Cross-dimension or dimension-combined security

Hi gurus!
I must implement "cross-dimension" security in a planning application. I've defined some dimensions, and it's critical to implement security on some of them. Now, I can create security filters, but I need to restrict combinations of two dimensions. For example:
Let's say I have 2 dimensions: Entity and Activity, and 2 users: user1 and user2
-Entity has 2 members: Entity1 and Entity2
-Activity has 2 members: Activity1 and Activity2
-user1 can read/write data for Entity1 - Activity1 and Entity2-Activity2
-user2 can read/write data for Entity1 - Activity2 and Entity2-Activity1
In this case, user1 and user2 must hace read/write access to Entity1, Entity2, Activity1 and Activity2. So user1 will be able to write on Entity1-Activity2, and he should not be able to do that!
I'm using Hyperion 11.1.2.1.
How can I resolve this problem? Any ideas?
Thanks in advance!

While the limitation you are describing is not an issue for Essbase (cell level security with cross-dimension context), it IS for Planning. So yes, you can do what you describe in Essbase, but not in Planning.
Planning uses an additional layer of security on top of Essbase security filters, and when you think about it, it makes sense. Security in Hyperion Planning is dynamic. It changes when an admin updates the open/close periods in a Scenario, and it changes during workflow operations.
When an Essbase security filter changes, the user must LOG OUT and log back in for it to take effect. So you can see why Planning needs this additional layer of security (stored in the relational repository). We coudn't ask users to log out and log back into the app every time they promoted a planning unit. And it would not be efficient to recreate the Essbase security filters every time approvals changed.
The functionality you're describing is in the product roadmap. The Planning product managers have talked about this during the last two Kscope conferences. It's just not here yet.
Hope this helps,
- Jake

Similar Messages

How to implement Dimension Level Security on Tabular?

Not possible on SQL Server 2014 SSAS Tabular? How to work around?
Kenny_I

Hi Kenny_l,
According to your description, you want to implement dimension security in SSAS 2014 tabular. Right?
In Analysis Services Tabular mode, dimension level security (based on role permission) is not supported. This security can only used in Multi-dimension mode. In tabular mode, we can only use row-level security based on role permission.
Please refer to links below:
Implement Dynamic Security by Using Row Filters
Reference:
Comparing Tabular and Multidimensional Solutions (SSAS)
If you have any question, please feel free to ask.
Best Regards,
Simon Hou
TechNet Community Support

Member Access Profiles--Dimension combinations

My client has the following setup (simplified):
Entity--Total, children Asia, Europe
Category--Actual, Forecast, Budget
A user has 3 access profiles:
1. R/W Asia
2. R/W Actual
3. R/W Budget
They are separate profiles so write access can be turned off for Budget when the budget is locked down
They would also like to have, at the same time, Read Actual (not budget or forecast) to Europe. I can't see a way to make this happen. If I put Read Europe on profile 1, they will be able to read Budget for Europe as well.
It seems this requires changing the Category rights, based on the Entity, and my understanding is each dimension's security is independent of other dimensions.
Is it possible to achieve this, at least through the front end? Thanks in advance for any insight.
Regards,
Paul B.

Don't use member access profiles to secure categories of data selectively, based on where users are in the business process workflow. Use work status settings instead -- this relieves the administrator from having to update constantly the member access security profiles (users control their own work status), and also allows, for example, for a given user to have access to the 2009 Budget but be prevented from changing the 2008 Budget (same category, different time period).
You may find it useful to secure the category dimension as simple R/W for Budget, Read-only for Actual. This assumes your users need to do nothing at all in the Actual version (such as run currency conversion logic, etc.) In some cases, key finance people in fact may need write access to Actual as well, even in a planning application.
For a consol application, many people need write access to actual, in which case I'd normally not secure the category dimension at all. I'd probably secure Datasrc instead, which allows you to control in what ways different types of users can change things.

Dimension level Security

Hi All,
Can anyone help me in providing Dimension level security for some members in a dimension? I have given planning application access as "Interactive User" and Reporting Level as "Explorer and Viewer".
I am using Hyperion 11.1.1.3.
Thanks in advance

No the roles in Shared Services are not for defining member access in the planning application, if you want more information on the planning roles in shared services have a look at http://docs.oracle.com/cd/E12825_01/epm.111/epm_security/apas07.html
Cheers
John
http://john-goodwin.blogspot.com/

Dimension Level Security on a Data Form

Hi,
Is there any other way in Hyperion Planning to know where the dimensional level security is missing when you get the following error - (other than manually going to the dimensions and checking it)
"Security and/or filtering has resulted in a required dimension not being represented on the data form"
Please let me know !
~ Adella

Alp, I did try to work with your idea and it did help. Thank you so much for your input.
Anyways, for now I think I got an answer to my question..but please do let me know of other ideas if you come across any :)
~ Adella

How to set dimension level security with multiple levels

Hi,
We have hierarchy with Level 0 codes to Level 4 codes.
For e.g.
Region 1 : Level 0 code 10000, Level 1 code 10001, Level 2 code 10011, Level 3 code 10111, Level 4 code 11111
Region 2: Level 0 code 20000, Level 1 code 20001, Level 2 code 20011, Level 3 code 20111, Level 4 code 21111
Region 3: Level 0 code 30000, Level 1 code 30001, Level 2 code 30011, Level 3 code 30111, Level 4 code 31111
From SSAS role administration, I would like to assign a user permission to all Region 1 codes and only Level 3 code (30111) of region 3.
How and where do I set this kind of permission?
Thanks in advance.
Manisha

see
http://www.mssqltips.com/sqlservertip/1834/introduction-to-dimension-security-in-sql-server-analysis-services-ssas-2005/
Please Mark This As Answer if it helps to solve the issue Visakh ---------------------------- http://visakhm.blogspot.com/ https://www.facebook.com/VmBlogs

Dimension member security

Hello,
could you please help me to configure a security system (BPC 10.0 Nw) like bellow requirement of my end user:
Dimension : Product
Property: Group:- A, B, C, D
Now user want to update member of Dimension PRODUCT manually with web admin tab.
Requirement is when user BPCUser1 login into the system so user can see only "Group A" products in the dimension and can delete or enter new product in the member list of PRODUCT Dimension.
Thanks,
Deepak

Thanks Vadim Kalinin
I have opened a case with SAP for mater data on fly as system configuration status mismatched with How-to-Guide transport files.
In that case SAP recommend only web admin interface to update master data and informed us that MASTER_DATA_ON_FLY is not BPC standard function: Please find reply of SAP
This master data on the fly is not BPC standard
function, which is out of our capability and the support scope as per
note 83020 and be noted that there may be potential risk. In addition, BPC Admin is the
only standard way to maintain master data.
Regards,
Deepak

Dimension Library - Security on Dimension member - navigation path please?

Hi,
I have been going round in ever decreasing circles trying to find the exact navigation path to ADD a new member such that users who are members of a group can see it from within Dimension Library... specifically my Account dimension has a new top level member.
Hyperion Planning 11.1.2.0.83, can anyone enlighten me as to the precise key clicks please, the manuals / forums are not helping on this.
thanks,
Robert.

Hi John,
apologies if I do not make sense... let me explain.
I have created a new account in the shared library and shared this with the planning application to 'hang' a whole hierarchy off which I import via the interface tables.
This all works fine when I am logged in as Administrator, but the users do not see the new member or any of its children, so I am assuming that this is a security matter.
Now the functional security is configured via shared services, but I had thought that Dimension / Account / Member security is configured via the dimension library - am I looking in the wrong place?
thanks for your time,
Robert.

Page Dimension Members & Security

I have cost centers dimension in my page view on a data form. My question is that will the cost center dimension members be displayed as per security/access permissions when users click the drop down menu ? In other words, if a user only has access to costcenters a,b & c - is that all they will see ?
Version is 11.1.2.

Roles can be assigned to a user (via HSS):
http://download.oracle.com/docs/cd/E17236_01/epm.1112/hss_admin/ch09s04s05.html
Once you have created a user and assigned him roles as per your requirement, below link will help you in assigning access to the members.
How to assign access to members in Hyperion Planning:
http://download.oracle.com/docs/cd/E17236_01/epm.1112/hp_admin/acc_mem.html
Cheers...!!!

Financial Reporting: Suppress pages for large sparse dimension combinations

Hello,
I am trying to create a Financial Reporting report that shows only pages that are populated with data, but the dimensions that I have on the page are fairly large and very sparse. There are 8,000+ combinations of sparse members, only of which about 120 have data populated and those 120 are what I want to return on my report. I can't call out the page member combinations individually as new combinations appear regularly and I want to avoid running maintenance on the report definition each time the data in the cube is refreshed. My report isn't executing, so I suspect it is running for each of the 8,000+ combinations before determining whether or not it should render each particular page. Does this behavior sound right? If so, is there a workaround or some other trick to get Financial Reporting to test for the presence of populated combinations before rendering the pages?
Any help would be much appreciated!
Thanks,
Rob M
Synapse Group/Time, Inc.

You can achieve this by doing following:
1. Open report
2. Select grid (left top corner)
3. On 'Properties' window, select suppression
4. Select '#Missing' in 'Basic option' section.
Good luck & let me of the results.
Venu

SSMS hangs when SSAS role dimension data security is accessed

In the last two weeks, when we try to access the dimension data tab of an SSAS security role properties through SSMS the application hangs. It cannot bring up the dimension members. The error detail just says ProblemEventName: AppHangB1
and the version and operating system and some hex locations.
This does not happen in Visual Studio (BIDS) only in SSMS. The only choices available once the application hangs are to wait (but nothing ever happens to end the wait) or to close the program (or search for a solution and restart) which of course
closes SSMS.
I have tried reprocessing all the dimensions but that does not fix the issue.
Diane Blackwood

Hi Diane,
According to your description, when you access dimension data in SSMS via a user under security role, it can't bring the members and hang with ProblemEventName: AppHangB1 error thrown. Right?
In this scenario, since the security role works in BIDS, there should no issue on the dimension itself. Based on the error message, it's more like a compatibility issue on SSMS. Firstly please make sure your SSMS is compatible with your operation
system.
This issue can happen when your computer has more than 32 processors. You can start the SSMS using only one processor through command prompt:
start /affinity 0x00000001 C:\Program Files (x86)\Microsoft SQL Server\100\Tools\Binn\VSShell\Common7\IDE\ssms.exe
Also this issue has been fixed in the KB below, please repair your .NET Framework and apply the hot fix:
https://support2.microsoft.com/default.aspx?scid=kb;EN-US;2276255
If the issue still persists, please uninstall and reinstall the SSMS(compatible with your OS).
Reference:
AppHangB1 in MS SQL SERVER R2(SP2)
Best Regards,
Simon Hou
TechNet Community Support

Dimension level Security in SSM

Hello,
Requirement,
The dimension PLANT in PAS under PAS Model ABCD looks as below
ROOT
ASSET1
ASSET2
we have single CONTEXT called ASSET meaning one model connection to link ASSET context to PAS Model ABCD.
CE level SSM users USER1 and USER2 are created.
When user1 logins, he should be dyanamically restricted to ASSET1
When user2 logins, he should be dyanamically restricted to ASSET2
Please help.
Best Regards

Hi Shashi,
This is a standard feature used already in many implementations worldwide. For the same context, you can restrict which measures and/or dimension members a user or user group can have access to.
In order to put in place this kind of security, you have to create different Application Server Connections inside the Model Connection you have associated with the Context.
In the Model Connections screen, search for a box called App.Server Connections. Click on new. This will allow you to establish a connection to the same PAS model, but using a different PAS user. In the end, you will need to create as many App.Server Connections, each one with a different PAS user associated, as the different access profiles you want to create for your users.
To each App.Server Connection, and so to each PAS user, you can assign different user groups and/or users.
The rest of the configuration has to be done directly in the PAS model, creating a procedure called SECURITY and specifying there which measures and/or dimension members each PAS user will have access to. You will need, of course, to create all of the PAS users first.
Hope this helps!
Best regards,
Ricardo Vieira

Using cross-dimension values in FR reports.

I need help understanding how a field name in a Financial Reporting report can be populated with an intersection of two different dimension members of an Essbase cube. For example, suppose I have two dimensions members in my cube - Sales and Qtr1. Now I want to create a single field in my FR report that would store values for Sales->Qtr1. Also, i want to have a field name like (Qtr1->Sales % Qtr2->Sales).
My report would look as follows:
Sales in Qtr1 | Sales in Qtr2 | Qtr1 Sales as a percent of Qtr2 Sales
Region1 100 | 200 | 50%
Region2 25 | 100 | 25%
Thanks.
Axe

If you want to show two member descriptions or names within a single column header cell, then you need to use memberdescription / membername text functions.

RDMBS tables for Dimension Members Security

Hi
We have assign user access to Dimension members in Planning. I just want to know, which is the RDBMS table where i can get detail of the access for some reporting purpose.
Pls its very urgent
Regards

If you are an Oracle dbms user then try the below - I have rewritten the script from the Cameron Blog for those of us fortunate enough not to be in sqlserver....
SELECT
    O.OBJECT_NAME,
    -- Subquery to get user or group name
    (SELECT OA.OBJECT_NAME
        FROM HSP_OBJECT OA
        WHERE OA.OBJECT_ID = AC.USER_ID) AS UserGroupName,
    CASE
    -- Subquery to get user or group type
        (SELECT OA.OBJECT_TYPE
            FROM HSP_OBJECT OA
        WHERE OA.OBJECT_ID = AC.USER_ID)
        WHEN 5 THEN 'User'
        WHEN 6 THEN 'Group'
    END AS Security_Type,
    CASE AC.ACCESS_MODE
        WHEN 1 THEN 'Read'
        WHEN 3 THEN 'Write'
        WHEN -1 THEN 'Deny'
    END AS ReadWrite,
    CASE AC.FLAGS
        WHEN 0 THEN 'Member'
        WHEN 5 THEN 'Children'
        WHEN 6 THEN 'IChildren'
        WHEN 8 THEN 'Descendants'
        WHEN 9 THEN 'IDescendants'
        END AS Hier_Function,
    OT.TYPE_NAME AS Object_Type
FROM HSP_OBJECT O
INNER JOIN HSP_ACCESS_CONTROL AC
    ON O.OBJECT_ID = AC.OBJECT_ID
INNER JOIN HSP_OBJECT_TYPE OT
    ON O.OBJECT_TYPE = OT.OBJECT_TYPE
-- Sort on Object name, object type
ORDER BY 6, 1

Cross Dimension vs FIX

We are trying to improve calc times by using FIX statements instead of Cross Dimensional statements.We have had success with converting calcs like:"New Prod Dev" = "Total Manufacturing Expense->D904"intoFIX(D904)"New Prod Dev" = "Total Manufacturing Expense";ENDFIXBut we are having trouble with syntax for converting:"Total Sales Exp" = ("Total Manufacturing Expense"->D903)+("Total Manufacturing Expense"->D907)Basically the same statment, but we cannot get the FIX statement to work. Anytime we try to use any additive syntax within the calc and use the FIX it errors. Can't FIX on "Total Manufacturing Expense" because "Total Sales Exp" is from the same dim (account).Any help would be appreciated. Running 5.02 patch 13 a on HP Unix. Migrating next year to 6.5.ThanksGlen MoserConsultant

You need to be careful - the formulas that you posted are doing two different things. For example, the calculation:FIX(D904) "New Prod Dev" = "Total Manufacturing Expense"; ENDFIX Will work, but its NOT the same as:"New Prod Dev" = "Total Manufacturing Expense"->D904; The FIX basically means that you are moving the "Total Manufacturing Expense" into the "New Prod Dev" for D904 only. The cross dim will take the "Total Manufacturing Expense" for D904 and move it to the "New Prod Dev" for EVERY OTHER D*** member.The second calculation:"Total Sales Exp" = ("Total Manufacturing Expense"->D903)+("Total Manufacturing Expense"->D907) Takes two different member combinations and adds them into "Total Sales Exp" The question is, will this create the right result? If you look at "Total Sales Exp" for D903 it will be the same as the "Total Sales Exp" for D907 - and for EVERY OTHER D*** member. I don't know if that is correct.Unless you are going to change how this formula works or where it gets its value from, you can't use a FIX statement. If the purpose of the FIX is to improve calc time, why not use a member formula and make it Dynamic? Is the result being used in other calculations? Finally, regardless of the version you are on, FIX works the same way - this won't work in 5 or 6x.Regards,Jade---------------------------------------Jade ColeSenior Business Intelligence ConsultantClarity [email protected]

Cross-dimension or dimension-combined security

Similar Messages

Maybe you are looking for