Embedded Publisher reports remain protected by Oracle Analytics and Publisher authorization controls. Authentication establishes who the user is, but access to the underlying Publisher content must additionally be governed through application roles, functional privileges, and Catalog permissions .

Oracle Analytics allows administrators to assign users and groups to application roles and then grant those roles access to Catalog objects. Publisher also defines functional permissions such as running reports, developing reports, scheduling reports, and accessing output. Oracle's administration guidance makes an important distinction: possession of a functional role does not by itself grant access to specific Catalog objects; the appropriate Catalog permissions must also be assigned.

This is particularly important for reports embedded in dashboards. Securing only the dashboard page isn't sufficient protection for the underlying sensitive Publisher object. Database authentication alone likewise does not implement the complete analytics-content authorization model. Disabling cache doesn't establish access control.

Therefore, the appropriate solution is role-based access combined with Publisher Catalog security , ensuring that only authenticated and authorized users can access the sensitive embedded reports.

Reference Topic: Managing and Securing Oracle Analytics Publisher — Application Roles, Functional Privileges, and Catalog Security

===============