ODI View Access Appears to Incorrectly Allow Users to Modify Variable Expressions
Last updated on JANUARY 03, 2018
Applies to:Oracle Data Integrator - Version 22.214.171.124.6 to 126.96.36.199.0 [Release 12c]
Information in this document applies to any platform.
Oracle Data Integrator (ODI) allows for different access privileges to user accounts.
A "Guest" user is configured with read-only access to variables. However, the user appears to be able to make modifications to the Expression on the "Refreshing" tab. The user can press the "Save" button without an error message, and the modification appears to be saved. However, when refreshing the variable (by closing and opening it), the modification is reverted back to the original value, and the variable modification is not actually saved (which is correct).
The user should not be able to modify the expression or anything about the variable in the first place. As read-only access, the user should only be able to view and export, but not edit it.
A. Create the Guest User
- Log into Studio as a supervisor
- Duplicate "NG Designer" Profile, ie "Guest - NG Designer"
- Go To "Authorization" tab
- Select Object Variables, and unselect all options. Select only "View" and "Export"
- Select Object "User Functions", and unselect all options. Select only "View" and "Export"
NOTE: for the purpose of this test we have left all other default settings
- Save the profile
- Create a new user "Guest"
- Assign the following profiles to user:
CONNECT, CONSOLE, Guest - NG Designer
B. Modify the Variable
- Log into Studio as the new guest user.
- In Designer tab, expand a project, ie "TEST"
- Expand "Variables" and open a Variable, ie: "V_CHECK_STATUS"
- Go to "Refreshing" tab, notice that everything is "greyed out" usually indicating that no changes can be done
- Click the "Pencil" icon
- Make changes in "Edit Expression" , ie add "abc"
- Select OK
- Observe that the change made appears in the "Select Query"
- Save the Variable, notice that "Select Query" still shows "abc"
- Close the Variable and open it again
- Notice that the "Select Query" on the "Refreshing" tab is reverted back to the original setting
Sign In with your My Oracle Support account
Don't have a My Oracle Support account? Click to get started
My Oracle Support provides customers with access to over a
Million Knowledge Articles and hundreds of Community platforms