OBIEE Row-Level Security Inquiry

Question

I had discussed a security requirement with one of our resources and it seems like a simple concept but for some reason I can’t think of simple way to implement in OBIEE.
If we have a fact table with a security column that has values which state what groups can see the data in that row (Multiple groups separated by semi-colons). The data in the row is layed out like this:
Group 1;Group 2;Group 3;Group 4
There is a user and group mapping table as well where if I pull a user (Say User1) the data in the column for their group assignments would look like:
Group 3;Group 10; Group 11
Since this user is in Group 3 they can see the values in that row of the fact table above (Because Group 3 appears in both).
Now I can run a session variable to get the user groups but how to then correlate to what rows they can see in that fact table is where I am stuck.
Can I solicit any suggestions?

Answer 1

They are various problems with your approach. To start with let's how OBIEE would like you to have the data:
State Sales
1 99
2 30
3 50
Then your user to group table should be like this:
User State
1 1
1 2
1 3
2 1
3 3
You would then do an row-wise Init Block to populate the GROUP variable. Then you simply do a filter in your BMM layer State = VALUEOF(NQ_SESSION.GROUP). Note that GROUP is that a list of groups so OBIEE will take care to convert this to SQL correctly. Now the way you have your data I don't think you can easily do row-level security. Basically what you need is to have your Group as dimension in your fact. What you have a is concatenated value which is useless. Also your user to group mapping table needs to be flat so you can do the row-wise init block. Hope it helps.