Select Page

The Easy Button: Fixing Security Issues When Migrating EPBCS to Production

Dave Shay | | September 12, 2017

oracle epm, cloud

When we migrate EPBCS/PBCS from the Test instance to the Production instance, security doesn’t migrate correctly because Oracle uses different naming conventions between Test & Prod for the security groups.

Test                                                                       Production                          

planning-test Service Administrator         planning Service Administrator

planning-test PowerUser                            planning PowerUser

and so on…

When you import your Test snapshot into Production, you do not get any kind of notification that security provisioning was rejected. For example, if you do not want “planning Viewer” to have access to the Workforce accounts, that access assignment is rejected because it was imported as “planning-test Viewer” and we are none the wiser.

Traditionally, we’d either manually redo the security setup directly in Production, and hope we remembered everything we did in Test (Seriously, don’t do this). Or, we would crawl through the snapshot and edit the various .csv and .xml files, and certain files would also have to be renamed. Been there, done that.

I proudly present…. The Easy Button.

Download this:


Unzip it and save it in a place you can find it later when you need it. To ensure you’re paying attention, this download link expires in 30 days.


1. One time only, copy and paste this command to a command prompt on your computer (it doesn’t matter what folder you’re in) and press ENTER:

powershell.exe Set-ExecutionPolicy Unrestricted

2. When it is time to migrate, download the snapshot from the Source instance to your computer and unzip it using 7-zip from Regular Windows unzip will bark about the long paths inside Reporting & Analysis. Unzip the snapshot to a path and folder name that does not contain any spaces anywhere within the fully-qualified path.

3. Copy the contents of the zip file you downloaded from my link above into the topmost folder of the extracted snapshot, like this:

4. If you are migrating from Test to Prod, double-click TestToProd.bat. If you are migrating from Prod to Test, double-click ProdToTest.bat. The script completes in less than 1 minute.

5.Use 7-zip to zip up your snapshot. Upload it to the target instance, and import it according to then-current best practices.

What the three highlighted files above do is search for and replace the instance-specific roles and also rename the instance-specific group files. You now have a repeatable process.

If we have a similar migration issue with FCCS, ARCS, and other Cloud products that have different group names between Test & Prod, this process could be adapted for them. Inspect the two .bat files and you should be able to figure it out. The .ps1 file should not need to be changed.


Subscribe to Our Blog

Never miss a post! Stay up to date with the latest database, application and analytics tips and news. Delivered in a handy bi-weekly update straight to your inbox. You can unsubscribe at any time.

How to Solve the Oracle Error ORA-12154: TNS:could not resolve the connect identifier specified

The “ORA-12154: TNS:could not resolve the connect identifier specified” Oracle error is a commonly seen message for database administrators.

Vijay Muthu | February 4, 2021

Oracle EPM Cloud Vs. On-Premises: What’s the Difference?

EPM applications help measure the business performance. This post will help you choose the best EPM solutions for your organization’s needs and objectives.

Bobby Ellis | April 10, 2018

12c Upgrade Bug with SQL Tuning Advisor

Learn the steps to take on your Oracle upgrade 11.2 to 12.1 if you’re having performance problems. Oracle offers a patch and work around to BUG 20540751.

Megan Elphingstone | March 22, 2017

Work with Us

Let’s have a conversation about what you need to succeed and how we can help get you there.


Work for Us

Where do you want to take your career? Explore exciting opportunities to join our team.