A business users case study of seamless drillback from OBIEE/OBIA key metrics dashboards to transactional detail in eBusiness Suite

1. COLLABORATE 14 Copyright ©2014 by Preet Shah, Linda Flood, John Fortado P a g e 1
From Dashboards to Transactional Detail - Seamless drillback to EBS
Preet Shah Linda Flood John Fortado
Humana Humana Emtec
Abstract:
A business user’s case study of seamless drillback from OBIEE/OBIA key metrics dashboards to transactional detail
in eBusiness Suite and beyond to Kofax images. It will cover corporate security setup and requirements in EBS and
OBIEE and also implementing seamless navigation to EBS passing through row level data filtering.
The presentation objectives will demonstrate what is the need to implement the drillback and also covers the
implementation process.
The Business Case:
With pressure to grow and protect revenue and profitability, Oracle Business Intelligence Analytics provides the
tools to leverage insight into enterprise wide data. OBIA out-of-the-box provides drilldown through its many
aggregations, and provides the capabilities of drillback to eBusiness Suite detail. We will present a business users
case study and overview of seamless drillback from OBIEE/OBIA key metrics dashboards to transactional detail in
eBusiness Suite and beyond to Kofax images. Kofax is an add-on product which integrates with EBS providing
access to invoice and other receipt images linked to row items within EBS. We will review corporate security setup
in EBS and OBIEE necessary to access and implement seamless navigation to EBS passing through row level data
filtering. Security integration between OBIEE and EBS can be a seemingly daunting task and requires some
knowledge of a number of enterprise layers including system servers, network domains and protocols, fusion
middleware, weblogic, rpd variables, initblocks, the physical layer, the object layer, the presentation layer, role and
responsibilities permissions, data filters, dashboard administration, EBS Forms and Menu Security.
In the past few years Humana has achieved tremendous growth but the current system and tools remain
unchanged. This left Humana at risk to human error, inaccurate closing and audit requirements. The Business and
the IT faced the following challenges:
• Custom OBIEE 10g platform
• Only GL Summary data to data warehouse
• No sub-ledger data for Procurement, Projects, AP or AR
• No drill back to source data for immediate results on issues
• Volume growth in source data and external reporting requirements will not be sustainable
• Data mining was the way for analysis and reconciliation
• IT was over whelmed with all ad-hoc report requirements
• Rudimentary reporting tools like Excel, MS databases and silo reporting tools like Hyperion and
Discoverer are being used for dashboards and KPI’s

2. COLLABORATE 14 Copyright ©2014 by Preet Shah, Linda Flood, John Fortado P a g e 2
The business was looking to introduce automation, improve productivity, accuracy and provide insight into
transaction. The business team required a single software solution that would provide a company wide data
source for accessing and reviewing calculations and transactions. The business drivers and expectations for the
desired system would allow the following:
• The ability to use OBIEE as a front end to connect directly to sub-ledger detailed data
• Produce reporting at a summary level on actual and budget information that allows for the drill back
to the transactional level detail for research and reconciliation purposes
 Able to replace disparate access databases and other places data is extracted and stored for data
such as AP detail
• Provide insights into procurement and spends for the budget managers
• Leverage data mining to OBIEE for analysis and reconciliation
• Implement drill back capabilities from summary GL level reporting, down to sub-ledger detail, back to
the origin of the transaction which could be back to the AP invoice, including the image, the purchase
order including the actual PO, Accounts receivable receipt, etc.
• Provide operational reporting to support the daily business process
• Analyze accounting entries at the transactional level for accruals, invoice and payments.
The OBIA key metrics of income, cash flow, the balance sheet, payables, receivables, inventory management, and
resource effectiveness provide us with a good measure of business health. It is available on-demand and updated
daily. It is available in context with the enterprise to the granularity of the department, allowing drilldown to
detail and drillback to line item detail within EBS. Drilldown is the ability to click on an object on a dashboard and
be taken to the underlying data. Drillback is ability to click on an object and be taken into the source system to
the associated line item – in our case, an invoice image.
Without drillback, getting to the detail is a time consuming process which involves logging into EBS, navigating
through the form sequence to the necessary form, downloading the data result set for import to Excel the
analyzing and comparing with other Excel sheets. The time from report initiation to decision point can be hours. It
entails downloading a data set to excel, further data manipulation and analysis, comparison between sheets.
Significant manual intervention is required to produce the data points necessary for making a well-informed
judgment.
The risks of human error, inaccurate invoicing and audit requirements are abundantly present. As more contracts
are negotiated with new requirements of protection against unit cost inflation and other complex contract
language the current system and tools simply could not handle this effectively. The home grown solution
extracted information from the EDW (Enterprise Data Warehouse) and then processed the billing and payment
data.
The overall benefits of OBIA allow integration with the current eBusinessSuite which is Humana’s book of record
and a single stand-alone application solution to process the entire cycle of the business process. Accounts
Receivable creates invoices, receives payments, tracks collections and invoices. General Ledger houses accounting
entries for customer invoices, payments, and adjustments. With OBIA the data and analysis are single sourced and
available on demand, creating a goto knowledge base that is updated daily and is accessible locally, online, and via
mobile devices. With drillback, getting to detail is a matter of clicking on a cell in a dashboard table activating an

3. COLLABORATE 14 Copyright ©2014 by Preet Shah, Linda Flood, John Fortado P a g e 3
action link which takes the cell value back to a designated form within EBS and calls that form into a browser
window for display. The time to a decision point can be minutes.
The achievements and benefits are recognized as
• A single goto application
• Accurate calculations
• Application and IT performance
• Successful processing of high data volume and growth
The Technical Detail:
Preparing the system for drillback involves a large number of configuration changes and security settings. It is
necessary to first implement single sign-on between eBusinessSuite and Business Intelligence. Humana installed
OBIA 7.9.6.3 and OBIEE 11.1.1.6 then upgraded and patched to 11.1.1.7.114. For complete details of integrating
with EBS, please refer to the Oracle Documentation including:
Oracle® Fusion Middleware Integrator's Guide for Oracle Business Intelligence Enterprise
Edition 11g Release 1 (11.1.1) E16364-04
Oracle® Fusion Middleware Security Guide for Oracle Business Intelligence Enterprise Edition 11g
Release 1 (11.1.1) E10543-06
Oracle® Business Intelligence Applications Fusion Edition Installation and
Configuration Guide Release 7.9.5 E12083-01
Oracle® Business Intelligence Applications Integrating Oracle Business Intelligence
Applications with Oracle E-Business Suite document 1343143.1
Oracle® Business Intelligence Applications Security Guide Release 7.9.6.4 E35621-01
Implementing Data Security for Oracle E-Business Suite 11i in
Oracle Business Intelligence Applications 7.9.3 (Doc ID 475387.1)
Integrating Oracle Business Intelligence Applications with Oracle E-Business Suite
Saurabh Gautam 6/9/2011 (Oracle White Paper)
To integrate OBIEE with EBS, we will create a database object and connection pool in the rpd which will connect to
EBS. The connection will require an EBS database user with access to the Oracle call library and system security
tables (FND_%). It must be able to call function APP_SESSION.validate_icx_session(). This call will be issued from
the initblock when the EBS user links back to OBIEE from within EBS and will attach the OBIEE session to the EBS
session.
Additional session variables are required for Authentication with EBS and must be added to this initblock:
SELECT
FND_GLOBAL.RESP_ID, EBS_ RESP_ID
FND_GLOBAL.RESP_APPL_ID, EBS_RESP_APPL_ID
FND_GLOBAL.SECURITY_GROUP_ID, EBS_ SECURITY_GROUP_ID
FND_GLOBAL.RESP_NAME, EBS_ RESP_NAME
FND_GLOBAL.USER_ID, EBS_USER_ID
FND_GLOBAL.EMPLOYEE_ID, EBS_EMPLOYEE_ID

4. COLLABORATE 14 Copyright ©2014 by Preet Shah, Linda Flood, John Fortado P a g e 4
FND_GLOBAL.USER_NAME, USER
FROM DUAL
To allow native user access to the system, uncheck ‘Required for Authentication’. Roles will be created
dynamically by the Authorization InitBlock, so do not create it here as a static variable. It will be added later.
Note that USER in the Authentication Initblock must be deleted. This will likely cause subsequent errors in existing
Identities which will need to be repaired. They will be identified when doing a consistency check on the RPD. The
USER variable must be populated by the EBS query in the EBS initblock that is created to do this for single sign-on.
To correct the error, open the Identity Manager Manage  Identity Application Roles  Primary
Employee/Position Hierarchy-based Security  Properties  Permissions and change all formulas to use
NQ_SESSION.USER.
The Authentication Initblock must now be modified and enabled. The datasource must be changed to
SELECT DISTINCT 'ROLES',
RESPONSIBILITY_NAME FROM
FND_USER,FND_USER_RESP_GROUPS, FND_RESPONSIBILITY_VL
WHERE
FND_USER.user_id=FND_USER_RESP_GROUPS.user_id AND
FND_USER_RESP_GROUPS.RESPONSIBILITY_ID = FND_RESPONSIBILITY_VL.RESPONSIBILITY_ID
AND FND_USER_RESP_GROUPS.RESPONSIBILITY_APPLICATION_ID =
FND_RESPONSIBILITY_VL.APPLICATION_ID AND
FND_USER_RESP_GROUPS.START_DATE < SYSDATE AND
(CASE WHEN FND_USER_RESP_GROUPS.END_DATE IS NULL THEN SYSDATE
ELSE TO_DATE(FND_USER_RESP_GROUPS.end_Date) END) >= SYSDATE
AND FND_USER.user_id = (SELECT USER_ID FROM FND_USER WHERE
UPPER(USER_NAME) = UPPER('VALUEOF(NQ_SESSION.USER)')) ;
This populates the ROLES session variable dynamically, which requires that it be set to row-wise. This now enables
EBS responsibilities to be carried over to OBIEE as roles.
It is important that OBIEE be accessible via SSL as EBS will be running SSL and the transport agencies must match in
order to utilize the same session cookie. This also requires that the servers be in the same domain or be
configured so through DNS. On a test installation, the default SSL supplied with Weblogic may be utilized although
a user will be consistently warned about the invalid certificate. Should Weblogic fail to start because of a
replication channel error, enable the secure replication channel through the WLS console in
environmentClustersbi_clusterReplication. Note that turning on the SSL listener in Weblogic can cause the
RPD connection from the admin tool to fail with a communications error unless SSL is switched on in the ODBC
connection utilized by the admin tool. Open the ODBC administrator and check “Use SSL”.
The instanceconfig.xml file must be changed to enable the EBS-ICX schema and to implement the logoff button.
This will apply a logoff link below the address bar. Without the logoff button, it can become necessary to clear
cookies, close and restart the browser in order to login again cleanly.
The authenticationschemas.xml file must be changed to use EBS-ICX and accept the named cookie from EBS. Note
that the cookie name is case sensitive. This is the cookie that identifies the EBS session to which the OBIEE session
will attach via an OCI call. This can be verified through sqlplus with a
call APP_SESSION.validate_icx_session('Ie9bhcYlZgyXCizAFQscmHeYUM');
where the encrypted string is the cookie value set in the named cookie upon login to EBS.
EBS responsibilities must now be added within Weblogic’s Enterprise Manager as created roles - coreapplication 
Security  Application Roles. This will allow for permissions to be assigned on the Presentation Layer Subject

5. COLLABORATE 14 Copyright ©2014 by Preet Shah, Linda Flood, John Fortado P a g e 5
areas, dashboards and the catalog.
Once all roles are created in WLS, they may be assigned permissions using the OBIEE Administration page
Administration  Security  Manage Privileges. Finally, the EBS side must be configured, by embedding the URL
to OBIEE/Analytics into the EBS menu structures.
Row Level Security begins with configuring the Oracle pre-defined security role, Operating Unit Org. An initblock
must be defined within the RPD to access the EBS security tables to capture the Operating Unit Org set belonging
to the responsibilities of the current user. The sql to retrieve this data set is available in the Oracle documentation:
SELECT DISTINCT
'OU_ORG', TO_CHAR(PER_ORGANIZATION_LIST.ORGANIZATION_ID)
FROM
PER_ORGANIZATION_LIST,
(SELECT
FND_PROFILE.VALUE_SPECIFIC('XLA_MO_SECURITY_PROFILE_LEVEL', USER_ID,
RESPONSIBILITY_ID, RESPONSIBILITY_APPLICATION_ID) PROFILE_ID
FROM
(SELECT
FND_USER_RESP_GROUPS.USER_ID,
FND_USER_RESP_GROUPS.RESPONSIBILITY_ID,
FND_USER_RESP_GROUPS.RESPONSIBILITY_APPLICATION_ID
FROM
FND_USER,
FND_USER_RESP_GROUPS,
FND_RESPONSIBILITY_VL
WHERE
FND_USER.user_id = FND_USER_RESP_GROUPS.user_id
AND FND_USER_RESP_GROUPS.RESPONSIBILITY_ID =
FND_RESPONSIBILITY_VL.RESPONSIBILITY_ID
AND FND_USER_RESP_GROUPS.RESPONSIBILITY_APPLICATION_ID =
FND_RESPONSIBILITY_VL.APPLICATION_ID
AND FND_USER_RESP_GROUPS.START_DATE < SYSDATE
AND ( CASE WHEN FND_USER_RESP_GROUPS.END_DATE IS NULL THEN SYSDATE ELSE
TO_DATE(FND_USER_RESP_GROUPS.end_Date) END) >= SYSDATE
AND FND_USER.user_id = (
CASE
WHEN 'VALUEOF(NQ_SESSION.EBS_SSO_INTEGRATION_MODE)' = 'Integrated'
THEN VALUEOF(NQ_SESSION.EBS_USER_ID)
ELSE
(SELECT USER_ID FROM FND_USER WHERE USER_NAME = ':USER'
)
END)
)
)
WHERE
PER_ORGANIZATION_LIST.SECURITY_PROFILE_ID = PROFILE_ID
UNION
SELECT DISTINCT
'OU_ORG', FND_PROFILE.VALUE_SPECIFIC('ORG_ID', USER_ID, RESPONSIBILITY_ID,
RESPONSIBILITY_APPLICATION_ID) ORGANIZATION_ID
FROM
(SELECT

6. COLLABORATE 14 Copyright ©2014 by Preet Shah, Linda Flood, John Fortado P a g e 6
FND_USER_RESP_GROUPS.USER_ID,
FND_USER_RESP_GROUPS.RESPONSIBILITY_ID,
FND_USER_RESP_GROUPS.RESPONSIBILITY_APPLICATION_ID
FROM
FND_USER,
FND_USER_RESP_GROUPS,
FND_RESPONSIBILITY_VL
WHERE
FND_USER.user_id = FND_USER_RESP_GROUPS.user_id
AND FND_USER_RESP_GROUPS.RESPONSIBILITY_ID =
FND_RESPONSIBILITY_VL.RESPONSIBILITY_ID
AND FND_USER_RESP_GROUPS.RESPONSIBILITY_APPLICATION_ID =
FND_RESPONSIBILITY_VL.APPLICATION_ID
AND FND_USER_RESP_GROUPS.START_DATE < SYSDATE
AND ( CASE WHEN FND_USER_RESP_GROUPS.END_DATE IS NULL THEN SYSDATE ELSE
TO_DATE(FND_USER_RESP_GROUPS.end_Date) END) >= SYSDATE
AND FND_USER.user_id = (
CASE
WHEN 'VALUEOF(NQ_SESSION.EBS_SSO_INTEGRATION_MODE)' = 'Integrated'
THEN VALUEOF(NQ_SESSION.EBS_USER_ID)
ELSE
(SELECT USER_ID FROM FND_USER WHERE USER_NAME = ':USER'
)
END)
)
Identity Manager must be used to assign the Application Roles now present within Weblogic by adding filters to
the Business Model Mapping (BMM) layer utilizing Operating Unit Org Number. Some of these already exist and
are predefined by Oracle. We will add dimension and fact tables as needed.
For applying Row Level Security, the Weblogic roles for the responsibilities are selectively given permissions on
BMM fact tables thru explicit Segment Code Data Filters applied to User/Application Role Permissions.
The OBIEE Presentation Service Administration dashboard is utilized to manage Privileges and grant specific roles
access to specific areas of Dashboards and Subject Areas.
Each Subject Area in the Presentation Layer will grant read or read/write access to each of the specific roles.
To complete the security setup, each role (responsibility) must be explicitly granted access to what used to be
Shared Folders in the Catalog.
OBIEE must be enabled to present new action links to EBS by adding the ebusinesssuiteconfig switch to
ActionFrameworkConfig.xml. Visible must be set to true to enable OBIEE to present action links for EBS.
An Action Link must be configured to point to the destination EBS form. Select a new Navigate to E-Business Suite
action link and define the appropriate parameters. Note that the EBS form must have defined parameters and
must be configured to accept those parameters. For Accounts Payable drillback to invoice detail, we called
Function Code “AP_APXINWKB_SUMMARY_VIEW” and passed the parameter “INVOICE_ID”. A Server Error Alert
stating that the Oracle eBusiness Suite Server is not available will be thrown if the user defined in the initblock
specified in the Action Link does not have sufficient privileges into EBS. This can be verified with sqlplus in the
manner mentioned earlier.
EBS responsibilities must be configured within EBS in order to enable an EBS user to open an Analytics dashboard
in OBIEE. Beginning with the EBS NavigatorSystem Administration, an admin user will access EBS Menus and
create a function, menu, responsibility, user and profile.

7. COLLABORATE 14 Copyright ©2014 by Preet Shah, Linda Flood, John Fortado P a g e 7
From the Application menu, choose Function. This takes you to Oracle Applications Function form shown below.
Give your function a name, User Function Name and Description and save your changes (using the diskette icon on
the toolbar). The type will be SSWA jsp function. The Web HTML tab, must contain
OracleOasis.jsp?mode=OBIEE&function=Answers. Note when linking to a dashboard use function=Dashboard.
Typically menus are compiled when they are updated.
To create within EBS a new Standard menu, select ApplicationMenu or FormsTop Ten ListMenu and give it a
Name and User Name. In the Function field, enter the name of the Function created in the previous step. This
menu that was created in the previous step must be associated with a responsibility. Either create a new
responsibility or reuse an existing responsibility. To create a new responsibility, choose the application that you
are creating the Menu for then for Responsibility Key define a unique value. Next choose Oracle Self Service Web
Applications under Application From, then under Data Group choose Standard and reenter the Application name.
For the Menu entry, enter the name you created in the previous step.
Either create a new user or assign the responsibility just created to an existing user. Then go to
ApplicationProfile and set it for a responsibility. Use Profile %oracle business% to find the “FND: Oracle Business
Intelligence Suite EE base URL” then enter the URL to the OBIEE server like this https://mydomain.com:9804. It
does not require the analytics trailer. Note that the Menu Folder structure should be organized and the OBIEE
Responsibility should be under the Application Role responsibility in order to pass the Responsibility Id of the
Application Role while navigating back to EBS. For example, the OBIEE11g responsibility should be a sub menu
under Application Role Corp Finance Responsibility.
Lessons Learned
Some challenges of the project were
• Requirements can quickly expand the original project scope
• Installing into fresh environments leads to tweaking the application and the database
• Additional time is required for load testing
• Test strategy and test cases will change as complex calculations are added
• The folder structure in the EBS menu is critical:
The OBIEE/OBIA menu should be under the responsibility and not at the same level. Otherwise,
this will cause an error during drill-back to EBS

8. COLLABORATE 14 Copyright ©2014 by Preet Shah, Linda Flood, John Fortado P a g e 8
• Make sure that the OBIEE URL is also defined at the responsibility level. Otherwise this will result into
following error
• Verify that Row-wise initialization is checked for Operating Unit based security initialization block. This
allows multiple results to be stored in the variable. Also set the Execution Precedence to be sure that
initblocks EBS Single Sign-on Integration and Oracle EBS SSO are fired before the Operating Unit
Organizations initblock.

9. COLLABORATE 14 Copyright ©2014 by Preet Shah, Linda Flood, John Fortado P a g e 9
Contact Details
Preet Shah
Humana Inc.
Applications Consultant
Tel. 502.476.9149 | Cell. 203-645-7171
pshah3@humana.com
Linda Flood
Humana Inc.
Financial Reporting|Manager
Project Implementations
Tel. 502-580-2193 | Fax 502-508-2153
lflood1@humana.com
John Fortado
Emtec Inc.
Consultant
210-867-2957
John.fortado@emtecinc.com