OBIEE 11G INSTALL GUIDE

OVERVIEW
This document provides a step-by-step guide through the install process of OBIEE 11G on a 64-bit Linux machine. The guide assumes that the install process has already taken place in a lower environment, and that security, RPD, and catalog objects have been upgraded to be compatible with OBIEE 11g. Therefore, some descriptions and scripts will be referenced that may not be applicable to a from-scratch OBIEE 11G upgrade.

PREREQUISITES
1. Additional Files a. AMC_Security_20110915.py This file is a WLST script to created against a prior environment upgrade to automate security migration. It contains commands to create all necessary Application Roles and associate them to appropriate Active Directory Groups in WebLogic. b. AMCBI.rpd The upgraded OBIEE 11G rpd. This file will need to have its connection pools modified as appropriate for individual environments. c. AMC Catalog Folder The upgraded OBIEE 11G web catalog. d. /u02/fmw/instances/instance1/bifoundation/OracleBIApplication/coreapplication/setup/user.sh This file sets the proper lib path for ODBC drivers. e. /u02/fmw/instances/instance1/bifoundation/OracleBIApplication/coreapplication/setup/odbc.ini This file contains ODBC connection information. Its database connections will need to be modified as appropriate for individual environments.

I. RCU
The Repository Creation Utility (RCU) sets up the database schemas to store repository information for your OBIEE 11G implementation. Each environment must have its own repository, so the RCU must be run prior to every new OBIEE 11G install. This repository is NOT the same as the rpd file that is managed via the BI Admin Tool. See RCU.doc for screen prints of the following steps. 1. 2. 3. 4. 5. Run the RCU utility. Once downloaded from Oracle and unzipped, the executable is ../rcuHome/BIN/rcu.bat Welcome Screen: Click Next Create Repository: Select Create and click Next Database Connection Details: Enter the information for the database in which you would like to have the OBIEE 11G repository schemas. Two new database schemas will be created in this database. Click Next. Select Components: Create a new prefix specific to the environment for which you are creating a new repository. For example, DEV would be a good prefix for a development environment. Under Component, select Oracle Business Intelligence. Automatically, under AS Common Schemas, Metadata Services will also be selected, since it is required as well. Metadata Services and Business Intelligence Platform should be checked, and the schema owners should be PREFIX_MDS and PREFIX_BIPLATFORM. Click Next. Prerequisites will be checked. Click OK.

6.

7.

Schema Passwords: For simplicity, it is recommended that the same password should be used for both schemas. Enter and confirm your desired password, and take note of it, as it will be required during the OBIEE 11G install. Click Next. 8. Map Tablespaces: Leave default tablespaces, or modify as necessary. Click Next. 9. The tablespaces will be created. Click OK. 10. Summary: A summary of your selections will be displayed for review prior to any schemas being created. Review and Click Create. 11. Completion Summary: A summary of the repository creation will be displayed. Review and Click Close.

II. JROCKIT JDK

The JRockit JDK must be installed for use by WebLogic and OBIEE 11G. See JRockit.doc for screen prints of the following steps. 1. Run the JRockit installer. Once the .bin file has been downloaded, navigate to its directory and enter the following. chmod a+x jrockit-version-linux-x64.bin ./jrockit-version-linux-x64.bin The installer will launch. Welcome Screen: Click Next. Installation directory: Install the JDK to /usr/java/jrockit-version/. Click Next. Optional Components: Click Next. The installation will occur. Click Done.

2. 3. 4. 5.

III. WEBLOGIC
The generic version of WebLogic should be installed. It will not initially create and domains or instances. This will allow us to later add OBIEE 11G to the generic WebLogic installation. See weblogic1035_generic.doc for screen prints of the following steps. 1. Completely shut down any OBIEE 10G implementation running on the machine on which WebLogic will be installed. 2. Run the WeLogic installer. Once the .jar file has been downloaded, navigate to its directory and run it using the previously installed JRockit JDK. /usr/java/jrockit-version/bin/java d64 jar wls1035_generic.jar 3. The installer will launch. Welcome Screen: Click Next. 4. Choose Middleware Home Directory: Enter /u02/fmw. Click Next. 5. Register for Security Updates: Uncheck the checkbox to receive updates and click Next. 6. A warning about receiving updates will pop up. Click Yes to remain uninformed. 7. Choose Install Type: Select Typical and click Next. 8. JDK Selection: ensure the the JRockit JDK previously installed is selected and click Next. 9. Choose Product Installation Directories: Leave the default directories and click Next. /u02/fmw/wlserver_10.3 /u02/fmw/coherence_3.6 10. Installation Summary: A summary of your choices will be displayed. Review and click Next. 11. The installation will occur. 12. Installation Complete: Click Done.

IV. OBIEE 11G

The OBIEE 11G install will be a software-only install, and similar to the generic WebLogic install, it wont do any configuration. See OBIEE11G.doc for screen prints of the following steps. 1. Run the OBIEE 11G installer. Once all the files have been downloaded and unzipped, navigate to /bishiphome/Disk1/ and type ./runInstaller. 2. The installer will launch. Welcome Screen: Click Next. 3. Install Software Updates: Select Skip Software Updates and click Next. 4. Select Installation Type: Select Software Only Install and click Next. 5. Prerequisite Checks: The installer will go through its checklist. When it completes, click Next. 6. Specify Installation Location: Keep the default paths. Ensure the Middleware Home matches the location in which WebLogic was installed. Click Next. Oracle Middleware Home: /u02/fmw Oracle Home Directory: Oracle_BI1 7. Specify Security Updates: Uncheck the checkbox and click Next. 8. A warning will pop up. Click Yes to stay uninformed. 9. Summary: A summary of the selections made will be displayed. Review and click Install. 10. The installation will occur. 11. Complete: A summary of the installation will be displayed. Click Finish.

V. CONFIGURATION ASSISTANT
Once all the software is installed, the configuration assistant must be run to create a working WebLogic Domain and Oracle Business Intelligence instance. See Configuration_Assistant.doc for screen prints of the following steps. 1. 2. 3. 4. Run the Configuration Assistant. Navigate to /u02/fmw/Oracle_BI1/bin. Run ./config.sh. The Configuration Assistant will launch. Welcome Screen: Click Next. Prerequisite Checks: The tool will go through the prerequisite checklist. When it completes, click Next. Create, Scale Out, or Extend: Select Create New BI System. Leave the default User Name of weblogic and Domain Name of bifoundation_domain. Choose a password for the weblogic user, and take note of it for future use. This will be the initial administrative user for WebLogic and OBIEE. Click Next. Specify Installation Location: Leave the default locations and names and click Next. Domain Home:/u02/fmw/user_projects/domains/bifoundation_domain Instance Home: /u02/fmw/instances/instance1 Instance Name: instance1 Configure Components: Ensure all components are selected and click Next. BIPLATFORM Schema: Enter the database connection information and BIPLATFORM schema username and password for the repository created with the RCU for the present environment. Click Next.

5.

6. 7.

8. 9. 10. 11. 12. 13. 14. 15. 16.

MDS Schema: Enter the database connection information and MDS schema username and password for the repository created with the RCU for the present environment. Click Next. Configure Ports: Select Auto Port Configuration and click Next. Specify Security Updates: Uncheck the checkbox and click Next. A warning regarding security updates will pop up. Click Yes to remain uninformed. Summary: A summary of the selections made will be shown. Review and click Configure. The configuration will occur. When the progress bar reaches 100%, and all tasks are successful, click Next. Complete: A summary screen will be shown. Click Finish. A web browser will pop up with the OBIEE 11G sign-in screen.

VI. ACTIVE DIRECTORY

Prior to the migration of metadata and catalog objects, it is necessary to set up security, so that when these objects are migrated, the environmental Active Directory groups and BI Application Roles are already present. Active Directory must be set up in WebLogic before any BI specific security can be implemented. 1. Configure Active Directory Authenticator in WebLogic a. In the WebLogic Administration Console, navigate to Security Realms -> myrealm. b. Click Providers tab, Authentication sub-tab. Click Lock & Edit.

c.

Click the New button to create a new Authentication Provider. This is where the Active Directory Authenticator will be configured. Name: ADAuthenticator Type: ActiveDirectoryAuthenticator

d.

Click Reorder and set ADAuthenticator to be the first Authentication Provider, then click OK.

e. f. g. h. i.

Click on DefaultAuthenticator to edit its properties. In DefaultAuthenticator, set Control Flag: SUFFICIENT Click Save, and navigate back to the Providers tab, Authentication subtab. Click on ADAuthenticator to edit its properties. In ADAuthenticator, set Control Flag: SUFFICIENT

j. k.

Click Save, and navigate back to the Provider Specific subtab. Configure the settings as follows (this is from the Test environment, modify as necessary)

Host Port Principal Credential Confirm Credential User Base DN User From Name Filter User Name Attribute User Object Class Group Base DN Group From Name Filter GUID Attribute

AMCDCH0111.homeoffice.amc.corp 389 CN=SVCQAOBI,OU=Service Accounts,OU=HomeOffice,DC=homeoffice,DC=amc,DC=corp [Password for SVCQAOBI user] [Password for SVCQAOBI user] OU=HomeOffice,DC=homeoffice,DC=amc,DC=corp (&(sAMAccountName=%u)(objectclass=user)) sAMAccountName user OU=Groups,OU=HomeOffice,DC=homeoffice,DC=amc,DC=corp (&(cn=%g)(objectclass=group)) objectguid

2.

l. Click Save. Click Activate Changes. Since we are using the User Name attribute sAMAccountName instead of the default cn, we will also have to add two properties to the Identity Store. Log into the WebLogic Enterprise Manager. a. Open the folder Weblogic Domain. Right click on bifoundation_domain, and select Security -> Security Provider Configuration.

b. c.

In the Identity Store Provider section, select Configure Click the Add button to add the following property value pairs: Property Name: Value: user.login.attr sAMAccountName username.attr sAMAccountName virtualize true *The virtualize = true pair allows both the ADAuthenticator and DefaultAuthenticator to work at the same time. We are adding this value now while we are in this section so we dont have to come back to it later.

3.

d. Click OK Reset the System User: a. In Enterprise Manager, Open the folder Weblogic Domain. Right click on bifoundation_domain, and select Security -> Credentials b. Select the oracle.bi.system folder, and select the system.user key within. c. Click Edit and set the BI System username and password (modify as necessary per environment). User Name: SVCQAOBI Password: [Active Directory Password for SVCQAOBI] Confirm Password: [Active Directory Password for SVCQAOBI]

4. 5.

d. Click OK. Stop and Restart the WebLogic Admin and Managed Servers. This will fully activate all the changes made thus far, and allow the Active Directory users and groups to be configured within WebLogic. Ensure the BI System User is a member of the BI System application role: a. In Enterprise Manager, Open the folder Weblogic Domain. Right click on bifoundation_domain, and select Security -> Application Roles. b. In the Application Roles configuration screen, Select Application Stripe to Search of obi, and click the green play button to display all application roles. Select the BISystem role and click Edit. c. At the bottom of the Application Role screen, click Add User. d. In the Add User dialog box, add the BI System user specified above (SVCQAOBI) and click OK. e. In the Edit Application Role screen click OK in the upper right of the screen (this is easy to miss, as it is sometimes scrolled off the screen).

6.

Ensure the BI System user is a member of the WebLogic Global Admin role: a. Log into WebLogic Administration Console. Navigate to Security Realms -> myrealm. b. Select the Roles and Policies tab, Realm Roles subtab. c. In the list of roles, expand Global Roles, Roles, and in the row for Admin, click on View Role Conditions.

d.

Ensure that the BI System user (SVCQAOBI) satisfies the Role Conditions. If in doubt, add an OR condition specific to the BI System user: Click Add Conditions Select User from the Predicate List. Click Next. Enter the BI System user (SVCQAOBI) into User Argument Name and click Add.

Click Finish. Click Save.

7.

Add Non-AD users to DefaultAuthenticator: a. Navigate to Security Realms -> myrealm. b. Under Users and Groups tab, Users subtab, click New to create custom users not in Active Directory (Administrator and oscar).

c.

Click on individual user names to configure a user, then navigate to Groups to add the user to specific groups. User Groups Administrator BIAdministrators oscar BIAdministrators

8.

d. When completed configuring non-AD users, click Activate Changes. Restart the Admin and Managed Servers. Bring up BI Services.

9. Refresh GUIDs (see Appendix A). 10. Test Logging into the BI application. You should be able to login both as Active Directory users and DefaultAuthenticator users. Please note that Active Directory users will not yet be able to access secured reports, as we have not yet set up Authorization to attach users to Application Roles.

VII. APPLICATION ROLES

Application Roles (formerly RPD groups) allow users to access specific parts of the BI Application. Users are assigned to specific application roles in BI via the Active Directory Groups to which they belong. Users -> AD Groups -> BI Application Roles Users are already assigned to AD groups, and specific authorization is applied to BI Application Roles in the RPD and Web Catalog, so the only tasks are to create the Application Roles in WebLogic, then map them to AD groups as appropriate to the BI Application Roles. The Application Role names and associations have been extracted from the Test environment and loaded into a script (AMC_Security_20110915.py) to be run in the WebLogic Scripting Tool (WLST). 1. Open the script and verify that it is set to connect to the appropriate environment, with the correct credentials:
connect("weblogic", "password", "hostname:7001")

2.

Run WLST (Windows): [FMWHome]/oracle_common/common/bin/wlst.cmd [path]/

AMC_Security_20110915.py

OR 2. Run WLST (Linux): [FMWHome]/oracle_common/common/bin/wlst.sh [path]/

AMC_Security_20110915.py

3.

Log into WebLogic Enterprise Manager and confirm that the Application Roles are created and have been associated to the Active Directory Groups.

VIII. DATABASE
Before we migrate the catalog and RPD, we need to make sure that the ODBC settings and tnsnames.ora are correct in the environment, otherwise there will be no data available for the reports.

1. 2.

Open the user.sh file. You can find this file at: INSTANCE/bifoundation/OracleBIApplication/coreapplication/setup/user.sh Add the following 2 lines to the file:
LD_LIBRARY_PATH=/u02/fmw/Oracle_BI1/bifoundation/odbc/lib:$LD_LIBRARY_PATH export LD_LIBRARY_PATH

3. 4. 5. 6. 7.

Save and close the file. Open the odbc.ini file. You can find this file at: INSTANCE/bifoundation/OracleBIApplication/coreapplication/setup/odbc.ini Enter the contents of ODBC.ini as necessary for the present environment. It may be useful to copy and paste from a lower environment, then modify for the present environment. Save and close the file. Copy the correct tnsnames.ora file for the environment to this directory:
MWHOME/Oracle_BI1/network/admin

8. Open the Metadata Repository (AMCBI.rpd) with the Administration Tool. 9. Modify the connection pools in the repository as appropriate for the present environment. 10. Save and close the file.

IX. RPD AND CATALOG

The final step is to deploy the AMC metadata repository and web catalog to the new environment. 1. Copy the AMC catalog folder to:
INSTANCE/bifoundation/OracleBIPresentationServicesComponent/coreapplicatio n_obips1/catalog/

2. 3. 4. 5. 6. 7.

Log into the WebLogic Enterprise Manager. Navigate to Business Intelligence -> coreapplication. Navigate to Deployment tab, Repository subtab. Click Lock and Edit Configuration. Under the section Upload BI Server Repository, click Browse and select AMCBI.rpd. Enter the repository password and confirm password. Note that this is the repository password, and not Administrator password or weblogic password. Under the section BI Presentation Catalog, set the Catalog Location to:
$ORACLE_INSTANCE/bifoundation/OracleBIPresentationServicesComponent/$COMPO NENT_NAME/catalog/AMC

8. Click Apply. Click Activate Changes. 9. Navigate to Overview tab. Restart BI Services. 10. Once services have restarted, log in to OBIEE and test the repository and web catalog.

X. INSTANCECONFIG.XML

<Views> <Pivot> <MaxCells>1920000</MaxCells> <MaxVisibleColumns>30</MaxVisibleColumns>

<MaxVisiblePages>1000</MaxVisiblePages> <MaxVisibleRows>150000</MaxVisibleRows> <MaxVisibleSections>25</MaxVisibleSections> <DefaultRowsDisplayed>30</DefaultRowsDisplayed> <DefaultRowsDisplayedInDelivery>75</DefaultRowsDisplayedInDelivery> <DefaultRowsDisplayedInDownload>150000</DefaultRowsDisplayedInDownload> <DisableAutoPreview>false</DisableAutoPreview> </Pivot> <Table> <MaxCells>1920000</MaxCells> <MaxVisiblePages>1000</MaxVisiblePages> <MaxVisibleRows>150000</MaxVisibleRows> <MaxVisibleSections>25</MaxVisibleSections> <DefaultRowsDisplayed>30</DefaultRowsDisplayed> <DefaultRowsDisplayedInDelivery>75</DefaultRowsDisplayedInDelivery> <DefaultRowsDisplayedInDownload>150000</DefaultRowsDisplayedInDownload> </Table> </Views>

A. REFRESHING GUIDS
If you change the directory server used as the identity store for the authentication provider, then you must refresh the user GUIDs as described below. If you do not refresh the GUIDs and the same user name exists in both directory servers (original and new), then the original user GUID might conflict with the user GUID contained in new directory server, resulting in authentication errors. This task requires that you manually edit the configuration files to instruct Oracle BI Server and Oracle BI Presentation Server to refresh the GUIDs on restart. Once completed, you edit these files to remove the modification. For information about where to locate Oracle Business Intelligence configuration files, see "Where Configuration Files are Located" in Oracle Fusion Middleware System Administrator's Guide for Oracle Business Intelligence Enterprise Edition. Update the FMW_UPDATE_ROLE_AND_USER_REF_GUIDS parameter in NQSConfig.INI: Open NQSConfig.INI for editing at:

ORACLE_INSTANCE/config/OracleBIServerComponent/coreapplication_obisn Locate the FMW_UPDATE_ROLE_AND_USER_REF_GUIDS parameter and set it to YES, as follows: FMW_UPDATE_ROLE_AND_USER_REF_GUIDS = YES; Save and close the file. Update the ps:Catalog element in instanceconfig.xml: Open instanceconfig.xml for editing at: ORACLE_INSTANCE/config/OracleBIPresentationServicesComponent/ coreapplication_obipsn Locate the ps:Catalog element and update it as follows: <Catalog xmlns:ps="oracle.bi.presentation.services/config/v1.1"> <UpgradeAndExit>false</UpgradeAndExit> <UpdateAccountGUIDs>UpdateAndExit</UpdateAccountGUIDs> </Catalog> Save and close the file. Start the Oracle Business Intelligence system components Set the FMW_UPDATE_ROLE_AND_USER_REF_GUIDS parameter in NQSConfig.INI back to NO. Important: You must perform this step to ensure that your system is secure. Update the Catalog element in instanceconfig.xml to remove the <UpdateAccount GUIDs> entry.
a. Restart the Oracle Business Intelligence system components