Business Objects's GetObjectPrincipalsEx(...) & Orphan principals
My company uses Business Objects Enterprise XI2 SP1 as our reporting framework, our reporting rights are saved per each report (direct assignments for user), we have two repositories (AD, BO).
Our user management application load all the reports in the system (50+) and shows to the user manager them in the original hierarchy (I know this is not the best pattern but we wanted a disconnection while editing) than the end user can play with the assignments when saving the rights are saved per report (without working on the hierarchy).
After investigating a customer repository we found our that:
- The GetObjectPrincipalsEx method (even with the direct assignment flag) performance is highly effected by the actual principals found on the object you are querying (it seem as if there is no cache of the data).
- Deleting a user who ad direct assignment to an object will not delete the principal (this creates an orphan principal that will never be deleted)
- The only way to efficiently save rights is using Groups & Folders (there was no indication on that on the administration documents of march, there was no indication for the bad performance the above API)
I am going to make your life easier and post a command line tool that I have created that will enable you to:
- For each report in your system you will get the number of principals on the object and a list of orphan principals (deleted users / groups principals)
- Get measure of how much time it will take you to iterate on all the reports in your system (in bulk) and check the principals - so you can understand the current performance
- Clean the orphan principals (using command argument)
Usage: BOAnalysis.exe [/username[:]user name] [/password[:]password] [/server[:]CMS Server address] [/commitable]
/username user name to use when authenticating
/password password to use when authenticating
/server The cms server to connect to
/commitable remove the orphan principals
The queries used by the tool are exposed in configuration (so this is highly customizable).
I would expect Business Objects support to provide such tool but I was amazed that I was asked to provide it as a sample (reproduce) - very unprofessional.