Logical OR in BW authorizations

Question

Hi,
I am using BW 3.5. and have following authorizations issue:
My cube contains 2 country-related infoobjects, 'sender-country' and 'receiver-country'.
For simplification lets say the cube contains only 3 records:
Sender   Receiver   Amount
DE         FR           100,--
FR         GB            80.--
US         DE            70,--
The user access to this cube must be restricted like this:
User 1 should have access to all DE data, but regardless in which country field the value DE occurs, in other words, its a logical OR. if the value 'DE' appears in either field the record should be displayed. In the example above he would therefore see record 1 and record 3.
Likewise, another user with access to FR should only see record 1 and 2.
To my knowledge the authorizations usually work as a logical AND, that is, if I make both characteristics authorizationrelevant and create 2 roles with:
Role 1:                   
Sender: *                
Receiver: DE
and
Role 2:
Sender: DE
Receiver: *
then it will internally grant * to both sender and receiver which I dont want.
Any ideas how to design this?
Thanks for any insight.
Regards
Udo

Answer 1

Hi Olivier,
Thank you very much for your answer.
Unfortunately it does not work with this approach, or only partly.
I have set up the authorizations the way you mentioned, still I am getting a 'no authorization message' for records that should be accessible now.
On the other hand, the existing roles do work correctly if I put fixed filter values for the countries into the query.
For example a query with SENDER = DE, Reciever = ZZ is accessible, which is correct with the new roles.
However, the scenario does not work if the allowed filter values are retrieved via the authorization variables.
I think this behavious is due to the inability of the query to process logical OR filters.
The authorization variables retrieve the allowed values from the roles.
These roles contain now the allowed value set
Sender = DE, Receiver = *
and
Sender = *, Receiver = DE
These values cannot be applied meaningfully as it would lead to a logical OR in the query select statement which cannot be done.
So I dont see any further solution to this....do you?
Regards
Udo