your choices will be displayed. Review and click Next.11. The installation will occur.12. Installation Complete: Click Done.

IV. OBIEE 11G

The OBIEE 11G install will be a software-only install, and similar to the generic WebLogic install, it won’t do any configuration. See OBIEE11G.doc for screen prints of the following steps.

1. Run the OBIEE 11G installer. Once all the files have been downloaded and unzipped, navigate to ‘/bishiphome/Disk1/’ and type ‘./runInstaller’.

2. The installer will launch. Welcome Screen: Click Next.3. Install Software Updates: Select “Skip Software Updates” and click Next.4. Select Installation Type: Select “Software Only Install” and click Next.5. Prerequisite Checks: The installer will go through its checklist. When it completes, click Next.6. Specify Installation Location: Keep the default paths. Ensure the Middleware Home matches the location in

which WebLogic was installed. Click Next. Oracle Middleware Home: /u02/fmw Oracle Home Directory: Oracle_BI1

7. Specify Security Updates: Uncheck the checkbox and click Next. 8. A warning will pop up. Click Yes to stay uninformed.9. Summary: A summary of the selections made will be displayed. Review and click Install.10. The installation will occur.11. Complete: A summary of the installation will be displayed. Click Finish.

V. CONFIGURATION ASSISTANT

Once all the software is installed, the configuration assistant must be run to create a working WebLogic Domain and Oracle Business Intelligence instance. See Configuration_Assistant.doc for screen prints of the following steps.

1. Run the Configuration Assistant. Navigate to ‘/u02/fmw/Oracle_BI1/bin’. Run ‘./config.sh’.

2. The Configuration Assistant will launch. Welcome Screen: Click Next.3. Prerequisite Checks: The tool will go through the prerequisite checklist. When it completes, click

Next.4. Create, Scale Out, or Extend: Select ‘Create New BI System’. Leave the default User Name of

‘weblogic’ and Domain Name of ‘bifoundation_domain’. Choose a password for the ‘weblogic’ user, and take note of it for future use. This will be the initial administrative user for WebLogic and OBIEE. Click Next.

5. Specify Installation Location: Leave the default locations and names and click Next. Domain Home:/u02/fmw/user_projects/domains/bifoundation_domain Instance Home: /u02/fmw/instances/instance1 Instance Name: instance1

6. Configure Components: Ensure all components are selected and click Next.7. BIPLATFORM Schema: Enter the database connection information and BIPLATFORM schema

username and password for the repository created with the RCU for the present environment. Click Next.

8. MDS Schema: Enter the database connection information and MDS schema username and password for the repository created with the RCU for the present environment. Click Next.

9. Configure Ports: Select ‘Auto Port Configuration’ and click Next.10. Specify Security Updates: Uncheck the checkbox and click Next.11. A warning regarding security updates will pop up. Click Yes to remain uninformed.12. Summary: A summary of the selections made will be shown. Review and click Configure.13. The configuration will occur.14. When the progress bar reaches 100%, and all tasks are successful, click Next.15. Complete: A summary screen will be shown. Click Finish.16. A web browser will pop up with the OBIEE 11G sign-in screen.

VI. ACTIVE DIRECTORY

Prior to the migration of metadata and catalog objects, it is necessary to set up security, so that when these objects are migrated, the environmental Active Directory groups and BI Application Roles are already present. Active Directory must be set up in WebLogic before any BI specific security can be implemented.

1. Configure Active Directory Authenticator in WebLogica. In the WebLogic Administration Console, navigate to Security Realms -> myrealm.b. Click “Providers” tab, “Authentication” sub-tab. Click “Lock & Edit”.

c. Click the “New” button to create a new Authentication Provider. This is where the Active Directory Authenticator will be configured.

Name: ADAuthenticator Type: ActiveDirectoryAuthenticator

d. Click “Reorder” and set ADAuthenticator to be the first Authentication Provider, then click OK.

e. Click on DefaultAuthenticator to edit its properties.f. In DefaultAuthenticator, set

Control Flag: SUFFICIENTg. Click Save, and navigate back to the Providers tab, Authentication subtab.h. Click on ADAuthenticator to edit its properties.i. In ADAuthenticator, set

Control Flag: SUFFICIENT

j. Click Save, and navigate back to the “Provider Specific” subtab.k. Configure the settings as follows (this is from the Test environment, modify as necessary)

Host AMCDCH0111.homeoffice.amc.corp

Port 389Principal CN=SVCQAOBI,OU=Service

Accounts,OU=HomeOffice,DC=homeoffice,DC=amc,DC=corpCredential [Password for SVCQAOBI user]Confirm Credential [Password for SVCQAOBI user]User Base DN OU=HomeOffice,DC=homeoffice,DC=amc,DC=corpUser From Name Filter (&(sAMAccountName=%u)(objectclass=user))User Name Attribute sAMAccountNameUser Object Class userGroup Base DN OU=Groups,OU=HomeOffice,DC=homeoffice,DC=amc,DC=corpGroup From Name Filter (&(cn=%g)(objectclass=group))GUID Attribute objectguid

l. Click Save. Click “Activate Changes”.2. Since we are using the User Name attribute “sAMAccountName” instead of the default “cn”, we will also

have to add two properties to the Identity Store. Log into the WebLogic Enterprise Manager.a. Open the folder “Weblogic Domain”. Right click on “bifoundation_domain”, and select Security ->

Security Provider Configuration.

b. In the “Identity Store Provider” section, select “Configure…”c. Click the “Add” button to add the following property value pairs:

Property Name: Value:user.login.attr sAMAccountNameusername.attr sAMAccountNamevirtualize true

*The virtualize = true pair allows both the ADAuthenticator and DefaultAuthenticator to work at the same time. We are adding this value now while we are in this section so we don’t have to come back to it later.

d. Click OK3. Reset the System User:

a. In Enterprise Manager, Open the folder “Weblogic Domain”. Right click on “bifoundation_domain”, and select Security -> Credentials

b. Select the “oracle.bi.system” folder, and select the “system.user” key within.c. Click “Edit” and set the BI System username and password (modify as necessary per environment).

User Name: SVCQAOBI Password: [Active Directory Password for SVCQAOBI] Confirm Password: [Active Directory Password for SVCQAOBI]

d. Click OK. 4. Stop and Restart the WebLogic Admin and Managed Servers. This will fully activate all the changes made

thus far, and allow the Active Directory users and groups to be configured within WebLogic.5. Ensure the BI System User is a member of the BI System application role:

a. In Enterprise Manager, Open the folder “Weblogic Domain”. Right click on “bifoundation_domain”, and select Security -> Application Roles.

b. In the Application Roles configuration screen, Select Application Stripe to Search of “obi”, and click the green play button to display all application roles. Select the “BISystem” role and click Edit.

c. At the bottom of the Application Role screen, click “Add User”.d. In the Add User dialog box, add the BI System user specified above (SVCQAOBI) and click OK.e. In the Edit Application Role screen click OK in the upper right of the screen (this is easy to miss, as

it is sometimes scrolled off the screen).

6. Ensure the BI System user is a member of the WebLogic Global Admin role:a. Log into WebLogic Administration Console. Navigate to Security Realms -> myrealm.b. Select the “Roles and Policies” tab, “Realm Roles” subtab.c. In the list of roles, expand “Global Roles”, “Roles”, and in the row for “Admin”, click on “View Role

Conditions”.

d. Ensure that the BI System user (SVCQAOBI) satisfies the Role Conditions. If in doubt, add an OR condition specific to the BI System user:

Click “Add Conditions” Select “User” from the Predicate List. Click Next. Enter the BI System user (SVCQAOBI) into User Argument Name and click Add.

Click Finish. Click Save.7. Add Non-AD users to DefaultAuthenticator:

a. Navigate to Security Realms -> myrealm.b. Under “Users and Groups” tab, “Users” subtab, click New to create custom users not in Active

Directory (‘Administrator’ and ‘oscar’).

c. Click on individual user names to configure a user, then navigate to “Groups” to add the user to specific groups.

User GroupsAdministrator BIAdministratorsoscar BIAdministrators

d. When completed configuring non-AD users, click “Activate Changes”.8. Restart the Admin and Managed Servers. Bring up BI Services.

9. Refresh GUIDs (see Appendix A).10. Test Logging into the BI application. You should be able to login both as Active Directory users and

DefaultAuthenticator users. Please note that Active Directory users will not yet be able to access secured reports, as we have not yet set up Authorization to attach users to Application Roles.

VII. APPLICATION ROLES

Application Roles (formerly RPD groups) allow users to access specific parts of the BI Application. Users are assigned to specific application roles in BI via the Active Directory Groups to which they belong.

Users -> AD Groups -> BI Application Roles

Users are already assigned to AD groups, and specific authorization is applied to BI Application Roles in the RPD and Web Catalog, so the only tasks are to create the Application Roles in WebLogic, then map them to AD groups as appropriate to the BI Application Roles. The Application Role names and associations have been extracted from the Test environment and loaded into a script (“AMC_Security_20110915.py”) to be run in the WebLogic Scripting Tool (WLST).

1. Open the script and verify that it is set to connect to the appropriate environment, with the correct credentials:

connect("weblogic", "password", "hostname:7001")2. Run WLST (Windows): [FMWHome]/oracle_common/common/bin/wlst.cmd “[path]/

AMC_Security_20110915.py”

OR

2. Run WLST (Linux): [FMWHome]/oracle_common/common/bin/wlst.sh “[path]/ AMC_Security_20110915.py”

3. Log into WebLogic Enterprise Manager and confirm that the Application Roles are created and have been associated to the Active Directory Groups.

VIII. DATABASE

Before we migrate the catalog and RPD, we need to make sure that the ODBC settings and tnsnames.ora are correct in the environment, otherwise there will be no data available for the reports.

1. Open the user.sh file. You can find this file at: INSTANCE/bifoundation/OracleBIApplication/coreapplication/setup/user.sh

2. Add the following 2 lines to the file: LD_LIBRARY_PATH=/u02/fmw/Oracle_BI1/bifoundation/odbc/lib:$LD_LIBRARY_PATH

export LD_LIBRARY_PATH3. Save and close the file.4. Open the odbc.ini file. You can find this file at:

INSTANCE/bifoundation/OracleBIApplication/coreapplication/setup/odbc.ini5. Enter the contents of ODBC.ini as necessary for the present environment. It may be useful to copy and

paste from a lower environment, then modify for the present environment.6. Save and close the file.7. Copy the correct “tnsnames.ora” file for the environment to this directory:

MWHOME/Oracle_BI1/network/admin8. Open the Metadata Repository (AMCBI.rpd) with the Administration Tool.9. Modify the connection pools in the repository as appropriate for the present environment.10. Save and close the file.

IX. RPD AND CATALOG

The final step is to deploy the AMC metadata repository and web catalog to the new environment.

1. Copy the ‘AMC’ catalog folder to: INSTANCE/bifoundation/OracleBIPresentationServicesComponent/

coreapplication_obips1/catalog/2. Log into the WebLogic Enterprise Manager. Navigate to “Business Intelligence” -> coreapplication.3. Navigate to Deployment tab, Repository subtab.4. Click “Lock and Edit Configuration”.5. Under the section “Upload BI Server Repository”, click Browse and select AMCBI.rpd.6. Enter the repository password and confirm password. Note that this is the repository password, and not

Administrator password or weblogic password.7. Under the section “BI Presentation Catalog”, set the Catalog Location to:

$ORACLE_INSTANCE/bifoundation/OracleBIPresentationServicesComponent/$COMPONENT_NAME/catalog/AMC

8. Click Apply. Click Activate Changes.9. Navigate to Overview tab. Restart BI Services.10. Once services have restarted, log in to OBIEE and test the repository and web catalog.

X. INSTANCECONFIG.XML

<Views><Pivot><MaxCells>1920000</MaxCells><MaxVisibleColumns>30</MaxVisibleColumns><MaxVisiblePages>1000</MaxVisiblePages>

<MaxVisibleRows>150000</MaxVisibleRows><MaxVisibleSections>25</MaxVisibleSections><DefaultRowsDisplayed>30</DefaultRowsDisplayed><DefaultRowsDisplayedInDelivery>75</DefaultRowsDisplayedInDelivery><DefaultRowsDisplayedInDownload>150000</DefaultRowsDisplayedInDownload><DisableAutoPreview>false</DisableAutoPreview></Pivot><Table><MaxCells>1920000</MaxCells><MaxVisiblePages>1000</MaxVisiblePages><MaxVisibleRows>150000</MaxVisibleRows><MaxVisibleSections>25</MaxVisibleSections><DefaultRowsDisplayed>30</DefaultRowsDisplayed><DefaultRowsDisplayedInDelivery>75</DefaultRowsDisplayedInDelivery><DefaultRowsDisplayedInDownload>150000</DefaultRowsDisplayedInDownload></Table></Views>

A. REFRESHING GUIDSIf you change the directory server used as the identity store for the authentication provider, then you must refresh the user GUIDs as described below. If you do not refresh the GUIDs and the same user name exists in both directory servers (original and new), then the original user GUID might conflict with the user GUID contained in new directory server, resulting in authentication errors.

This task requires that you manually edit the configuration files to instruct Oracle BI Server and Oracle BI Presentation Server to refresh the GUIDs on restart. Once completed, you edit these files to remove the modification. For information about where to locate Oracle Business Intelligence configuration files, see "Where Configuration Files are Located" in Oracle Fusion Middleware System Administrator's Guide for Oracle Business Intelligence Enterprise Edition.

Update the FMW_UPDATE_ROLE_AND_USER_REF_GUIDS parameter in NQSConfig.INI:

Open NQSConfig.INI for editing at:

ORACLE_INSTANCE/config/OracleBIServerComponent/coreapplication_obisn

Locate the FMW_UPDATE_ROLE_AND_USER_REF_GUIDS parameter and set it to YES, as follows:

FMW_UPDATE_ROLE_AND_USER_REF_GUIDS = YES;

Save and close the file.

Update the ps:Catalog element in instanceconfig.xml:

Open instanceconfig.xml for editing at:

ORACLE_INSTANCE/config/OracleBIPresentationServicesComponent/

coreapplication_obipsn

Locate the ps:Catalog element and update it as follows:

<Catalog xmlns:ps="oracle.bi.presentation.services/config/v1.1">

<UpgradeAndExit>false</UpgradeAndExit>

<UpdateAccountGUIDs>UpdateAndExit</UpdateAccountGUIDs>

</Catalog>

Save and close the file.

Start the Oracle Business Intelligence system components

Set the FMW_UPDATE_ROLE_AND_USER_REF_GUIDS parameter in NQSConfig.INI back to NO.

Important: You must perform this step to ensure that your system is secure.

Update the Catalog element in instanceconfig.xml to remove the <UpdateAccount GUIDs> entry.

a. Restart the Oracle Business Intelligence system components