Just a quick note on OBIEE 12c’s Visual Analyzer. It is installed by default, but there is no Single Sign On enabled between OBIEE and Visual Analyzer. Each user will be prompted to login.
Appears access to Visual Analyzer (VA) is controlled by the Application Roles etc. It does not look easy to restrict a user to only OBIEE and not VA.
Oracle’s tech note discusses this here
How To Remove Or Add Specific OBIEE 12c Data Visualization | Visual Analyzer Permissions And Access (Doc ID 2102444.1)
Summary below
You may want to remove the ability for your user population to use or access data visualization in OBIEE 12c (licensing or other segmentation reasons). By default in OBIEE 12c, the permission “va.author” is granted to the BIContentAuthor role. It is not always feasible to remove the BIContentAuthor and all of it’s inherited and granted permission sets; therefore, how can one just limit or grant access to the data visualization permission?
All Oracle Business Intelligence permissions and permission sets are provided; you cannot create additional permissions or permission sets. If you chose to configure your service instance based on the Sample Application, sample application policies and application roles are pre-configured to assign these permission sets according to the access requirements of the Oracle Business Intelligence common user types:
administrator, author, and consumer. If you chose to import an 11g upgrade bundleinto your service instance, the 11g permission grants will be used along with any newpermission sets that were not available in 11g. Permission grants can be changed asneeded using Fusion Middleware Control.
Note: Permission set grants can be viewed in Enterprise Manager Fusion Middleware Control but can only be changed using WLST.
Additionally, you may want to create a role with only data visualization permissions. In that use case, the permissions would be:
ResourceType=oracle.bi.tech.visualanalyzer.permission esourceName=oracle.bi.tech.visualanalyzer.generalAccess Actions=*
This would allow a user to login to /analytics and /va, but only have data visualization related permissions.
Some useful 12c scripts here 12c_scripts2