Member access and inheritance

Hi,
I am wondering if there is an access level missing for member, or if there is good reasons not to have it.
If I desing a class C with an attribute a. For some reason, I want a to be as private as possible (not accessible for the other class in the package of C, so protected is not enough), but I also need the class SubC (which is a sub class of C) to have access of a.
To me, it seems very intuitive to have an attribute shared within a family of class but not to the neighbours. However, I feel that since it is not possible to do so in Java (as reported in http://java.sun.com/docs/books/tutorial/java/javaOO/accesscontrol.html), then either there is a good technical reason or it's again the way of thinking and I should simply package things differently.
Anyone can help me to understand that?

Thank you all for you comments. I guess the answer is
that I have to change my idea about what is a
package. You said a package should contain classes
that interact with each others instead of similar
classes. However, when I look at Sun's packages, my
impression is that package are made over similar
classes instead of interacting classes:One thing you should take care to not do is assume that because it's done a certain way in the JDK, that that is the way it should be done. Some of the worst Java code and designs are in the JDK. Look at the Date class for an example of terrible design.
HyperlinkEvent vs MenuListener in java.swing.event or
Date and HashMap in java.util. Plus, it does not make
sense to try to package interacting classes since the
interaction relation is not necessarily transitive (A
can interacts with B which interacts with C while A
and C are totaly independant, but they may end up in
the same package). So I wonder if interaction between
classes is really the philosophy behind a package?I'm not coming from the a philisophical perspective. My point is purely pragmatic and (I feel) irrefutable. Java has no friend access. In order to give certain (non-child) classes special access, you have to put them in the same package. If you want to make use of this feature, you need to group the classes that need this special access with each other in a single package. You can structure your classes in other ways and still make things work but you won't be able to use package-level access effectively.

Similar Messages

Data access in reports after changing Member Access profile

Hi All
I made changes in the member access profile of a user (while current system was available for User Planning).
After making and applying these changes in Access profile, the Current view in the report accessible to user got updated.
But the problem was in reporting, where the updates didnot happen.
Please suggest for necessary steps so that user get updated report as per change in Member access profile.
Thanks in advance.
Regards
Abhishek

Hi Lokesh
Thanks for the reply.
1. Report is based on CV
2. With another ID assigned to same member access profile, the report is showing complete data.
I mean with X user id 100 data sets are showing while with Y user id only 95 data sets. Where both X and Y are having same Member Access Profiles.
Regards
Abhishek

Dynamic non-hierarchy based Member Access Profile

Hello all,
I have few (semi related) questions:
Qouestion 1:
I would like to perform the following configuration:
1. We have a dimension called "Budgeting Model".
2. We have a property called "Division" to this dimension.
3. I would like to create a Member Access Profile based on the value of the property.
4. I do not want to use hierarchy.
Question 2:
1. We have a dimension called "Budgeting Model"
2. We have a dimension called "Profit Center"
3. I would like to create a property for the Budgeting Model called Profit Center that will be checked against the Profit Center dimension valued. I saw something in the documentation but I wonder if anyone can provide me with a step-by-step guidance.
Generally speaking - I am trying to create the BPC/IP "Characteristics relationships" functionality in BPC and using the Profit Center as a secured dimension bypass the limitation of question 1 above.
Thanks in advance for you help,
Avihay

Hi Avihay,
1. Yes, you are absolutely right. You cannot set it dynamically. This maintenance has to be done manually.
2. If you look at the entity dimension, this dimension refers to currency type dimension. Similarly, an account dimension refers to the rate type dimension. You can see these information when you modify these dimensions. These relationships are pre-delivered. And you cannot create any new relationships.
So, lets say if you want to create a relationship, then you can have one dimension as entity and another as currency. Then you can establish the relationship between them. This is just an example. You can explore more on these types of pre-existing relations.
Hope this helps.

Member Access Profile Setup to Secure multiple Dimensions

Hey Experts!
We're running BPC 5.1.502 on Microsoft SQL 2005.
Until yesterday, we were only using a single dimension (CATEGORY) to restrict our user's ability to push data into BPC. We have 4 Categories. (ACTUALS, QUOTA, FORECAST, and ACCRUALS). ACTUALS were completely locked down (Read-Only) and the other three Categories were Read-Write.
I was asked if we could change this so that our users could still have full Write Access to the three non-Actuals Categories; but also have the ability to write to a specific ACCOUNT under the ACTUALS Category.
Initally, this seemed doable. I set up the Member Access Profile as follows:
READ & WRITE - CATEGORY - [ALL]
READ ONLY      - CATEGORY - ACTUALS
READ ONLY      - ACCOUNT     - [ALL]
READ & WRITE - ACCOUNT     - BASE_Quota_Monthly
This setup is not working because now our users can only write to the "Base_Quota_Monthly" account regardless of what Cagetory they're working with. Now I know I can set up Read&Write access for every single one of our Accounts, but we have hundreds of Accounts and it will be an administrative nightmare. Is it possible to just limit a Single Account within a single Category, but not within All Categories?
Any help would be greatly appreciated.
Thanks!
Sean

Hi Sean,
Combination of dimensions will not help. When you specify, READ & WRITE - ACCOUNT - BASE_Quota_Monthly and READ ONLY - ACCOUNT - ALL, the user will have write access to only BASE_Quota_Mothly and not others, irrespective of the categories. So, when we are defining the profile, the dimensions are completely independant of each other.
If you want to the write access to one account for only one user, that can be provided by creating a member profile and assigning it to only that particular user. However, the independance between the dimensions will still exist.
Hope this helps.

Member Access Profile - update from table MemberAccess

Hello,
We need to do an update in all our member access profiles. As we have 710 profiles, it's very time consuming to update each of them seperately.
I was looking into the table MemberAccess profile to update the profiles. I manage to update all profiles with one query but unfortunately it seems that we still need to go into SAP BPC Admin to process each profile. If I don't process in SAP BPC Admin, I get the error in Excel: 'There is a problem in dimension file: Entity' and the current view in Entity dimension just shows ...more... instead of the correct security!
Is there another way of updating the MemberAccess profiles in 1 go, without needing to process it individually? This would save us a lot of time!
Thanks,
Sofie Luyten

Sofie,
Are you assuming it didn't work because of the "Return Value = 0" result? That stored procedure isn't designed to return anything so whether it ran properly or not you wouldn't get much back (except an error message is something went very wrong).
The only way that you can know if it worked is to look at the acsEntity table and make sure it has all of the proper records. I guess you can also start up SQL Profiler before executing the stored procedure to see what the stored procedure runs and make sure that's what you want. I'm not sure how familiar you are with SQL though so that may not be helpful for you.
Jimmy

Dump Error when I open 'Member access Profile' in Admin client

Hi,
We have recently performed DB-Refresh.
In Admin client: when try to create a user and assign the user to team it throws the error: "Object Reference not set to an instance of an object".
There are no 'Member Access Profiles' and when we click on 'Member access Profiles' it throws a dump error.
We have the issue with APPSHELL as well. I've deleted and re-created the APPSHELL but still same issue.
Please let me know how to resolve this issue.
Thanks

Whenever you see dumps on accessing the security profiles/ cannot add/modify users..
it is usually a mismatch with the BPC Server, BPC CLient (on your machine) with .NET server.
Please check the BPC server version, and go to the installation doc for that SP, you will find the relevant client and .NET versions to go with the Server version..
Hope this helps..

Netscape.security.AppletSecurityException: security.member access

Hi,
I have a jarred applet. Netscape4.7 reads it fine.
There is a class in the jarred file, that reads in a property file
from the server and populates some public fields in that same class.
And to do this, i have tried using reflection - the getFields/getDeclaredFields methods
of the 'Class' class. I get the following:
netscape.security.AppletSecurityException: security.member access
at java.lang.Throwable.<init>(Compiled Code)
at java.lang.Exception.<init>(Compiled Code)
at java.lang.RuntimeException.<init>(Compiled Code)
at java.lang.SecurityException.<init>(Compiled Code)
at netscape.security.AppletSecurityException.<init>(Compiled Code)
at netscape.security.AppletSecurityException.<init>(Compiled Code)
at netscape.security.AppletSecurity.checkMemberAccess(Compiled Code)
at netscape.security.AppletSecurity.checkMemberAccess(Compiled Code)
at java.lang.Class.checkMemberAccess(Compiled Code)
* at java.lang.Class.getDeclaredFields(Compiled Code)
I have used reflection in the main applet class of the jarred file,
(getDeclaredMethods/getMethods) and it works fine.
I was thinking that if the browser loads a class from over the
network, then it would atleast allow that class to perform reflection
on itself, if not on other classes.
Can anyone please enlighten me please ?
Thanks,
-r:)

I got the solution, I thought I tried it with getFields,
but seems like i did not. The applet works with
getFields, and hence solves my problem.
Thanks all.
-r:)
Hi,
I have a jarred applet. Netscape4.7 reads it fine.
There is a class in the jarred file, that reads in a
property file
from the server and populates some public fields in
that same class.
And to do this, i have tried using reflection - the
getFields/getDeclaredFields methods
of the 'Class' class. I get the following:
netscape.security.AppletSecurityException:
security.member access
at java.lang.Throwable.<init>(Compiled Code)
at java.lang.Exception.<init>(Compiled Code)
at java.lang.RuntimeException.<init>(Compiled
d Code)
at java.lang.SecurityException.<init>(Compiled
d Code)
at
t
netscape.security.AppletSecurityException.<init>(Compil
d Code)
at
t
netscape.security.AppletSecurityException.<init>(Compil
d Code)
at
t
netscape.security.AppletSecurity.checkMemberAccess(Comp
led Code)
at
t
netscape.security.AppletSecurity.checkMemberAccess(Comp
led Code)
at java.lang.Class.checkMemberAccess(Compiled
d Code)
* at java.lang.Class.getDeclaredFields(Compiled Code)
I have used reflection in the main applet class of the
jarred file,
(getDeclaredMethods/getMethods) and it works fine.
I was thinking that if the browser loads a class from
over the
network, then it would atleast allow that class to
perform reflection
on itself, if not on other classes.
Can anyone please enlighten me please ?
Thanks,
-r:)

Security - How to use Denied member access

I am trying to understand how the "denied" setting works in member access profiles.
I have an entity hierarchy with a parent (TotalCompany) and several children (CompanyA, CompanyB, CompanyC, etc.). I want my user to be able to access all entities except CompanyA.
I set up two member access profiles: Entity_Totals has read access to the parent entity (TotalCompany) at the top of my entity hierarchy.
Entity_X_CompanyA has denied access to CompanyA, a child of TotalCompany.
I assigned both to my user. But he can still read data for CompanyA as well as all other entities in the hierarchy.
Am I setting this up wrong or do I just not understand how "denied" works?
I am on version 5.1, SP 8.

Hi,
The problem is when you've conflict between profiles. The rule is less restrictive profile wins.
For example:
Profile A    R&W (Read & Write) Sales Wold
Profile B    Read only                   Sales Europe
Profile A wins B is ignored
So user can R&W Sales world and all underlying nodes like sales europe
Another example:
Profile A   Access Denied       Sales Europe
Profile B   Read only                 Sales World
Profile B wins (less restrictive) profile A is ignored
User only can read data for node sales world and all underlying subnodes like europe and their leaves
Another one:
Profile A   Read only        Sales World
Profile B   R&W                 Sales Europe
Profile B wins Profile A is ignored
That means user only can R&W node Sales Europe and their underlying and leaves.
So you have to analyzed the conflicts between your profiles.
Remember the rule is less restrictive profile wins.
Hope it helps.

Member Access Profiles--Dimension combinations

My client has the following setup (simplified):
Entity--Total, children Asia, Europe
Category--Actual, Forecast, Budget
A user has 3 access profiles:
1. R/W Asia
2. R/W Actual
3. R/W Budget
They are separate profiles so write access can be turned off for Budget when the budget is locked down
They would also like to have, at the same time, Read Actual (not budget or forecast) to Europe. I can't see a way to make this happen. If I put Read Europe on profile 1, they will be able to read Budget for Europe as well.
It seems this requires changing the Category rights, based on the Entity, and my understanding is each dimension's security is independent of other dimensions.
Is it possible to achieve this, at least through the front end? Thanks in advance for any insight.
Regards,
Paul B.

Don't use member access profiles to secure categories of data selectively, based on where users are in the business process workflow. Use work status settings instead -- this relieves the administrator from having to update constantly the member access security profiles (users control their own work status), and also allows, for example, for a given user to have access to the 2009 Budget but be prevented from changing the 2008 Budget (same category, different time period).
You may find it useful to secure the category dimension as simple R/W for Budget, Read-only for Actual. This assumes your users need to do nothing at all in the Actual version (such as run currency conversion logic, etc.) In some cases, key finance people in fact may need write access to Actual as well, even in a planning application.
For a consol application, many people need write access to actual, in which case I'd normally not secure the category dimension at all. I'd probably secure Datasrc instead, which allows you to control in what ways different types of users can change things.

Transport of Member Access Profiles

Hi,
I created a significant number of member access profiles in DEV and had these transported in QA. I attached these profiles to users and they were working properly in DEV. However, after the transport , I attached the transported profiles to users and they are not working in QA. I tried to recreate some profiles in QA with the same settings, attached these to users, and they worked. Is there a way to make the profiles work without having to recreate them again in QA.
Thoughts would be greatly appreciated. Thanks.

Hi,
Please check if the following -how-to guide would be useful in your case. We have used this successfully in BPC 7.5 NW version SP04.
How-to: "How To... Use the BPC_NW Mass User Management Tool"
http://www.sdn.sap.com/irj/scn/go/portal/prtroot/docs/library/uuid/40e91e46-1c9b-2d10-1c87-fac75bd7b4bd?quicklink=index&overridelayout=true
You need to import the transport files to install the custom program 'ZUJE_MASS_USER_MGMT'.
This program howver had some issues in SP05 for NW version. I am not sure if the issue is fixed yet.
Otherwise, its an useful tool to transport across the security profiles from one system to another.
Thanks

Copy Member Access Profiles from the Test to Prod region

Is there a way to copy the Member Access Profiles from the Test region to the Prod region? We have updated all the profiles in the Test region for user testing and would like to copy them to Prod to avoid having to update all the member access profiles.

There is no "out-of the box" method for such a need. But if you study the tables in SQL, assuming you are using the BPC for Microsoft version, you may be able to copy the table contents from one application to another. Keeping in mind that Member Task profiles are at the application set level, and Member access to data is at the Application level.
Hope this helps.

Member Access Profiles

Why would a member access process not take effect?
Wehave changed a member access profile to remove access to one of the Secure dimensions (covered by another MAP) but the acsCategory table still has the erroneous access values. The MAP changes were applied and the security report does not include the records in the acsCategry table so why are they still there?

Sorin
We are using version 7.0 SP6.
We have CATEGORY_MAP which controls whether specific categories are read or write. All other MAPs control Entity access.
There was an issue where some users could run packages and overwrite read only categories. This was traced to CATEGORY Read & Write being included in a couple of the Entity MAP files - shown by App|Entity_MAP|Write in the acsCategory table.
We deleted the CATEGORY access from the Entity MAP file and selected APPLY. RUnning the report shows that the profile does not include category access BUT the records are still in the acsCategory table.
Obviously an issue.
Hope this explains better
Lesley

I am looking into Lightroom (Creative Cloud) to allow a Team Member access my Catalog to keyword search which images will work for our Social Media platforms.

I am looking at LR Creative Cloud to allow a Team Member access my catalog so she can keyword search which images will work for our social media campaigns. My catalog has both personal and business images (which are in separate folders), however, I only want them to access the business images. What is the best way to do this?
and a second question as I am new to the Cloud LR product. I am assuming that my images still stay on my external drive...how am I or her able to view these images if I am out of town on another computer?

My catalog has both personal and business images (which are in separate folders), however, I only want them to access the business images. What is the best way to do this?
I think the only way in Lightroom to make this happen is to use two catalogs, one for business and one for personal, and then prevent access to the personal catalog via putting it on a disk or location that your team member does not have access to.
I am assuming that my images still stay on my external drive...how am I or her able to view these images if I am out of town on another computer?
Situations like this require you to put the catalog file AND photos on the external HD and then move the external drive to whatever location and whatever computer is needed. An alternative is to put the photos on a network drive and the catalog file on a local disk and access the catalog locally and the photos via network, but that limits you to using a single computer.
I am looking at LR Creative Cloud to allow a Team Member access my catalog so she can keyword search which images will work for our social media campaigns.
As far as I know, this does not require Creative Cloud, nor does Creative Cloud help in this situation. Furthermore, if you are thinking about a situation where you and your team member have simultaneous access to the catalog(s) of interest, this is not possible in Lightroom. Lightroom is a single user application.
If you are interested in a true multi-use application, where more than one individual can access a catalog at the same time, you might want to look at Daminion. Note: I am not endorsing or recommending Daminion, as I have never used it; I simply point out the that it has the feature being discussed.

Member Access Profile in BPC

Hi,
I have some doubts w.r.t Member access profile in BPC. We have Entity and Category as secured dimension. Entity is read only (All members). Category is R/W (All members).
1) If i add a third row, and deny only one base member of Entity, whether it will work fine? Which definition system will accept? Read or deny?
2) In the above scenario, if i run the report on summary node of hierarchy (which has a denied base member), whether i will be able to read the values at summary node level.
3) When i say Entity members are read only .. cant i do input using input schedules for those entities?
4) How we need to copy these BPC authorizations to BI in BPC 7.0 (NW). Do we need to recreate these authorization concept in BI or the authorizations i define in BPC 7.0 (NW) are valid for BI also. In this case, if i run a report on BPC cubes using query designer in BI, how authorizations are checked?
Please suggest.
Thanks/regards,
Lokesh Nandula

Hi Lokesh
I will try to answer your questions:
1+2) If you give read/write access to a "Parentmember" all these settings are applied to all childs of this member. So if you give Read Access to a Parent the User will be able to see everything under this Member.
3) If you have Read Only on a Member, you cant send Data to the Database via Inputschedule.
If you have Read Only on the whole Entity Dimension you cant do any posting in the whole cube, regardless of the settings in Category Dimension (but I think this is clear in Multidimensional Systems)
4) Unfortunatly in Germany the RampUmp Version of BPC7NW is still not shipped, so I cant answer on this point
Regards
Jörg

Multiple Member Access Profiles

I am not clear on the interaction between member access profiles. A client would like the following situation. Entity and Category are secured.
1. R/W to Asia region (E), R/W to Actual and Budget (C)
2. Ability to turn off W access to Budget, but not Actual
If they create 3 mbrAccProf:
a. R/W access to Asia Entity and R access to all Categories
b. R to All Entities and W to Actual and Budget
c. R to All Entities and W to Actual only
If they assign a. and b. to the Asia team, does that net to R/W access to Asia Entity and R/W to Actual and Budget?
If they then remove b. and assign c., does that net to R/W access to Asia Entity and R/W to Actual only?
The purpose of this is to avoid having 2 MbrAccProf for every region, e.g. AsiaActualBudget and AsiaActual, CanadaActualBudget and CanadaBudget, etc. There are more combinations of category desired, but this encompasses the problem.
Sorry for the long post, thanks in advance for any insight you can provide. I have consulted the help and searched the forum, but have not found understanding.
Paul B.

This may not solve your issue, but I encourage all customers that need W/R access to category, to create member access profiles for Category ONLY, which are then added to the Team profiles, in addition to Entity memebr access profiles. That way, if you want to turn off access to BUDGET, you only have to perform this once. But you may still have a seperate access point in the Regional profiles. The nice thing about memebr access profiles is that you can assign more than 1 to any team, thus the highest level of current security wins access. Sometimes breaking out by dimension is easier than the combination of the dimensions in a profile. For example, if you have a process to turn on and off access to FORECAST and have 30 profiles of entity and category, you have to edit 30 times. Where as if you have 1 profile for category, you only need to edit 1 switch.
Hope this helps.

Member access and inheritance

Similar Messages

Maybe you are looking for