Security Model: Authentication & Authorization
Distinguish authentication (who you are) from authorization (what you can see/do) in OBIEE, and how Application Roles, groups, and RPD security tie together.
OBIEE security is layered, and interviewers use it to test whether you understand enterprise identity concepts, not just OBIEE clicks. Authentication answers "who are you?" and is typically delegated to WebLogic's security realm — backed by the embedded LDAP, an external LDAP/Active Directory, or SSO (SAML/Kerberos/OAM). Authorization answers "what can you see and do?" and is where OBIEE-specific concepts like Application Roles, Catalog Groups, and RPD-level data security come in.
It's like a building badge system: reception (WebLogic) checks your ID and knows which department you're in; your badge (Application Role) then decides which floors (subject areas) the elevator will even show you, and which filing cabinets (rows of data) on that floor you're allowed to open.