Not sufficient authorization to run a query : multiple authorization

Question

Hello,
I have ran into an issue way beyond my BW skills concerning authorizations used to restrict Queries data for certain characteristics. I am not sure which information are relevants, so here is all I gathered :
Screenshot of the rsecprot transaction after the Query has failed to run:
[http://f.imagehost.org/view/0113/rsecprot]
As you can see on this screenshot, we want (the query is requesting, I suppose) "AND /BIC/OR_CA4010 = ':' " and the authorization is "OR_CA4010  I CP * " so this okay, and the second part, we want "/BIC/
OR_CA0111/BIC/OR_CA4001 = ':' " and the autorization is only for "OR_CA0111__OR_CA4001  I EQ USA9996" so this is probably the part which fails, since the query is requesting all the data while the user only has access to one value.
In my poor understanding of the issue, it seems that this isn't a normal behavior, one would assume that queries would restrict themselves to allowed data, and this is what actually happens  when there is only one authorization involved. However, with two, the mix doesn't seem to work...
What is interesting is that if I set the values for OR_CA4010 (in the variable entry screen) for instance to the values "Node 1" and "Node 2" seen in the rsecprot, then the query is working fine and if I set it to another value, then the query doesn't work , so it seems that the issue isn't really the authorization themselves, but the way we set them up.
Any idea on what the issue may be? Any guidelines on how to set up authorizations in queries ? Maybe we missed something obvious which make it works in most cases but not in this one (since otherwise the queries are working fine, we don't have many user which this kind of authorization set up)
Thank you very much in advance!
Guilaume

Answer 1

Abhishek,
Thanks for your interest, I'm glad you took a peek at this thread
I am not sure what you are asking tho ... So to make things simpler, I created a very simple query with only the following things :
-> Two characteristics as rows, the two which are mentioned in rsecprot (OR_CA4010 and OR_CA0111__OR_CA4001), as you can see on the previous screenshot
-> Those two characteristics have a restriction in "Default Values" : a variable for each, which have been created as "Processing : By Authorization" (one is a "Hierarchy Node", for OR_CA4010 which has a hierarchy, and the other one is just a "Characteristics Value")
So, as you can see, you can't make it more simple ! And I still get the same error and the same log in rsecprot. Is it any helpful to you ?
Is there anything else I need to check? The authorization given to the user contains values for those two characteristics...
This is driving me crazy