PERMIT_READ to limit dimensions

Hi,
I have a 9.2.0.6 EE DB running on Linux RHEL ES3.0. I am using AW to build a Cube and present it through Discoverer plus 10g. Everything is currently working fine and Discoverer produces great looking presentations out of OLAP.
What I am trying to do now is to build a security mechanism restricting the users to view the data based on product dimension. My product dimension has three level hierarchy: All Products -> Product Groups -> Products.
So, if user1 is logged in then I want that user to view only GRP1 and its children, user2 for GRP2 and its children and so on so forth.
In order to do this, I have an ALL_USERS dimensions containing all the available users and user_variable dimensioned by ALL_USERS and PRODUCT. I store 1 to the variable if a user has access to a particular product group and its chidren. And in the PERMIT_READ program, I use the following.
CONSIDER ALL_USERS
PERMIT READ WHEN ALL_USERS EQ USERID
CONSIDER PRODUCT
PERMIT READ WHEN USER_VARIABLE EQ 1
When I open the AW in OLAP worksheet and report the Product dimension, it properly displays the dimension values of product. However, in the Discoverer Query wizard, nothing comes up for Product dimension value window. Then I put 1 for user_variable for 'All Products' variable as well. That showed the top level product hierarchy, but was not able to drill down probably because I limited to one Product group.
Obviously, I am not doing something right! What's the better way to implement this logic?
Thanks for all your help
Suresh.

Ok, here's What I do.
1. a Load program loads the database Users with specific Cube access role into ALL_USERS dimension.
2. Product Dimension is refreshed daily.
3. a Load program gets the Product/User Combination from a relational table and updates PRODUCT_USER_VARIABLE with 1 where the combination matches.
In the PERMIT_READ program, I have following lines
CONSIDER ALL_USERS
PERMIT READ WHEN ALL_USERS EQ USERID
CONSIDER PRODUCT
PERMIT READ WHEN nafill(USER_PRODUCT_VARIABLE,0) EQ 1
In order to test whether it selects the right products, I had an outfile setup in permit_read program which reports the product dim after permits have been set. Output file correctly reported out the list of products enabled for the user logged in, when discoverer was launched.
However, when I build a query, the Product Dimension value window comes up with top level and was not able to drill down. My product has following hierarchy (ALL PRODUCTS -> PRODUCT GROUPS -> PRODUCT). The way I set the value in the user_variable was like following:
Value in the variable:
Product User1 User2 User3
All Products 1 1 1
GROUP1 1 NA NA
PROD1 1 NA NA
PROD2 1 NA NA
GROUP2 NA 1 NA
PROD3 NA 1 NA
GROUP3 NA NA 1
PROD4 NA NA 1
PROD5 NA NA 1
the result I want is when I logged in as User1, show up All Products in the product dim window and able to drill down to group1 and products. It shows up All products, but not able to drill down.
What am I doing wrong here?
Thanks for your help
Suresh.

Similar Messages

  • How to limit  dimensions values of querybuilder

    Hi,
    I want to learn how to limit dimension value in query builder. i want, the user who run the querybuilder can not see a dimension value which i do not want to display.
    For example,
    The time dimension has "2000" and "2001" values as default which is defined in database. Normally when i run the querybuilder for create new presentation or calculation, In the dimensions panel of the querybuilder display all values of each of dimension. The user can select values which she/he want from that list.
    But i want to limit values which the user can see in the dimensions panel of the querybuilder. for this time dimension example, i want to hide "2001" value from the user. How can i do it. if there is any sample code, please share.
    Thank you very much for your helps.
    ilknur

    Thanks Thomas, excellent suggestions as always.
    If anybody wants more information regarding Thomas' suggestions please refer to
    Oracle9i OLAP Developer's Guide to the OLAP DML for the AW Permit command.
    In sumamry: To create permission programs, you define two programs with the names permit_read and permit_write. In these programs, you can specify PERMIT commands that grant or restrict access to individual workspace objects. In addition, you write these programs as user-defined functions that return a Boolean value, and the return value indicates to Oracle OLAP whether or not the user has the right to attach the workspace.
    For relational security there is an excellent tutorial on the database pages of OTN, follow this link:
    http://otn.oracle.com/obe/start/index.html
    then follow the links for Oracle9i Database Release 9.2.0.2 - Security - Creating Label-based Access Control. This module describes how to use Oracle Label Security to setup security based on label policies
    These security layers should be transparent to the OLAP metadata layer, therefore, once you have implemented your chosen security method your BI Beans application will only need to connect with the appropriate user to inherit the security layer. For more information see the Security section of the BI Beans Help:
    http://otn.oracle.com/bibeans/903/help/
    BI Beans product Management Team
    Oracle Corporation

  • Limit Dimension to a  level? error! error!

    in OLAP worksheet
    step 1: show all members of channels_dim
    ->report channels_dim
    CHANNELS_DIM
    CHANNEL.2
    CHANNEL.3
    CHANNEL.4
    CHANNEL.5
    CHANNEL.9
    CHANNEL_CLASS.12
    CHANNEL_CLASS.13
    CHANNEL_CLASS.14
    CHANNEL_TOTAL.1
    step 2: show all levels of channels_dim
    ->report channels_dim_levellist
    CHANNELS_DIM_LEVELLIST
    CHANNEL
    CHANNEL_CLASS
    CHANNEL_TOTAL
    step 3:limit channels_dim dimension to 'CHANNEL' level
    ->limit channels_dim keep channels_dim_levellist 'CHANNEL'
    step 4:show status of channels_dim
    ->report channels_dim
    CHANNELS_DIM
    CHANNEL.2
    Why it has only one member in status?
    why not for CHANNEL.2,CHANNEL.3,CHANNEL.4,CHANNEL.5,CHANNEL.9?
    Please give me a hand!

    Use the relation instead in the limit statement:
    limit channels_dim keep channels_dim_levelrel 'CHANNEL'
    This will work.
    Suresh.

  • Limit dimension to members of particular hierarchy

    Hi,
    I have a dimension say dim1 which has two hierarchy h1 and h2.
    I want to limit my dimension to have members present in only h1 hierarchy.
    How can I do this?
    Thanks in advance.
    Thanks
    Brijesh

    Assuming that your AW was defined using AWM or OWB (i.e. it is standard form), then you should find two additional objects related to your dimension -- the INHIER valueset and the HIERLIST dimension. For example, if your dimension is named PRODUCT, then you should find
    DEFINE PRODUCT_HIERLIST DIMENSION READONLY LOCKDFN TEXT
    DEFINE PRODUCT_INHIER VALUESET READONLY LOCKDFN PRODUCT <PRODUCT_HIERLIST>
    (These are 11g definitions -- the 10g versions do not have READONLY LOCKDFN.
    The PRODUCT_HIERLIST contains one member for each hierarchy of the dimension, 'H1' and 'H2' say. To limit the dimension to just members in H2 you can say
    LIMIT PRODUCT TO PRODUCT_INHIER(PRODUCT_HIERLIST 'H2')

  • Possible to limit dimensions and measures when creating presentations?

    We are trying to use OLAP/BI Beans to add BI functionality to our next-generation data warehouse application. This application has its own security framework, with the ability to define permissions/privileges for objects. We need to integrate BI Beans/OLAP with this security framework.
    One of the things we need to do is control which OLAP objects (like dimensions and measures) are available to a given user in the Items tab when creating a presentation. For example, user A might see dimensions Alpha, Bravo and measure Charlie, while user B might see dimensions Delta, Echo and measure Foxtrot.
    We need to be able to apply these dimension/measure restrictions without using different Oracle users, with each having access only to their own OLAP objects. Our data warehousing application does not use Oracle and Oracle users to control security; it has its own internal frameworks for privileges/permissions. We therefore need to find a way to restrict access to OLAP objects in some programmatic way.
    Here's an example of how this might work:
    - I am a clinical analyst. I sign on to the data warehouse application. The data warehouse knows that as a clinical analyst, I have access to a certain list of objects and functionality across the application. One of the apps I have privilege to is the BI Bean Presentation Creation Application, so I click the menu to bring this up. I can now create BI presentations, but since I am a clinical analyst my list of available dimensions and measures do not contain any of the G/L, payroll or other financial OLAP objects.
    - If I signed onto the data warehousing application as a different user, one that has a financial analyst role, I might see a different set of OLAP objects when I run the presentation application application.
    So what we need is some API way to specify which dimensions and measures are available to a given user when they launch the presentation wizard. I've been digging through the BI Beans help and javadoc and have found a few things, but they aren't what I need.
    Here's what I found:
    - setItemSearchPath: this allows you to specify which folders are to be displayed. We want control at the OLAP object level, not at the folder level, so this doesn't work for us
    - setVisibleDimensions: this controls which dimensions are available in the Dimensions tab, not which dimensions can be selected in the Items tab. Doesn't work for us
    - setDimensionContext/setMeasureContext: These might work for us but I haven't been able to get them to retrieve anything yet. It also seems to me that these might set which dimensions/members are initially selected in the Items tab, not the list of dims/measures that are available for selection.
    Any assistance on this matter would be greatly appreciated.
    s.l.

    Reply from one of our developers:
    The get/setMeasureContext and get/setDimensionContext methods are currently only used by the Thick CalcBuilder (in a few limited scenarios) and cannot be used "to scope the dimensions and measures listed in Query and Calc builder based on user access rights".
    The scoping of dimensions and measures based on user access rights should be performed at the MetadataManager/Database level.
    This may change going forward as the real issue here is the static nature of the metadata and a general issue with the GRANT option within the database. So from the database perspective it is not possible to grant select priviledges on a single column of a table.
    The metadata issue is more complex as the OLAP API reads the metadata only once on startup of a session. The list of available measures is based on the GRANT priviledge, so for relational OLAP this limits the data scoping capabilities. In 10g, the metadata for AW OLAP becomes more dynamic and contained and read directly from the AW. Therefore, with an AW OLAP implementation with 10g it could be possible to scope boht dimensions and measures quickly and easily.
    Hope this helps
    Business Intelligence Beans Product Management Team
    Oracle Corporation

  • Limit dimensions in copy package

    Standard, all dims are shown.
    Is i possible to only show source en destination for dimensions Category and Time? All other dims are copied to themselves.
    Can you elaborated in detail if it is possible?

    Hi,
    In the standard copy DM, it uses %DIMS% to display all the dimensions. The selections are captured and then are used in the SQL statement to do the copy. Instead, you can use %CATEGORY_DIM% and %TIME_DIM% to display only these 2 dimensions. However, you need to make some changes in the SQL statement as well.
    Hope this helps.

  • Applying LIMIT (dimen.) TO TOP (...) BASEDON (...) structure in OLAP_TABLE

    Hi
    I'd like to know how to apply structure
    LIMIT dimension TO TOP (number of top member performers) BASEDON (measure)
    in OLAP_TABLE.
    For instance I have a cube SALES with 2 measures: SALES_VALUE and QUANTITY and a dimension PRODUCT with two levels: TOTAL and PRODUCT_NAME. Then I want to list 3 products with the highest SALES_VALUE and QUANTITY > 100.
    I can create for example such query:
    SELECT sales_val, quant, product_dsc
    FROM TABLE(OLAP_TABLE(
    'test_schema.test_aw DURATION SESSION',
    null,
    null,
    MEASURE sales_val FROM sales_value
    MEASURE quant FROM quantity
    DIMENSION product WITH
    HIERARCHY product_parentrel
    INHIERARCHY product_inhier
    ATTRIBUTE product_dsc FROM product_description
    ROW2CELL r2c'))
    WHERE
    OLAP_CONDITION(R2C, 'LIMIT product TO product_levelrel eq ''PRODUCT_NAME''', 1)=1
    AND OLAP_EXPRESSION_BOOL(R2C, ' quantity gt 100')=1
    AND OLAP_CONDITION(R2C, 'LIMIT product TO TOP 3 BASEDON sales_value, 1)=1;  ???????
    Instruction above does not work completely well, because it will give 3 rows with top values of SALES_VALUE measure, but in this case OLAP_CONDITION(R2C, 'LIMIT product TO product_levelrel eq ''PRODUCT_NAME''', 1)=1 is not fulfilled (row with values of TOTAL_PRODUCT level appears).
    One can create such query:
    SELECT sales_val, quant, product_dsc
    FROM TABLE(OLAP_TABLE(
    'test_schema.test_aw DURATION SESSION',
    null,
    *'LIMIT product TO TOP 3 BASEDON sales_value', ?????*
    MEASURE sales_val FROM sales_value
    MEASURE quant FROM quantity
    DIMENSION product WITH
    HIERARCHY product_parentrel
    INHIERARCHY product_inhier
    ATTRIBUTE product_dsc FROM product_description
    ROW2CELL r2c'))
    where
    OLAP_CONDITION(R2C, 'LIMIT product TO product_levelrel eq ''PRODUCT_NAME''', 1)=1
    AND OLAP_EXPRESSION_BOOL(R2C, ' quantity gt 100')=1;
    It leads to the same result as the first query.
    What shuold I do to make OLAP_CONDITION(R2C, 'LIMIT product TO product_levelrel eq ''PRODUCT_NAME''', 1)
    fulfill in query above?
    I can add that query below works as it should (LIMIT TO TOP... omitted).
    SELECT sales_val, quant, product_dsc
    FROM TABLE(OLAP_TABLE(
    'test_schema.test_aw DURATION SESSION',
    null,
    null,
    MEASURE sales_val FROM sales_value
    MEASURE quant FROM quantity
    DIMENSION product WITH
    HIERARCHY product_parentrel
    INHIERARCHY product_inhier
    ATTRIBUTE product_dsc FROM product_description
    ROW2CELL r2c'))
    WHERE
    OLAP_CONDITION(R2C, 'LIMIT product TO product_levelrel eq ''PRODUCT_NAME''', 1)=1
    AND OLAP_EXPRESSION_BOOL(R2C, ' quantity gt 100')=1;
    Thank you in advance for any help
    Peter

    Peter, Yes, I hadn't considered the condition sales_value greater than 100 in my mail.
    You can try either of the below limit cmds to include that condition too:
    limit product to limit(limit(limit(product to (product_levelrel eq 'PRODUCT_NAME') AND (sales_value gt 100)) keep top 3 basedon sales_value) sort top 3 basedon sales_value)
    -or-
    limit product to limit(limit(limit(limit(product to product_levelrel eq 'PRODUCT_NAME') keep sales_value gt 100) keep top 3 basedon sales_value) sort top 3 basedon sales_value)
    I dont think one can be sure that having separate olap_condition filters for each condition will work fine all the time. To simulate the cascading of AND operations of where clause (filters) in SQL, we can use the nested limit() function to act on progressively smaller/better qualified resultsets (cells). SQL query would apply the AND filters in any manner or order that the optimizer deems fit whereas using the limit function with keyword "keep" within it indicates an implicit order of filters. SQL query with multiple olap_conditions might rank and find top 3 -or- bottom 5 before it applies the filter "sales_value gt 100". In such a case, you may find that the query will return no rows or return only the top 1 or 2 out of top 3 which are gt 100 -or- in case of bottom, return no rows or return less than 5 members (only those above 100) -- not necessarily 3 "top 3" or 5 "bottom 5" members.
    rgds
    Shankar

  • Dimension administration by end-users

    Dear colleagues,
    I am designing BPC solution for Headcount planning. End users should be able to change properties for employee dimension. This would be done by approx. 40 users (Fund Centre managers). Is this possible to be done within BPC admininstation, what are the challenges and risks? Has anyone done it with so many users? As far as I know it is not possible to customize or limit dimensions, which can be changed by a user. So it would be very risky that someone changes property, which he should not.
    Thank you!
    Kind regards
    Ivan

    Hi Ivan,
    If the user activity will be limited to member property change (not creating of new members) then the risk is moderate. It can be done by modified code of Master Data on the Fly http://www.sdn.sap.com/irj/scn/go/portal/prtroot/docs/library/uuid/2020b522-cdb9-2e10-a1b1-873309454fce?QuickLink=index&…
    Using this badi you can add required restrictions. You will need to change code to allow update of properties only.
    Vadim

  • Ripping DVD's: what to do about special features

    What do you guys do about special features on DVD's? I rip everything to my drives, but then the AppleTV becomes a clutter of entries...

    Well, I like to keep everything organized, so I encode the specials features as one file with the movie. They play after the movie plays. When Apple allows us to add chapters, then I will be able to just skip to them instead of fast-forwarding.Okay, I understand now. Actually, Apple already allows you to chapter your movies. However, if you do so in the normal fashion, then you will have to put everything in an MOV file container instead of MP4 or M4V containers. This means you cannot associate external "cover artwork" but, if you want to include it, embed it in your movie as a poster frame and limit dimensions to your frame size. You can use a program like Metadata Hootenanny to capture/insert chapters from your DVD or simply insert a single chapter marker at the beginning of your "special." In adddition to the "fast forwarding" capability of TV you mentioned, it also creates "pseudo" chapters of equal time intervals for "stepping" through your movie rather than "fast forwarding" if preferred. Unfortunately, they would probably not be very accurate for finding the start of your "special" content.

  • MaxL / INCBUILDDIM - two dimension limit

    I'm trying to build multiple dimensions in a single MaxL 'import database dimensions' command by including multiple 'from xx using rules_file xx' blocks separated by commas. This syntax is as per the documentation.The reason for building multiple dimensions in a single 'import database dimensions' command, rather than using multiple commands is that this achieves the same effect as the ESSCMD 'INCBUILDDIM', where the database is only restructured after ALL the dimensions have been built.MaxL doesn't error, but it only builds the first two dimensions specified and simply ignores any others! Has anyone seen this issue - I'm wondering if it's a MaxL bug (v6.5.1). I've tried different dimensions, changing the order etc. Always the same - builds the first two, ignores anything else.Thanks..

    Assuming that your AW was defined using AWM or OWB (i.e. it is standard form), then you should find two additional objects related to your dimension -- the INHIER valueset and the HIERLIST dimension. For example, if your dimension is named PRODUCT, then you should find
    DEFINE PRODUCT_HIERLIST DIMENSION READONLY LOCKDFN TEXT
    DEFINE PRODUCT_INHIER VALUESET READONLY LOCKDFN PRODUCT <PRODUCT_HIERLIST>
    (These are 11g definitions -- the 10g versions do not have READONLY LOCKDFN.
    The PRODUCT_HIERLIST contains one member for each hierarchy of the dimension, 'H1' and 'H2' say. To limit the dimension to just members in H2 you can say
    LIMIT PRODUCT TO PRODUCT_INHIER(PRODUCT_HIERLIST 'H2')

  • Limit rows for Degenerate dimension in SSAS 2012 Standard Edition

    Hi Experts,
    I have a fact table consisting of 4 measures and 6 descriptive fields. The Geography and Time dimension are separately palaced. I want to build SSAS cube on this schema.
    I have created the dimension from fact table itself for the descriptive fields. The scenario is that we are not loading complete fact table in SSAS. Only recent 2 years out of 10 years is brought into SSAS. But the degenerate dimension is procssesing all
    the rows from fact.   
    I want to limit the dimension processing to only recent two years of data. How will I be able to achieve this?
    Please help me out of this.
    Thanks,
    RuchikaG

    Use a view as the source for dimension. Inside that write logic to filter data from the fact for last two years.
    ie like
    WHERE dateField >= dateadd(yy,datediff,yy,0,getdate())-1,0)
    AND dateField < dateadd(yy,datediff,yy,0,getdate()) + 1 ,0)
    Then take distinct attributes from it for the dimension
    Please Mark This As Answer if it solved your issue
    Please Vote This As Helpful if it helps to solve your issue
    Visakh
    My Wiki User Page
    My MSDN Page
    My Personal Blog
    My Facebook Page

  • Limit array dimension

    On the front panel is an array of dbl. I want to only allow the user to select four (0-3) using the index display. How can I limit the index display?
    Solved!
    Go to Solution.
    Attachments:
    Array dimensions.vi ‏6 KB

    You can hide the index display, then make a seperate control where you can set entry limits. Use a value change event on it to set the "index values" property to scroll the array. Make the upper limit of the control dependent on the size of the array and the number of elements visible.
    For example, if the array is size=4 and the display is size=3, only allow 0..1 on the control using data entry limits.
    You could even wrap the entire thing into an xcontrol. The advantage of an xcontrol is the fact that is also work in edit mode.
    Message Edited by altenbach on 02-01-2010 09:35 AM
    LabVIEW Champion . Do more with less code and in less time .

  • Limit Panel Resize to One Dimension?

    Is there an easy way to limit panel resizing to a single dimension? That is, can I make a front panel that allows resizing the HEIGHT but not the WIDTH?
    What would be nice is if there was a way to set the "VI Properties>>Window Size" MAXIMUM size along with minimum (default to <Inf>). But I would settle for a programmatic way to do it, too. I tried making a UE to catch the <Panel: Resize> event, and replace the "Left" and "Right" bounds of the NewBounds with those of the OldBounds, but that ended up doing some wonky stuff.
    Anyone out there found a solution for this problem?
    [I should add, I'm still running LV 8.6.1...maybe this has been addressed in later versions?]

    I'm pretty sure that there isn't, as I don't think Windows supports it and resizing windows is presumably handled by it.
    If there's a window message associated with the resize, you might be able to intercept it using some platform-specific code, but that's beyond the realm of my own experience.
    One thing you can try to do is disable the resizing completely and then add your own resizing logic and code (such as buttons near the edge which will expand or compact the UI by X pixels). I think this is what you usually see in programs which allow expanding in only one direction (although usually the buttons expose an entire pane at once).
    Try to take over the world!

  • How to limit data for a dimension in any subject area?

    Hi folks,
    I do have a little problem, maybe you can help me:
    I have a large subject area for all my countries and product i sell there.
    now i want to have special subject areas for certain countries.
    that for i ducplucated my large subject area, went to the identity manager and there I set special Rights für the users: I chose my fact measure and put a data filter for it on the dimension country.countryname = Germany.
    I hope you can fallow me until here. ;-)
    Now I can build a query in answers and it works, within this subject area I only get data for Germany.
    BUT: when I'm on the criteria tab and try to create a filter on my countryname (from the dimension) it shows me all the countries I have.
    I think for the end users this is a litte bit confusing.
    So how do I limit the dimension in this subject area to a particular value?
    I would be very happy for help, cause then I could finish my development for today ;-)
    Kind regards,
    Sven

    Try this; @BMM Fact source properties->Content tab->WHERE clause section add the dimension country.countryname = 'Germany'.
    Also set the implicit fact on the subject area.
    Let us know how it works
    Edited by: Srini VEERAVALLI on Apr 8, 2013 7:12 AM

  • Restricting dimension values = PERMIT_READ

    We have an EPM table which stores user_id and dimension members e.g. Business units user has access to. (e.g. 5 out of master list of 100 members.). When user queries using Excel add-in we would like him to be able to see results only for dimension members based on this table.
    Using PERMIT_READ how do we restrict BU dimension to only this list of values for that user session. Any examples?
    e.g. Select bu from my_epm_tab where user_id='aa111';
    bu101
    bu102
    bu103
    Now we want to restrict the cube bu members for which user can see results via Bi Add-in only to this set.What steps do I follow to initialize BU dimension to these values for this session? Any specific format to to initialize these database values into dimensions?
    Thanks,
    Sudip

    1. This is expected behaviour if you think about it. The user you logon to may not have the very top level of the POS tree (worldwide). SO you get blank and "expand all" gives you what you are supposed to see. For users who have access to the very top lvel of the POS hierarchy will see what they should see.
    2. If PERMIT_READ is implemented to filter dim values based on user_id then shared work books should work fine. make sure to save your selection as steps and not values.

Maybe you are looking for