Web Intelligence (also called WEBI or WebI) and other BusinessObjects documents have, for many years now, had the capability to be mass distributed to multiple recipients using the scheduled document functionality of BusinessObjects. Taking this one step farther, BusinessObjects publications can combine more than one document, execute them on schedule (for example, in the middle of the night), and send them to more than one recipient with personalized output on each one. Both of these options allow for night-time mass execution of documents with a variety of delivery options for the generated static output. For most users, this static snapshot is what they really want, not a real-time (and slower) fetch to the SAP BW system at the time they refresh a BusinessObjects document. There are a lot of sophisticated settings in BusinessObjects that allow for these documents to be personalized. For example, input prompts contained in documents can be populated in the scheduled nightly execution of the documents, resulting in different output for different users. These settings are controlled by the User Profiles in BusinessObjects. Unfortunately, they are not really as secure as some security administrators would like, because in order to use these profiles all the data is sent by SAP BW to the BusinessObjects enterprise, and filtered before it is sent to the user by these profiles. Really tight-row-level security, preferred by most security administrators (for example, where I can see all the controlling areas data but you can only see one controlling area), is best tied to and controlled by SAP BW. This level of security is called “analysis authorizations,” and is the technique deployed in this article for personalized output. I show how to create publications that allow documents to be sent to multiple users with personalized output to each user based on the SAP BW authorization. In this scenario, each document itself is different, depending on the authorization of the user who is to receive it. I assume readers have some expertise in these areas as I don’t go into the technical and connection details or the prerequisites required to use this method. On the bright side, most of the required setups are one-time setups that have probably already been performed in your system. The target audience of this article is Web Intelligence users who also have SAP BW query experience (or who have access to someone who does). This is not a detailed, step-by-step guide for each required process, as many tools and sub-tools are needed, and in many companies these complex steps are the responsibility of different teams or departments. Table 1 identifies the steps needed to accomplish the goal of a user-specific scheduled Web Intelligence document output, and to what level of detail each topic is addressed.  

Task	Level of detail addressed in this article
Set up SAP authentication and exchange security certificates between SAP BW and the BusinessObjects platform	Cursory discussion of the required system set up.
Set up an OLAP connection to SAP BW	Medium level of detail, including screenprints of the most important steps.
Set up SAP BW analysis authorizations	Cursory discussion of the required steps, with a screenprint of the finished setup needed.
Create an SAP BW Query design with an authorization-filled variable	Cursory discussion of the required steps with a screenprint of the finished result.
Create a Web Intelligence report	Cursory discussion of the required steps with a screenprint of the finished result.
Create a BusinessObjects publication	Cursory discussion of the required steps with a screenprint of the finished result.

The ultimate goal of the method I discuss is illustrated by the graphic in Figure 1.

Set Up SAP Authentication and Exchange Security Certificates

As the first step, make sure your BusinessObjects system is configured to allow access to the Business Intelligence Platform (BIP) via user IDs that originate in SAP BW (your technical team can do this). SAP BW user IDs are imported to BusinessObjects as alias users. Once imported, these users are assigned access to BusinessObjects tasks such as running or creating Web Intelligence documents. SAP authentication (or authentication via another technology) allows the user to log in to the SAP BW system just by being checked (or authenticated) by another system. In this example scenario, you need to have “trust” established between the systems to allow one user who logs in to SAP BW behind the scenes to have the ability to execute SAP BW Queries as if they are a different user. Ideally, your BusinessObjects and SAP BW systems have already been configured to allow this, but if they are not, here is a link to get your technical team on track: How to set up the systems.

Create an OLAP Connection to SAP BW

In this next step, your technical team links the BIP to SAP BW to allow the use of SAP BW queries as feeds to BusinessObjects documents (such as Web Intelligence), using the BICS (BI Consumer Services) protocol. Instead of creating a Universe getting data from an SAP BW cube with relational connections and then creating a Web Intelligence document off the Universe, the new preferred approach is to directly access the BEx Query from Web Intelligence without the Universe. In order to accomplish this, an OLAP connection must be created so that possible BEx queries can be selected as sources when creating Web Intelligence documents. Figure 2 shows an OLAP connection. This one allows access to any queries written off the Cost Center Accounting Cube.

Set Up SAP BW Analysis Authorizations

SAP BW has two different authorization concepts and tools in place. One is the standard SAP authentication tool that is used by many SAP systems. These authorizations allow the execution of a query or the creation of an SAP BW cube. In addition to the standard authorization system, SAP BW has an SAP BW-specific toolset called analysis authorizations. Analysis authorizations control record-level security. For example, I can see company code X and Y data, but you can only see company code Y data. In my example scenario, SAP BW controls what and when the Web Intelligence report runs for each user separately. It is ultimately these analysis authorizations that control this. Figures 3 and 4 shows analysis authorization U11_CO1000 and its assignment to user R_CLARK11. With this authorization user R_CLARK11 only has access to view the data of Controlling Area 1000. On the other hand, user USER11 (not shown) has the analysis authorization BI_ALL, which allows him to see every record in the system including all the controlling areas.  Remember, this is not the main subject of the article, and as mentioned in the introduction details surrounding this topic, are out of the scope of the article.

Create an SAP BW Query Design with an Authorization-Filled Variable

In my scenario, the Web Intelligence report executes an SAP BW query. My goal is to have this query return different datasets based on the user who receives that data. In order to accomplish this, you need to use a special type of BEx variable (BusinessObjects calls these prompts) that, rather than asking, automatically fills in the filtered value set based on what is authorized. Figure 5 shows the BEx Query that you use in the Web Intelligence document, and the special authorization-filled variable.

Create the Web Intelligence Report

The next step is to create the Web Intelligence report that accesses the BEx Query. This step is the same as for creating any other Web Intelligence report except that in the initial screen, instead of choosing the Universe as your data source, you choose BEx query as the source (Figure 6). This then opens up the screen in Figure 7. To learn more about the basics for how to build a Web Intelligence document, watch Alan Mayer’s presentation from BI 2013:  “Learn SAP BusinessObjects Web Intelligence in an Hour (BI 2013).” Figure 7 is where you select the connection and the query you want to access. In this case, select the SAP BW query with the dynamic authorization based filter on CO_AREA. Then, follow the same steps you would usually take to select the fields to design the Web Intelligence document (Figure 8).

Create a BusinessObjects Publication

The final step is to create and execute a BusinessObjects publication. In this scenario, the publication only includes one Web Intelligence document, but this is not a real-world limitation. The central purpose of this feature is the ability is to publish a content-customized document or many documents to many people all in one go. I’m only publishing one, but more could be added each with its own link to SAP BW Queries, each containing authorization-filled variables. Here I only cover the options needed to support the example scenario. To start the process, choose New and then Publication in the Documents folder of the BI launch pad (Figure 9). This opens the screen shown in Figure 10, where you enter the General Properties for your new publication, such as name and keyword. The next step—determining which documents to publish—is one of the most important. In this scenario, you are publishing just one document (Figure 11). Once you’ve made your selections, click the Save button to add the document to the publication. This opens the screen in Figure 12, which shows the selection options for the recipients of the documents. In this scenario, the manager is USER11 and the restricted worker is R_Clark11. (Note that running the publication for another user in connection with the advanced settings does not work unless the security certificates have been exchanged between the BusinessObjects server and the SAP BW server, as stated earlier in this article.) The next step, shown in Figure 13, is to select the document format. In this scenario, keep it simple, and generate a static instance of the Web Intelligence document. Next, select Destinations from the list on the left. This opens the screen in the right of Figure 14, which shows lots of options. Again, just to keep it simple, select the BI Inbox check box and click the OK button. The BI Inbox is a default inbox provided for each user, and it’s accessed from the homepage of the BI launch pad. The screen in Figure 15 opens. In this next step, you need to address how often and on what schedule the publication will execute. Normally I would choose a weekly or daily recurrence. However, for this scenario just schedule it to execute once. The next step is the last step you take before running the publication. In the Advanced tab (Figure 16), as the user executing the publication, you can tell the BusinessObjects system either to run the document once in total or once for each recipient (e.g., Recurrence). If you were implementing the user-specific output of data using features within BusinessObjects, then you would want to choose only one data base fetch. However, since I am doing it via SAP BW, this would not be correct. Although the One data base fetch for each recipient option is much less efficient than the One database fetch per recipient option, you need to choose the former as it grants more control. Also in the middle of the night, inefficiency does not matter as much. More importantly, if you select the once for all recipients option, as shown in Figure 16, the SAP BW analysis authorizations would not be executed per user. Therefore, you would not get the desired result of each user seeing only what he or she was supposed to see as controlled by SAP BW authorizations. Again you need to choose the less efficient but more controlled once for each recipient option. Since you did not elect to have recurrences in the previous step, you need to schedule the publication to execute now. This is a simple context menu option, as shown in Figure 17. Simply select the Publication, right-click, and choose the Schedule option from the context menu. This opens the screen at the bottom of Figure 17 where you can schedule the publication to execute Now. The last step is to open the document link in the inboxes of the recipients. The instance of the document in R_CLARK’s inbox is shown in Figure 18. To double-check that this scenario worked, if you review this document for the restricted access worker, Mr. Clark, you see only CO Europe (which is CO Area 1000). Success!