OBIEE Data Level Security - Prompt While logging into the OBI Portal

Question

All,
Below is what we are trying to see if it’s possible
We have a BM say 'Sales and Profits' . This is a simple model built around 1 fact and 5 dimensions. The underlying tables contain data from 5 different geographic segments US-NE, US-SW,US-NW,US-Midwest, US-All Segments.
The dimension table 'Segments' has all the above said values which are used to build reports related to each segment and all segments etc..
We have Groups/Users assigned in the repository (Using OBI Rpd security) based on the above segments.
If we want a user from 'US-NE' group to see only data related to his segment , we can add a filter condition to the group privilege tab ( Using SQL expression segment = 'US-NE') . This is straight forward.
Now the problem part , if we have a user who should be able to access data from two segments ,how do we handle it ? . We don't want to go and create multiple groups and assign users to them from the RPD groups.
Other ideas we considered were
Duplicate the BM and add a filter through the LTS ( based on segment value) . Assign group permissions to the corresponding presentation models. This idea though has a lot of disadvantages. Firstly , it would mean creating several duplicate BM and every time we update the master BM we will have to update all duplicate models
Another idea was to specify the filter based on presentation model, while assigning the group privileges ( Using the expression from Group permissions). This approach is at least cleaner in the sense we will have to deal with only 1 BM and 1 Presentation model., but we will run into the same problem of having to create multiple groups or assign users to multiple groups ( Users who will have access to multiple segments)
An ideal solution -
When a user tries to log in or immediately after he logs , Is there a way we can throw a pop-up that will force the user to select segment(s)? This should enforce the data restriction. I did not find a way to do this especially while using RPD based security model. Any ideas how we can do this ?
Since the 'Segment' dimension table is applicable to all BM in our systems (All fact tables in our warehouse have a link to the Segment table). We would ideally want this implemented across all dashboards and reports within in the OBI portal
SK

Answer 1

Now the problem part , if we have a user who should be able to access data from two segments ,how do we handle it ?
You handle it on the same way as 'US-NE'. You will create another group called say US-SW then add the filter to it and make sure the user belongs to both groups. OBIEE will translate this into IN('US-NE', 'US-SW').We don't want to go and create multiple groups and assign users to them from the RPD groups.
You will need to create the groups but you can avoid having to asign them to the group in the RPD by using an init block to populate the GROUPS variable when the user logins.The other options are hacks...