Sunday, 27 June 2010

11.1.2 Planning – Mapping Reporting Application

I must apologise for the lack of blog activity recently, I have had a few people asking why and to be honest I just don’t have the time lately, I have to research and produce all the content in my spare time and other more important tasks have taken priority. I also had to spend a bit of time building up a new server that could handle all that the hungry version 11.1.2 could throw at it.

I have been meaning to go through all the new functionality in planning 11.1.2, there are quite a few changes and additions in this new release, planning has had a bit of an overhaul in some areas. I thought maybe some of the new content may have been covered in other blogs but I have not seen much, so until it is covered I will go through what I can.

Today I am going to look at a new piece of functionality that lets you map data from a planning BSO database to one or more BSO/ASO databases.

One example of why you may want to use this functionality is you say you have a reporting database such as an ASO database reporting actuals and you want to push a proportion of the forecast/budget data from the planning application into the ASO model. It could also be that you have a number of different cubes that you need to push different areas of data to from your planning application

In the past if you wanted to achieve this you would create a partition between the BSO planning database and the ASO database, this could sometimes be troublesome because when planning refreshes it destroys the partition so you would have to put in an automated process to get around this.

When I first read about this new functionality I assumed it would create a replicated partition and push the data to the mapped database, I thought it would manage the partition so it wasn’t destroyed with a refresh, this is not the way it works though but more about that later.

Right, so let’s go through how to set up a mapping.

My source is going to be the trusty Planning sample application (Plansamp)



The Plansamp application has dimensions: - HSP_Rates (not that you usually see this dimension from within planning), Account, Period, Year, Entity, Segments, Currency, Scenario and Version.

The target database is a ASO database (PlanASO) loosely based on the BSO db.



The dimensionality is similar except it doesn’t contain the HSP_Rates, Currency & Version dimensions, the Products dimension is closely linked with Segments dimension of BSO db.



The segments dimensional structure of the planning sample db in case you have not seen it before.



As you can see the ASO products dimension is very similar, basically AllSegments equals AllProducts, Seg01 equals Prod01, Seg02 equals Prod02.



A quick high-level retrieve from the ASO db shows Actual data but Plan/Forecast is missing.



The planning sample db contains the Plan/Forecast data I want to push to the ASO db, these are the steps to perform to map the data.



To access the mapping functionality go to Administration > Map Reporting Application.



First you give a name to your mapping and then select the essbase database you want to map to, it is possible to add essbase servers if the default server doesn’t contain the database you require.



The next screen is the main mapping section, this is where you define which members from the source planning database will map to your target database dimensions.

The map dimensions screen will automatically map all the dimensions that match between source and target.

As the target reporting application is ASO the rule is all the mappings have to map to level0 members in the ASO database.

All the members that are mapped must resided in both and target applications.

If the reporting application is a block storage database, then the default members can be any stored members on the target database.

So basically you just need to go through and map the areas that you want to push data to your reporting application.

By default the selection will be all level 0 descendants of the dimension.



If you click the member selection button you are given a number of different member functions to choose from.



There are three mapping types available, “dimension to dimension” which is selected by default.

“Not Linked” – which is saying there is no direct mapping between the dimensions, this could be used if you say you wanted “Forecast” in your source to be mapped “Actual” in your target or you want to map a number of members in your source to one member in your target, this is defined in the “Point of View” section which is the next page in the configuration.

“Smart List to Dimension” - Displays the available Smart Lists. When a Smart List is selected, the account members associated with it are displayed. If there is only one member, it is automatically selected.



With Smart List to dimension mapping, the source plan type must contain a dense Account dimension with at least one member associated with a Smart List.

I did have an issue using the smart list functionality, every time I went to save the mapping it came up with a JavaScript alert popup warning “You must select a member for the Planning dimension”. I left it there with the smart list error until I have a look at resolving another day.

Right back to the mapping, as I highlighted earlier the source segments members are slightly different to the target product members.

I would of thought I could just select Level 0 descendants of “AllSegments” as that should pick all the correct members I want to map.



Unfortunately there is a rule that states :-

If Descendants (“AllSegments”) is selected in a mapping, the “AllSegments” member must exist in the reporting application.



This meant I had to map where the member names matched.



Once all members have been mapped you move on to the “Point of View” section.



This is where you can define which members are used in the source mapping that does not exist in the target. As “Version” and “Currency” don’t exist in the reporting application the members of where the data needed to be taken from the source were chosen.

The POV section is also used when you choose “Not Linked” as the mapping type, which I briefly went over earlier.

The dimension “HSP_Rates” is automatically dealt with if it doesn’t exist in your target, so you won’t see it appearing anywhere unless the dimension did exist in your target.

Once the mappings have been saved you have the option to “Push Data” which will invoke your mappings and move the data from source to target.



You are given two options; you can either just do a straight push or choose to clear out the data against your defined area on the target first.



A quick retrieve of the data on the target and you can see the plan, forecast data has been pushed across.



Like with everything I am not happy until I know what is going on behind the scenes, is it a partition?

Well the answer is no, if you have a look in the planning applications essbase log you will get an idea of what is happening.



The essbase calculation command DATAEXPORT is being executed, so I assume that a calc script is generated in the background with a FIX on the members defined in the mappings.
If you don’t know much about the DATAEXPORT command it is worthwhile checking out the essbase technical reference documentation. -

Something you be aware of when you using DATAEXPORT is dynamic calc members can severely hit the performance of the export so watch out for this if you are going to use this functionality.

Now when using the command the output is either sent to a flat file or to a relational database table using an ODBC DSN. In this case it is using a flat file and you can find out what file it is generating by going to “Tools” > “Job Console” in planning.



If you click the link under “Run Status” it will open a window with further information.



The export generates a csv file a temporary directory, if you go into the directory after you have run a push data the file will still exist.

I would watch out because it looks like this directory does not get cleaned out and if you start running big data exports are a number of times it could easily start consuming a fair bit of space on the drive.



If you open the file the output looks exactly the same as if you would of created your own calc script using the DATAEXPORT command.



After the output csv file has been produced, the output is then transformed into another flat file (.txt) to map to target members or remove any unnecessary dimensions, in my case remove HSP_Rates, Version and Currency dimensions.



The text file is then loaded into target reporting database adding to any existing values.



If you choose the option of “Clear data on destination..” then the data for the area that has been defined will be removed.



If it is an ASO application then the equivalent of the Maxl

alter database appname.dbname clear data in region 'MDX set expression' physical;” is executed.

I assuming it is a physical and not a logical clear that is executed, as I don’t see a slice created after pushing data.

If the reporting application is a BSO type database then a CLEARDATA command will be executed for the area that has been defined.

I don’t see any utility to run this from command line so if you wanted to push data you would have to log into planning and run it manually.

Anyway the functionality can easily be replicated and scheduled by creating maxl script running a calc script that contains the DATAEXPORT command and then a data load.

Well that’s enough covered for today, I will let you decide if you are impressed with this new functionality.

Until next time whenever that may be.

Friday, 28 May 2010

EPM 11.1.2 – Life after OpenLdap

You may or not be aware that from version 11.1.2 OpenLdap has been finally dropped, many will warm to the culling of this problematic piece of software. Personally I have never been a fan or seen the need for using it, I have lost count the amount of times I have been involved with recovering the database from a serious failure.

Oracle have rightly gone down the route of replacing OpenLdap with using a RDBMS source, it is simple but an effective replacement and has been incorporated into the Foundation relational storage piece. This now fits in line with a wide range of the Oracle EPM product set using a RDBMS engine to store its information.
You may wonder why it was not done sooner.


If you have a look in your Foundation (Shared Services) database you will see 13 tables prefixed with CSS



These tables are now the core to provisioning with Shared Services. I will cover some of the tables in more detail shortly.

Another big change in this release with regards to provisioning is that there is no need to refresh essbase security once a new user/group is provisioned with a role against essbase in Shared Services.

This means the user/group information that was stored in the essbase.sec file is now being pushed into Shared Services tables and essbase has been updated to communicate directly with Shared Services.

The security refresh of essbase from Shared Services has always been an irritant and the removal of it is a welcome change.

So let me prove it does work and at the same time show you what is happening in the Shared Services relational tables.

If you are not interested in the tables and the SQL generated (and there is plenty of it) for provisioning then now is a good time to leave and do something far more interesting.



First a native user is created in Shared Services.



The creation of a native user will generate 2 records being written to 2 tables, the first table is CSS_IDENTIFY where it stores the native user value and a lower case version of it.

The SQL that is generated is :-

insert into "CSS_IDENTITY"("IDENTITY_ID","LOWER_IDENTITY_ID") values ('native://nvid=871ba2ae9678192d:-6132c2e4:1287e41a072:-7ed3?USER',
'native://nvid=871ba2ae9678192d:-6132c2e4:1287e41a072:-7ed3?user');




If you ever took a look at previous releases and checked out the code generated for a native OpenLdap user/group it would look something like :-

native://DN=cn=4e3bfafb605e4946:-7f90ab6e:11ff233f82d:-7b85,ou=People,dc=css,dc=hyperion,dc=com?USER

So the format of the value has changed, I am not yet sure how this will affect migrations from earlier releases to 11.1.2, I know there is no upgrade path from previous versions though I am not sure if that is meant to include migrations, it is something I will testing in the near future.




The second record that is inserted is into the table CSS_USERS, this table holds user information such as username, password, email etc..



The SQL generated is a long the lines of :-

insert into “CSS_USERS"("IDENTITY_ID","NAME","PASSWORD","FIRSTNAME","LASTNAME",
"DESCRIPTION",
"EMAIL","ACCOUNTSTATUS","CREATEDBY","UPDATEDBY",
"CREATEDTIMESTAMP",
"UPDATEDTIMESTAMP","LOWER_IDENTITY_ID",
"LOWER_NAME")
values ('native://nvid=871ba2ae9678192d:-6132c2e4:1287e41a072:-7ed3?USER',
'essuser','{SSHA}G/iurdcY1Aoe24xnt4m8yQqqLuJgd1Bb',NULL,NULL,NULL,
NULL,'1','admin','admin',TO_DATE('09-MAY-10', 'DD-MON-RR'),
TO_DATE('09-MAY-10', 'DD-MON-RR'),
'native://nvid=871ba2ae9678192d:-6132c2e4:1287e41a072:-7ed3?user',
'essuser');




Ok, so that is the sequence when a native user is created so now let’s provision the user with an essbase role.



This time one record is written to table CSS_PROVISIONING_INFO



The table holds the provisioning information for a user/group and links back to the CSS_USERS table by column MEMBER_IDENTITY to IDENTITY_ID



The SQL generated follows the format of :-

insert into “CSS_PROVISIONING_INFO"("APPLICATION_ID","MEMBER_IDENTITY","ROLE_IDENTITY","MEMBER_TYPE",
"CREATEDBY","CREATEDTIMESTAMP","LOWER_APPLICATION_ID",
"LOWER_MEMBER_IDENTITY",
"LOWER_ROLE_IDENTITY")
values ('ESB:Analytic Servers:win2008x64:1',
'native://nvid=871ba2ae9678192d:-6132c2e4:1287e41a072:-7ed3?USER',
'native://DN=cn=ESB:0009,ou=ESB,ou=Roles,dc=css,dc=hyperion,dc=com?ROLE',
'1','admin',TO_DATE('09-MAY-10', 'DD-MON-RR'),
'esb:analyticservers:win2008x64:1',
'native://nvid=871ba2ae9678192d:-6132c2e4:1287e41a072:-7ed3?user',
'native://dn=cn=esb:0009,ou=esb,ou=roles,dc=css,dc=hyperion,dc=com?role');


The application and role information are contained in columns APPLICATION_ID and ROLE_IDENTITY, in this case it is describing the Essbase Server name and the role of “Server Access”, I will go into more detail shortly on how this table links with another table to get more meaningful role information from the ROLE_IDENTITY column.


Look no refresh from Shared Services

Anyway in EAS expand security and take a look at the users you will see that the user is instantly added, no need to refresh security.



And you will be able to log straight into essbase without any issues.



If you check the essbase log output you will notice it is slightly different from previous versions, when logging in the directory that the user belongs to e.g. @Native Directory is logged and when logging out the native id is also logged.

This is how it gets logged in previous version.



If you export the security file then you will see the user information still gets written to it, it is just that it does not used in the same way anyway.



I was also interested in seeing if the provisioning of user for planning has changed in this release, previously if you provisioned an existing essbase user for a planning application and then had a look at the security in EAS it would not show the user as an “Essbase and Planning” access type until you either ran a planning refresh, executed the provisionusers utility or the user logged into the planning application.



The existing essbase user was provisioned for the PLANSAMP planning application.
This would create a new record in the CSS_PROVISONING_INFO table and the SQL generated is similar to the one shown earlier.

insert into “CSS_PROVISIONING_INFO"("APPLICATION_ID","MEMBER_IDENTITY","ROLE_IDENTITY","MEMBER_TYPE",
"CREATEDBY","CREATEDTIMESTAMP","LOWER_APPLICATION_ID",
"LOWER_MEMBER_IDENTITY",

"LOWER_ROLE_IDENTITY") values ('HP:PLANSAMP',
'native://nvid=871ba2ae9678192d:-6132c2e4:1287e41a072:-7ed3?USER',
'native://DN=cn=HP:0001,ou=HP,ou=Roles,dc=css,dc=hyperion,dc=com?ROLE',
'1','admin',TO_DATE('09-MAY-10', 'DD-MON-RR'),
'hp:plansamp',
'native://nvid=871ba2ae9678192d:-6132c2e4:1287e41a072:-7ed3?user',
'native://dn=cn=hp:0001,ou=hp,ou=roles,dc=css,dc=hyperion,dc=com?role');


This time the Application id is “HP:PLANSAMP”.



The users information is instantly updated in EAS so it does prove that essbase is now talking directly with Shared Services.


There is no change in regards to the user information being written to the planning applications HSP_USERS table when a user is provisioned against a planning application, it still requires the user to log in or a refresh to be run to populate the table.



The only difference is the new style native SID is used.


So what about an Active Directory user, what happens when they are provisioned in Shared Services.



There is no real difference in the way Active Directory information is accessed in Shared Services.



The active directory user is provisioned for two roles, an essbase calc role and a planner role.

A record is inserted into the CSS_IDENTITY table with the OBJECTGUID that relates to the user.

insert into “CSS_IDENTITY"("IDENTITY_ID","LOWER_IDENTITY_ID") values ('msad://OBJECTGUID=\a9\1a\6a\81\fc\64\d3\42\a9\69\43\11\6a\96\a5\a4?USER','msad://objectguid=\a9\1a\6a\81\fc\64\d3\42\a9\69\43\11\6a\96\a5\a4?user');

No record is inserted into the CSS_USERS table as the user already exists in the AD and the user information can be queried directly from the AD using the OBJECTGUID.



Like with a native user a record is inserted into the CSS_PROVISIONING_INFO table for each role that has been applied.

Essbase Sample – Calc Role

insert into "CSS_PROVISIONING_INFO"("APPLICATION_ID","MEMBER_IDENTITY","ROLE_IDENTITY","MEMBER_TYPE",
"CREATEDBY","CREATEDTIMESTAMP","LOWER_APPLICATION_ID",
"LOWER_MEMBER_IDENTITY","LOWER_ROLE_IDENTITY") values ('ESBAPP:Sample_win2008x64_1',
'msad://OBJECTGUID=\a9\1a\6a\81\fc\64\d3\42\a9\69\43\11\6a\96\a5\a4?USER',
'native://DN=cn=ESBAPP:0005,ou=ESBAPP,ou=Roles,dc=css,dc=hyperion,dc=com?ROLE',
'1','admin',TO_DATE('15-MAY-10', 'DD-MON-RR'),
'esbapp:sample_win2008x64_1',
'msad://objectguid=\a9\1a\6a\81\fc\64\d3\42\a9\69\43\11\6a\96\a5\a4?user',
'native://dn=cn=esbapp:0005,ou=esbapp,ou=roles,dc=css,dc=hyperion,dc=com?role');


Planning – PlanSamp – Planner role

insert into "CSS_PROVISIONING_INFO"("APPLICATION_ID","MEMBER_IDENTITY","ROLE_IDENTITY","MEMBER_TYPE",
"CREATEDBY","CREATEDTIMESTAMP","LOWER_APPLICATION_ID",
"LOWER_MEMBER_IDENTITY","LOWER_ROLE_IDENTITY") values ('HP:PLANSAMP',
'msad://OBJECTGUID=\a9\1a\6a\81\fc\64\d3\42\a9\69\43\11\6a\96\a5\a4?USER',
'native://DN=cn=HP:0001,ou=HP,ou=Roles,dc=css,dc=hyperion,dc=com?ROLE',
'1','admin',TO_DATE('15-MAY-10', 'DD-MON-RR'),
'hp:plansamp',
'msad://objectguid=\a9\1a\6a\81\fc\64\d3\42\a9\69\43\11\6a\96\a5\a4?user',
'native://dn=cn=hp:0001,ou=hp,ou=roles,dc=css,dc=hyperion,dc=com?role');


And if you check security in EAS you will see the AD user has been instantly provisioned with Essbase and Planning Roles.



Once again no need for a refresh and logging in as the AD user will produce the same sort of logging information in essbase as with a Native user.



So what about Groups?



A new native group was created.



And the user essuser was added to the group, once this was applied the following SQL is generated and executed.

insert into "CSS_IDENTITY"("IDENTITY_ID","LOWER_IDENTITY_ID") values ('native://nvid=2c571170edfbf9c6:-6429c4d1:128cb73e13b:-7ed2?GROUP',
'native://nvid=2c571170edfbf9c6:-6429c4d1:128cb73e13b:-7ed2?group');


This creates the native identity of the group.

insert into “CSS_GROUPS"("IDENTITY_ID","NAME","DESCRIPTION","CREATEDBY","UPDATEDBY",
"CREATEDTIMESTAMP","UPDATEDTIMESTAMP","LOWER_IDENTITY_ID",
"LOWER_NAME") values ('native://nvid=2c571170edfbf9c6:-6429c4d1:128cb73e13b:-7ed2?GROUP',
'essgroup',
NULL,'admin','admin',TO_DATE('24-MAY-10', 'DD-MON-RR'),
TO_DATE('24-MAY-10', 'DD-MON RR'),
'native://nvid=2c571170edfbf9c6:-6429c4d1:128cb73e13b:-7ed2?group',
'essgroup');




This creates the information about the group e.g. name, description and identity.

insert into “CSS_GROUP_MEMBERS"("GROUP_IDENTITY","MEMBER_IDENTITY","MEMBER_TYPE",
"LOWER_GROUP_IDENTITY",

"LOWER_MEMBER_IDENTITY") values ('native://nvid=2c571170edfbf9c6:-6429c4d1:128cb73e13b:-7ed2?GROUP',
'native://nvid=871ba2ae9678192d:-6132c2e4:1287e41a072:-7ed3?USER','1',
'native://nvid=2c571170edfbf9c6:-6429c4d1:128cb73e13b:-7ed2?group',
'native://nvid=871ba2ae9678192d:-6132c2e4:1287e41a072:-7ed3?user');




This assigns the user (essuser) by identity to the group (essgroup) by identity.

There are another couple of insert to the table CSS_GROUP_CACHE_DELTA, I am not quite sure what this table is used for, obviously some sort of caching but I didn’t think important to show the SQL generated.

So how do you find out a role name and description from the role identity written to the provisioning table.

The two records that were written above the role identities were:-

Essbase Calc - native://dn=cn=esbapp:0005,ou=esbapp,ou=roles,dc=css,dc=hyperion,dc=com?role

Planning planner role -

native://dn=cn=esbapp:0005,ou=esbapp,ou=roles,dc=css,dc=hyperion,dc=com?role


To do this the CSS_ROLE_LOCALES table can be queried.



The NAME and DESCRIPTION columns are the fields you will be interested in, you will also need to filter on the Locale otherwise records will be returned for each locale (n different locales)

If you combine the provisioning info and locale table you can return role information by user.



So if you want to start generating provisioning reports then it is relatively simple to query the tables directly.

The burning question that was niggling at me was do the products now communicate directly with the relational tables or do they go via the Shared Services web app in anyway. 

The easy was to find out was to stop the Foundation Managed Server.

Once stopped, I fired up essbase.



No problems there, looks to have started.



A quick check of the SharedServices_Security_Client.log (in \Oracle\Middleware\user_projects\epmsystem1\diagnostics\logs\essbase\essbase) and you can see essbase directly communicating with the shared services relational source using JDBC and a message indicates the CSS system is fully initialized.



Another test logging in as an AD user, so it does look like essbase communicates directly with the relational information and does not go through the HSS web app.

I also tested EAS, Studio and Planning and they both followed the same communication method, obviously anything that uses workspace would need the Foundation managed server to be started.

I must stress that I am not saying to start using the system like this; it was just to prove a point.
It also indicates that if you are having problems logging in to the system then the first place to check is that the rdbms database is up and running and you can communicate with it across the network.

Well there we have it a quick look at life after OpenLdap, definitely the way forward.