Roles in SSAS

Hi ,
Doubt 1:
I have one cube and no roles defined as of now. We got a situation to access the cube to only 10 users . I can see roles option in Cube and as well as I can see the same in SSMS. Which is the best option for creating roles and what is the difference
Doubt 2 :
Preapring ssrs , MDX report. Usually in sql SSRS report we prepare one query for splitting parameter values and after that we join using Join(abc,",") . How we do this in ssrs , MDX reports.
Thanks in advance,
Hari.

Hi Roles in SSAS,
Doubt 1:
The best option to create roles is in the cube itself by the developer. This is because developers tend to change stuff from time to time. What developers than can do is send the role.file to the administrator and he simple has to add memberships
only. 
If a roles&members would be made by the administrator, and developers change the role afterwards administrators can than do everything from scratch again. There is of course a workaround where you can save the script once everything is setup, and than
do manual changes in the script to the changes by the developer. If a lot has changed of course you have to do everything from scratch. 
Doubt 2:  Srry i don't understand the question, can you rephrase or give example pls?

Similar Messages

  • Dimension security is not working if user have two roles in SSAS while connecting from Excel

    Hello Genius,
    I am facing the issue when user trying to connect the cube from excel if user have more than one role in ssas db.
    Role 1: Countryuser, I have implemented the dimension security with country
    dimension and  countrycode attribute.
    Role 2: CityUser,   I have implemented the dimension security with
    city dimension and  citycode attribute.
    If user is mapped to any one of above role dimension security is working perfectly according to the logic but mapped to both role, cube is exposing all the data in this case dimension security is not working.
    Please give me the solution to fix this issue or incase I am wrong kindly advice.
    Thanks
    Ganesh

    This is the expected behaviour as allowed sets in roles are unioned together.
    This is not a problem when your roles are restricting across a single attribute.
    eg.
    US_role = {[Geography].[Country].[USA]
    France_role = {[Geography].[Country].[France] }
    as someone in both roles ends up seeing {[Geography].[Country].[USA], [Geography].[Country].[France] }
    But when you have different attributes:
    NY_role = {[Geography].[City].[New York] }
    France_role = {[Geography].[Country].[France] }
    The first role is unrestricted on countries and the second is unrestriced on cities which is effectively:
    NY_role = {[Geography].[Country].AllMembers , [Geography].[City].[New York]  }
    France_role = {[Geography].[Country].[France], [Geography].[City].AllMembers }
    And when you union those two sets together you end up with:
    {[Geography].[Country].AllMembers , [Geography].[City].AllMembers }
    Which means that someone in both roles can see everything.
    So if you want to restrict someone to City = New York and Country = France you have to create a
    single role where both attributes are restricted. So if you have a lot of these combinations you will either have to create a lot of "combination" roles or look at dynamic security.
    The other thing that might work is make sure that you only give some users access to certain cities and others access to certain countries. It's the mixing of the two for a single person that causes the issues.
    http://darren.gosbell.com - please mark correct answers

  • Making Dimensions invisible for a role in ssas cube

    Hi All,
    I have a dimension and I don't want the users of a specific ssas role to use/see this dimension. At moment I am using attribute security by defining a deny member set. Is it possible that the user (belonging to that specific role), while browsing/querying
    the cube, can not see the dimension itself?
    I can use perspectives but I am looking for some other way, if any.
    Nitesh Rai- Please mark the post as answered if it answers your question

    Hi Nitesh,
    Perspective is not a solution, it's a workaround. SSAS don't provide an opportunity to hide dimension from specific role.
    Your issue is discussed
    here and
    here too.
    Best regards.

  • How to find out by MDX that the current users is member of a role - Default member issue

    Hi,
    just imagine you have a dimension with a few members (A, B, C...). I defined a role which gives some users only rights to "B". On the other hand the default member for the dimension is set to "A". Now users part of the role get an error
    that the member "A" is not found. So while
    https://msdn.microsoft.com/en-us/library/ms175626.aspx says the default member setting in the role "overrides" the overall default member this is not completely true because first the general default member is selected and after that the role
    specific one.
    So the solution might be that I explicitly define the default member in all roles. This might be possible but there is one issue: you can't define a role specific default member for users part of the adminstrator role. So all admins don't have a default
    member which is quite some restriction for some users...
    So the question is how to solve that problem. An idea would be that I use some MDX to determine the default member in the dimension based on the actual user's role membership. But how to do that? Or any better idea?
    Thanks,
    Thomas Pagel

    Hi Thomas,
    According to your description, you want to have a role-specific default member for different roles. Right?
    In Analysis Services, when granting access to dimension, a connection will fail if a role restricts access to a default measure. As you mentioned, the best solution is specify a default member for each role. But for administrator role(full control),
    it can't set the default member. All tabs except General and Membership are disabled. And the system can determines the default member of current user automatically. It's not supported to get the default member in MDX either.
    However, SSAS has additive design for role security. So in this scenario, we just need to create another role for those members of administrator role and specify a default member for this role. SSAS will take that role-specific default member
    for these users. And it will not effect the administration permission for them.
    Reference:
    Default members, MDX Scripts, Security, KPIs and Perspectives
    The Additive Design of SSAS Role Security
    If you have any question, please feel free to ask.
    Best Regards,
    Simon Hou
    TechNet Community Support

  • Role and cube

    Hi guys, I got a problem with the role. I can see ( excel odc) the project BGroup but I cannot see the cubes within. Only if I log as administrator ( working from my local machine) I can see the cube, otherwise nothing. Ok the project but not the cubes.
    Any suggestion?

    I had to set up some permission even in SQL in order to allow people to see the Cube...
    Hi Diegoctn,
    Analysis Services provides a role-based authorization model that grants access to operations, objects, and data. Non-administrative users who query or process data are granted access through
    database roles.
    So in your scenario, in order to allow users to interact with a SSAS cube, you need to crete a role on SSAS database, and then add the users account to this role.
    Reference
    http://msdn.microsoft.com/en-IN/library/bb500251.aspx
    Regards,
    Charlie Liao
    TechNet Community Support

  • SSAS Tabular model conection stops refreshing data for sometime

    Hi,
    I am using SSAS Tabular model and create connection files to use data with excel using powerpivot or powerview.
    But recently for 1 or 2 months it stops working for few mins (generally 20-60) and starts working again.
    It's happens for all 4 SSAS service on same server.
    I am using AD roles with SSAS Tabular model to filter the data.
    Everything is normal no event for this stop, no network error, no over usage of data.
    ERROR is:
    Errors in OLEDB provider. Could not connect to the redirector. Ensure that the SQLBrowser service is running on the 'ABC_Production' secver.

    Hi pinaKPatel,
    According to your description, you get the above error recently when using your tabular model. Right?
    Based on the error message, firstly, please check if the OLEDB provider is installed properly. Then check the SQLBrowser service is running. If everything is working, it may caused by the port blockage. Please follow the steps below:
    Use a fixed port and unblock that port in Windows Firewall. Connect to the server in this format: <servername>:<portnumber>.
    Use dynamic port assignments and SQL Server Browser service. Unblock the port used by SQL Server Browser service in Windows Firewall. Connect to the server in this format: <servername>\<instancename>.
    Use a fixed port and SQL Server Browser service together. This approach lets you connect using this format: <servername>\<instancename>, identical to the dynamic port assignment approach, except that in this case the server listens on a fixed port. 
    If the issue still persists, pelase redeploy your SSAS database. 
    Reference:
    Errors in the OLE DB provider
    If you have any question, please feel free to ask.
    Simon Hou
    TechNet Community Support

  • How to find out XPath-Errors, that are only logged on the console

    Hi,
    I'm using the Java-API of XMLP Standalone Version 5.6.2. If my layout contains a german umlaut, like:
    <?for-each:Behälter_zeile?>
    <?BEFMTB_BEZEICHNUNG?>
    <?end for-each?>
    I get the following output in my application console when I call RTFProcessor.process() for this layout:
    [040609_111900450][][ERROR] [Line 118.183] Incorrect XPath: Behälter_zeile
    There is no exception thrown and the generated document seems to be correct.
    My question: How can I determine such an error in my application? I want to do at least some intelligent logging.
    Mirko

    Hi Thomas,
    According to your description, you want to have a role-specific default member for different roles. Right?
    In Analysis Services, when granting access to dimension, a connection will fail if a role restricts access to a default measure. As you mentioned, the best solution is specify a default member for each role. But for administrator role(full control),
    it can't set the default member. All tabs except General and Membership are disabled. And the system can determines the default member of current user automatically. It's not supported to get the default member in MDX either.
    However, SSAS has additive design for role security. So in this scenario, we just need to create another role for those members of administrator role and specify a default member for this role. SSAS will take that role-specific default member
    for these users. And it will not effect the administration permission for them.
    Reference:
    Default members, MDX Scripts, Security, KPIs and Perspectives
    The Additive Design of SSAS Role Security
    If you have any question, please feel free to ask.
    Best Regards,
    Simon Hou
    TechNet Community Support

  • User name error For Excel Analyzer

    Hi,
    I am using Oracle BI 10.1.3 . I have configured to checked credentials from Oralce 10gXE database.
    Bi Publisher is connecting using the database user I have created, the same is with MS-Word. But Ms-Excel is not authorizing .
    It is still taking the same Administration as username and password.
    The same is for creating Dashboard.
    Please let me know how should I configure Analyzer,Dashboard to work with my db user I have created.
    Thanks
    Edited by: Khayyam2 on Jun 20, 2011 2:55 PM

    Update this post saying that I've added the property ROLES=myrole inside the connection to SSAS for the Excel workbook and also the SSAS roles function without any problems.
    It seems that the EffectiveUserName authentication is a valid one and so I could think to use it instead of Kerberos authentication.
    Bye
    Hello,
    I have followed the steps mentioned under http://technet.microsoft.com/en-us/library/jj938164.aspx. My SharePoint site has 3 users User A, B and C. Under SSAS db I have created a
    role and added read permission to User A and B. But, User A, B as well as C can read the excel file published onto the SharePoint.. Why is User C able to read it when I have added only User A and User B to the role under SSAS db?

  • How to not make Tables, Column and Data Available in Excel

    Goal:
    Not displaying the dimension table and its data in excel
    Problem:
    I was enable to deny access for the user roles in SSAS about denying access the data from the column but the next thing is that I do not know how dimension table and column not to be available in the excel.
    Information:
    *The datasource is SSAS
    *I have made three user to have access to two tables only.

    Hi Sakura,
    According to your description, you want the Manager role can see all dimension table and its data column. And the Employee role can't view all table, column and data, right? Currently we don't have a direct option to complete hide the dimensions or attributes
    to some roles. However you can use workarounds below.
    Using cube perspectives and hide the cube dimension attribute then set the perspectives to role.
    Perspectives
    Use this workaround discussed in the similar thread below.
    Dimension attribute security to hide or unhide an attribute
    based on certain condition
    Hope this helps.
    Regards,
    Charlie Liao
    TechNet Community Support

  • Excel 2007 ignores the roles configured on SSAS 2008

    Hi,
    I am facing a common problem for which I have found very useful threads but they didn't manage to help me.
    My problem is on excel report, Dimension data is not filtering correctly when I connect with user credentials for which a role is configured on the cube. Excel 2007 ignores the roles configured on SSAS 2008 and I tested with 2 different users with the same
    role configuration.
    I ensured that the user doesn't fall in the server admin role and . I started up an SQL Profiler and I ensured no  * in the list of roles of the user.  I ensured also that there is no "built-in administrators group" configured (Security\BuiltinAdminsAreServerAdmin).
    http://social.technet.microsoft.com/Forums/sqlserver/en-US/7052f751-8478-4ab2-aba8-d250a1606e07/deny-access-to-analysis-services-cube-from-excel-2007
    Also I am planning to upgrade my Service Pack 1 to the cumulative pack Hot Fix 2710 ( KB969099 ) as it seems there are some known issues about dimension security on SSAS 2008. Do you really think it is a question of upgrade?
    http://social.msdn.microsoft.com/Forums/sqlserver/en-US/4b4e6e3c-bebe-4f81-8462-b2d0bd61ad11/dimension-attribute-security-on-ssas-2008-not-working-but-works-fine-on-2005
    However I managed to work around the issue on SSAS and on Excel as follow but it is the not the solution expected: 
    - On SSAS 2008 R2 cube browser, while testing using the role: Dimension values filtered correctly the required data 
    - On Excel: Unless the role is specified in the configuration of the connection then the data is not filtered.
    http://kevin_s_goff.typepad.com/kevin_s_goff_weblog/2009/12/1242009---testing-ssas-roles-in-excel.html
    It is really urgent,
    Many thanks

    Hello,
    I'm experiencing exactly the same issue and I can't find any solution to it.
    Were you able to solve it? If so, how did you do it?
    Thanks!!!

  • SSAS 2012 , Role- Limit of users

    Hi Experts , 
    I am working on SSAS 2012 Cube .
    I am implementing Security on my cube for which I have created 2 Roles.
    Question: I need to know how many users can be added in one Role (Member Ship Tab)? What is the maximum limit ??

    Hi Rihan,
    According to your description, you want to know the maximum number of users can be add into a role, right?
    Here is a document that the list the maximum sizes and numbers of various objects defined in Analysis Services components under different server deployment modes.
    http://technet.microsoft.com/en-us/library/ms365363(v=sql.110).aspx
    However, the maximum number of users can be add into a role is not specify on that document. As per my understanding, we can add any numbers of users to the role as we want. In your scenario, how many users do you need to add into this role?
    If you really need to know the maximum number, you can open a support case with Microsoft. Visit this link to see the various support options that are available to better meet your needs:
    http://support.microsoft.com/default.aspx?id=fh;en-us;offerprophone
    Regards,
    Charlie Liao
    TechNet Community Support

  • How to read ssas cube and role from Excel vba

    Hi,
    I want to read all roles and cubes in SSAS Db from Excel Vba.
    1. First i want to read all the roles which was assigned to me
    2. based on the role, i have to read all cube name
    Please help me to
    accomplish this task.

    Hi Jack,
    In Analysis Services, Each role contains members, by Windows username or by Windows group, and permissions (read, process, administrator). If the user has the permission to access SSAS database, then the account was contained in one or more roles. When connect
    to SSAS database, we need to use an account to log on it, and SSAS will list all the cubes' name based on the role automatically.
    Reference
    Using Excel to interact with a SSAS cube
    Regards,
    Charlie Liao
    TechNet Community Support

  • SSAS cube role members magically disappear overnight

    Hello,
    We are running SQL Server 2008 SP1 CU4 and I have been experiencing an occasional issue whereby our cube role members disappear - resulting in the user-dashboards failing on our website, so I am keen to resolve this.
    Some background:
    -We have two roles, one with 2 members and one with about 15-20.  When the issue occurs, both roles lose their members but the roles themselves remain.
    -The SSAS database is set to do a full process every night at 11pm.
    -I deploy cube changes by backing up the cube from my development machine, and restoring to the server.  My dev machine is on a different Windows domain.  When I restore I select "overwrite security information" but am always very careful to select
    "Skip Membership".  The restores always complete successfully, and I can immediately re-process the cube and confirm that the original members are still there and functioning normally.
    -I suspect that this issue is related to the nightly re-process of the database, however I have tested this theory by checking the membership the day after I've completed a cube deployment and everything is still Ok.
    -This just happened again last night.  I reviewed the server logs and saw that the server rebooted last night at 9pm, followed by the cube re-process at 11pm.
    -I noted this morning that the role membership has a single SID listed, and I can confirm that this is the SID of my local user account on my local machine.  So it appears that when the issue exhibits itself, the cube is reverting back to the role membership
    contained in the restored database, even though I told it to skip membership.
    To fix it this morning, I re-added the members and have saved a script to automate the process next time it occurs.  I am aware I could run this script after every re-process just to be safe - but I'd rather stop unpredictably losing the configuration
    than automate the re-establishment of it!
    What gives!? Any suggestions appreciated.
    Michael

    Hi Abbas,
    We're clear on the difference between "build" and "process" right?
    In my case, the cube processes every night - whereas we only change the design of the cube occasionally, maybe once every 2-3 months - therefore we are only
    building it every 2 or 3 months.
    Because my dev machine is on a totally different domain to the SSAS server, I can't (or at least I didn't think I could) specify the accounts that are members of the various roles during development.  I do this with the aid of a script every time we
    deploy out a new version of the cube to the SSAS server.
    So, after a build and deploy - the cube role membership is perfectly fine and behaves as expected for all users.  The thing that's puzzling us is that the role membership occasionally appears to unpredictably revert to prior settings (i.e. reverting
    back to my deployed role membership config prior to running my script to set the correct role membership). 
    The cube can be running fine for several months and then suddenly I get a call in the morning about users not being able to access the cube.  I find that the server was rebooted overnight and the role memberships have disappeared - this is not an immediate
    result of a BIDS build/deploy as I think you are suggesting Abbas.
    This hasn't occurred again since my last post in March this year, fingers crossed the problem has gone away.
    Thanks,
    Michael

  • SSAS Cube Role Issue

    Hi,
    I want to grant access to a user to a SSAS database. I'm able to add him to two databases but when i try to add him to the third database, it seems to hang. I have tried both GUI and XMLA query for this.The ALTER ROLE XMLA query(after extracting the member
    tag from the role query of another database) gives the following error in a couple of seconds:
    "Transaction errors: Aborting transaction on session 115585.
    Transaction errors: Aborting transaction on session 115585. Transaction errors: Aborting transaction on session 115585.
    I had to kill the query eventually. It doesn't seem to be a user issue as a simple alter role of the existing role also gives this error.
    I'm using SSAS 2005. Its strange that it is showing this issue suddenly today. Can someone please help?
    Regards,
    Sumit

    A restart of the SSAS service worked in this case. Never thought it would be as simple as this.

  • Role Base Security SSAS Tabular and PPS not working

    Hi,
    I am having SSAS (Tabular Model) with Role based Security. It is working fine with Powerview and PowerPivot.
    But when i am  using same with PPS. it is giving me error like 'Data source not accessible'.
    If i don't Provide Role while connecting and if i select
    unattended account, it is working but no security.
    Please help me out on this situation or provide any steps with snapshot(if possible), how to make pps
    working with SSAS Tabular model with Role.
    Thanks in Advance
    Pinak kakadiya

    Hi Vishal,
    According to your description, you are trying to use time intelligence functions in SQL Server Analysis Services Tabular model without success, right?
    In order to use time intelligence functions in DAX formulas, you must specify a date table and a unique identifier (datetime) column of the Date data type. Once a column in the date table is specified as a unique identifier, you can create relationships
    between columns in the date table and any fact tables. Please refer to the links below to see the details steps to use time intelligence functions in DAX formulas.
    https://msdn.microsoft.com/en-us/library/hh758415.aspx?f=255&MSPPError=-2147217396
    http://blog.gbrueckl.at/2013/02/fiscal-periods-tabular-models-and-time-intelligence/
    If the issue persists, please provide us more information about your tabular structure, so that we can make further analysis.
    Regards,
    Charlie Liao
    TechNet Community Support

Maybe you are looking for

  • J1IEX, error while posting Excise Invoice

    Dera Gurus, While posting the excise invoice for the invoice which has already been captured at the time of MIGO, I am getting the error message " All Part I entries have been canceled for excise invoice 5810 2009" I have checked the PO history and f

  • Which programming is used in SAP HANA? confused b/w ABAp or java?

    Can anyone just tell me As a programmer in which language i have to work on SAp HANA

  • Problem: Adapter SOAP

    Hello. My problem is recepcionar a SOAP external errors produced. The idea is that XI / IP register those errors and surrendered to a proxy SAP ECC. SOAP you want to capture. <Soap: Envelope xmlns: soap = "http://schemas.xmlsoap.org/soap/envelope/" x

  • Reparing the boot camp interface

    Hello, I wonder if there is coming out an update and gives the possibility to repair the boot camp interface. Every time when there is a little error with the boot camp partition, the partitions won't show under apple (startvolumes) and the repair po

  • Pivot table HELP in OBIEE Answers!!!

    Hello, I am having some problems in a "pivot table", "Sections" and "Calculated Items" I have a section called 'e) External Income' and I would like the value reverted from a negative to a positive. In excel or any other form of calculation you can d