How to assign AD groups to OBIEE Application Role:

Here are the steps:1

2
3
4

Create an application role in EM

Assign the required AD group to this role in WL Console
Using RPD, synchronize application roles.
Apply data filters on this role in the RPD.

In brief, when you setup AD authentication in Weblogic console, you are able to see
users & groups present in AD. Now, you need to create a role maybe, with the same
name and assign the group to it. Once you synchronize RPD, you are able to see
these new roles RPD where you can apply data filters.
Detailed Steps:
1- Login to Weblogic Console to see AD Users and groups.

2- Lets consider AD Group AppTesters which we want to link to OBIEE Role.

3- Login to Weblogic Enterprise Manager and create a new role, lets say
BI_DEVELOPERS_ALL_GG. Assign AD group AppTester to this role.

4- Open RPD in online mode. Go to Manager -> Identity -> Action ->
Synchronize. You will now see this newly created role in RPD.

5- Select this new role on which you want to apply filters.

6- Double click on selected role, click Permissions.

7- Click on Data Filters and press + sign.

8- Here, you need to select the Dim/Fact on which you want to apply the filter,
expand that table and select right column. Click Select on right pane. Make
sure the table type is Presentation Table

9- Now, you will return back to last pane and you will see the filter condition.
Highlight filter condition, and click on Edit Expression button.

10-Here you need to write the filter condition.

11-I wrote the following condition: -

"APP_BI_DTMRT"."D6 Product"."Product" = 'ABC' OR

"APP_BI_DTMRT"."D6 Product"."Product" = 'DEF' OR "APP_BI_DTMRT"."D6 Product"."Product" = 'XYZ'

12-Similarly, same filter is applied to the fact table as well. This will ensure the
filter is applied even when you are not selecting product data in answers.

After this setup, users within a role will be able to see data only for products abc,
def, xyz,