There is an “issue” or “security feature” (depending on how you look at it) that exists in OBIEE 12c (Oracle Business Intelligence) and in OAS (Oracle Analytics Server). The OBIEE or OAS dashboard pages do not display external embedded content in most browsers.
We use multiple BI platforms, but wanted to avoid sending users to one platform for some reporting and to another for other reporting. This can be confusing to users. To provide a good user experience by directing users to one place for all dashboards and self-service reporting, we have embedded most of the QlikView and Qlik Sense dashboards into OBI pages. With that, the users can be provided with one consistent training and have one place to go.
However, the Qlik embedded content only shows when using the IE (Internet Explorer) browser and the others give some “error” message.
- The Chrome browser gives this error message:
“Request to the server have been blocked by an extension.”
- And the Edge browser gives this message:
“This content is blocked. Contact the site owner to fix the issue.”
Or you may get other messages, such as (from Oracle Doc ID: 2273854.1):
- Internet Explorer
This content cannot be displayed in a frame
To help protect the security of information you enter into this website, the publisher of this content does not allow it to be displayed in a frame. - Firefox
No message is displayed on the page, but if you open the browser console (Ctrl+Shift+I) you see this message in it:
Content Security Policy: The page’s settings blocked the loading of a resource at http://<server>/ (“default-src http://<server>:<port>”). - Chrome
No message is displayed on the page, but if you open the browser console (Ctrl+Shift+I) you see this message in it:
Refused to frame ‘http://<server>/’ because it violates the following Content Security Policy directive: “default-src ‘self'”. Note that ‘frame-src’ was not explicitly set, so ‘default-src’ is used as a fallback
This situation, although not ideal, has been fine since our company’s browser standard is IE and we provided a work-around for users that use other browsers to access the embedded content. But this will change soon since IE is going away.
There are 2 solutions to address the embedded content issue.
- Run Edge browser in IE mode for the BI applications sites/URLs.
- This would have been a good option for us, but it causes issues with the way we have SSO configured for a group of applications.
- Perform some configuration changes as outline below from Oracle Doc ID: 2273854.1.
- We ended up going forward with this solution and our team got it to work after some configurations trial and error.
(from Oracle Doc ID: 2273854.1):
For security reasons, you can no longer embed content from external domains in dashboards. To embed external content in dashboards, you must edit the instanceconfig.xml file.
To allow the external content:
- Make a backup copy of <DOMAIN_HOME>/config/fmwconfig/biconfig/OBIPS/instanceconfig.xml
- Edit the <DOMAIN_HOME>/config/fmwconfig/biconfig/OBIPS/instanceconfig.xml file and add the ContentSecurityPolicy element inside the Security element:
<ServerInstance>
…
<Security>
…
<InIFrameRenderingMode>allow</InIFrameRenderingMode>
<ContentSecurityPolicy>
<PolicyDirectives>
<Directive>
<Name>child-src</Name>
<Value>’self’ http://www.xxx.com http://www.yyy.com</Value>
</Directive>
<Directive>
<Name>img-src</Name>
<Value>’self’ http://www.xxx.com http://www.yyy.com</Value>
</Directive>
</PolicyDirectives>
</ContentSecurityPolicy>
…
</Security>
…
</ServerInstance>
- Restart the presentation server component (obips1)
Engage the teams responsible for enterprise browser settings or other appropriate teams at your company as necessary.
The Data Community 