Hyperion Shared Services LCM of Reporting Fix

When You Can’t See the Document Repository from Hyperion Shared Services

Overview

It’s important to keep your system patched, but on occasion, this can cause you some issues. This showed up for me after patching WebLogic in a Hyperion 11.2.4 environment.

After applying the newest WebLogic security patch as recommended by April 2021 CVE, I found that I could no longer see the Document Repository from Shared Services. Instead, I got an error – EPMLCM-17000: Failed to authorize user for LCM migrations:

The Fix:

From the research I did, it looks like it’s a reoccurring issue – it appeared in an earlier 11.2 version and was fixed.  Now patching WebLogic makes it appear again.  I would expect 11.2.5 fixes it again and I would expect it to reappear after a future WebLogic patch.  The root cause is that WebLogic becomes more stringent with security that communication on this particular web page can’t handle properly, causing the error.

Luckily, this only appears from the web, so if you run the command line Utility to do nighly LCM exports, they will remain unaffected.  But you don’t have to live with nothing but command line LCM for reports – there’s a fix. Adding a couple of entries in the registry will dial the security back to an appropriate level and resolve the problem.

Set the Financial Reporting filter level:

• Open the Windows Registry Editor
• Navigate to HKLM\SOFTWARE\Hyperion Solutions\FinancialReporting0\HyS9FRReports_epmsystem1
• Determine the last current JVMOption value (in this example, we’ll use 40)
• Add New ‘String Value’ entry named one number higher – here it would be  ‘JVMOption41’
• Set value to ‘-Dweblogic.oif.serialFilterMode=disable’
• Modify JVMOptionCount to the new highest value 41 (decimal)

Set the Financial Reporting filter level:

• Navigate to HKLM\SOFTWARE\Hyperion Solutions\FoundationsServices0\HyS9FoundationsServices_epmsystem1
• Determine the last current JVMOption value (in this example, we’ll use 50)
• Add New ‘String Value’ entry named one number higher – here it would be  ‘JVMOption51’
• Set value to ‘-Dweblogic.oif.serialFilterMode=disable’
• Modify JVMOptionCount to the new highest value 51 (decimal)
• Restart all services

After doing this – success!  I can see the Document Repository from Shared Services again:

I was concerned when researching this setting in WebLogic – using ‘disable’ value for this is discouraged in general.  However, checking with Oracle support, they confirmed that this is a supported fix for this issue and does not introduce security issues because of the configuration of the service.

I hope you found this useful, check back for more tip and tricks in the future.