Security/Filter on a Shared Member Parent

I have a few alternate rollups in my 'Organization' dimension. I have allowed Read access to the appropriate 'real' members. In my primary rollup, if all of the children for a parent have Read access then the parent can also be viewed, and so on up my hierarchy. However, this does not hold true in my alternate rollups. Under a parent where all of the children are shared members and the user has Read access to all of the shared members they cannot see the parent. I have to go through each alternate rollup and manually add the appropriate parents to my security filters. Is there a better way to do this?We're on Essbase 5.0.2. If this is fixed in later releases please let me know as we are planning an upgrade soon.Thanks,Damon

Would something like this work? EsbOtlFindMemberPass hMember to EsbOtlGetNextSharedMember While LoopPass hShared to EsbOtlGetParentPass hParent to EsbOtlGetMemberInfo (to get the szMembername)hShared = hHandleLoop Loop will continue until EsbOtlGetParent <> 0.

Similar Messages

"Zoom out" on shared member defaults to different hierarchy??

Hi Guys,
I've created a shared member Cost Centre hierarchy in my outline. When I "zoom in" to the shared member hierarchy to level 0, then try zoom back out, level 1 is no longer the shared members level 1 as I've defined in my new shared member hierarchy.
Instead, level 1 (from zooming out of the level 0 shared member) defaults to the rollup associated with the member that the shared member points to?? Is there a way to make the zoom out of a shared member from level 0, zoom to the level 1 in the shared members hierarchy and not the associated member that the shared member point to?
I really hope that makes sense to you guru's :-)
Thanks
Dermott.

user1113036 wrote:
That's the way Essbase has worked from time immemorial. Annoying, isn't it?You think it's annoying in the UI? It is really annoying in the API.. A standard way to walk a tree structure is the 'preorder walk algorithm' which essentially walks down the children of the tree, the next sibling(s), then back to the parent, etc until eventually the original root node is encountered signaling that all nodes have been visited. With the behavior of Essbase described in this thread, a preorder walk actually goes into an endless loop when the 'parent' is the 'real' parent of a member and not the shared member 'parent'.
Tim Tow
Applied OLAP, Inc
Edited by: timtow on Aug 24, 2008 5:37 PM

Shared member equivalent to EssVGetMemberInfo?

in excel - is there a way to do=EssGetMemberInfo([sheet];"value";8;TRUE/FALSE;[cell]) for shared members as well?i need the parent of a bottom level shared member but until now i have no clue how. there is no problem with the members, but i just couldn't find anything (macros, VBA functions, whatsoever) that works for shared members as well.any idea?marco

user1113036 wrote:
That's the way Essbase has worked from time immemorial. Annoying, isn't it?You think it's annoying in the UI? It is really annoying in the API.. A standard way to walk a tree structure is the 'preorder walk algorithm' which essentially walks down the children of the tree, the next sibling(s), then back to the parent, etc until eventually the original root node is encountered signaling that all nodes have been visited. With the behavior of Essbase described in this thread, a preorder walk actually goes into an endless loop when the 'parent' is the 'real' parent of a member and not the shared member 'parent'.
Tim Tow
Applied OLAP, Inc
Edited by: timtow on Aug 24, 2008 5:37 PM

Issue with User Variable Due Shared Member Security Access

Hi All,
One of my client is using User variable in data form to define POV.
Now if user has access to 2 member in the Dimension, he should able to see 2 member when he try to assign the value to this "user variable"
but he can see some of the parent member name ,this parent name has only one child which is a shared member of the 2 base member for which he has access.
For Example:
Entity Dimension:
E1 (user has access)
E2
E3(user has access)
E4
Alt_Entity
Alt_Entity1E1 (sharedmember)
Alt_Entity2E2 (sharedmember)
Alt_Entity3E3 (sharedmember)
Alt_Entity4E4 (sharedmember)
User is able to see below members, when he try to assign value
E1 (user has access)
E3(user has access)
Alt_Entity1
Alt_Entity3
Now if I add another member under this parent, than user are unable to see this parent member.
For Example:
Entity Dimension:
E1 (user has access)
E2
E3(user has access)
E4
Alt_Entity
Alt_Entity1
E1 (sharedmember)
E2 (sharedmember)
Alt_Entity2E2 (sharedmember)
Alt_Entity3
E3 (sharedmember)
E2 (sharedmember)
Alt_Entity4E4 (sharedmember)
User is able to see below members, when he try to assign value
E1 (user has access)
E3(user has access)
Any idea?

Sorry, but actually its the parent that needs tagging with "Never Share", not the level 0 member, so Alt_Entity1 and Alt_Entity2 etc, see Essbase DBA guide
understanding Implied
Sharing
The shared member property defines a shared data relationship explicitly. Some
members are shared even if you do not explicitly set them as shared. These
members are said to be implied shared members.
If you do not want a member to be shared implicitly, mark the parent as Never Share so
that the data is duplicated, and is not shared. See Understanding Shared Members for an
explanation of how shared members work.
So in the example above
Entity Dimension:
E1 (user has access)
E2
E3(user has access)
E4
Alt_Entity
Alt_Entity1 - Set to "Never Share"E1 (sharedmember)
Alt_Entity2E2 (sharedmember)
Alt_Entity3 - Set to "Never Share"E3 (sharedmember)
Alt_Entity4E4 (sharedmember
Thanks
Anthony

Security Filter fails when level has only one member

Hi.
This is Essbase version 9.3. I have a forecast app\db to allow users enter\modify the forecast of the different products. The Product Dimension has the following hierarchy.
All Products
Planner 1
Supplier A
Product_A1
Product_A2Supplier B
Product_B1
Product is the lowest level, level 0, or Gen 4.
I need to allow the "Planner 1" to write only to his products, where the member is "My Scenario" from Scenario Dimension, and where the UDA's for the month is Forecast. The same planner can't write to the "All Products", "Planner" and "Supplier" levels.
I have created the following filter:
None: "All Products"
Read: @IDESCENDANTS("Planner 1")
Write: @REMOVE(@LIST(@DESCENDANTS("Planner 1")),@LIST(@LEVMBRS ("Planner 1", 1))), "My Scenario",@UDA("Time","FORECAST")
Basically, this is the portion most relevant of the filter: @REMOVE(@LIST(@DESCENDANTS("Planner 1")),@LIST(@LEVMBRS ("Planner 1", 1)))
where
@LIST(@DESCENDANTS("Planner 1") = List of descendants members from Planner 1, excluding Planner 1. = "FIRST LIST"
@LIST(@LEVMBRS ("Planner 1", 1)) = List of level 1 members from Product Dimension. = "SECOND LIST"
@REMOVE will remove values or members in the "SECOND LIST" from the "FIRST LIST".
This filter works perfectly but it has a little\big exception...
Based on the example, the filter works fine for Supllier A. Meaning that the user can modifiy the forecast for the products under Supplier A (Product_A1 and Product_A2), and the user can't modify the upper levels, "Supplier A", "Planner 1", "All Products". This is GOOD!
Now. For Supplier B, Essbase will allow write back to the Product_B1, OK. But will also allow write back to Supplier B, the upper level.
So. When the supplier has only one product, Essbase presents this exception that allows write to the upper level. This happens everywhere a supplier has only one product. When there are more than one product per supplier, the filter works as expected.
Is there a missing piece in my filter? Is there a different, better approach to accomplish this?
Thanks.

It's probably an implied share problem. That is, because Supplier B has only one child it is treated as a shared member. You can use the "never share" storage property setting to avoid that problem.

Giving filter to a Allias member only ,not to shared member with the same name

I have a situation that i have to give access to allias member ,with the same name there r a lot of shared member.
Please let me know ,if there is any syntex where i can give access to the member which is tagged as allias .

Access to member ?? Please be clear on it !!
Assuming that you are using Maxl scripts to create filter
create or replace filter 'App'.'db'.'Group Name ' read on '@IDESC("Dimensions") , @IDESC( ) ....';
Later use :
grant filter 'App'.'db'.'Group Name' TO 'Group Name in Shared services';
May be you can create a new Group for the shared members , or it really does not matter .
I am assuming that I got your question correct.

Selecting a shared structure parent member

Good day,
With a calcscript im trying to select the parent member of a shared structure using commands @SANCESTVAL or @SPARENTVAL, however it works correctly for the 1st shared structure and it dosent work for the 2nd shared structure i have in the OTL. Does somebody knows if this is an expected behavior? Or a workaround?
Kind Regards,
P.d I can´t move the shared structures order, since i also have that type of calculations for the 1st structure.
P.d.2. I have essbase ver 11.1.1.3
Edited by: user618861 on Aug 30, 2010 1:53 AM

Hi,
We found the solution, we where doing something wrong, i will explain so this helps to somebody else.
I have 1 dimension "Products" with 3 Childrens; "Total_Product", "Brand_Segment", "Total_SupplyPoint", where the store structure is "Total_Product" and the others are shared structures.
We were trying to select Level 1 members of the "Total_Supply Point" with the following Script.
FIX(&Load_Mth, &Load_Year,&Load_Scenario, "Working", @REMOVE(@RELATIVE("Total_SupplyPoint",0), @LIST("SRC_KK01", "SRC_PMB3", "SRC_SF02")), "NA_Customer","YTD_Input")
"CM_YearEndBonus" = ("CM_COGS_Allocation" / @SANCESTVAL("Products", -1, "CM_COGS_Allocation")) * @SANCESTVAL("Products", -1, "CM_YearEndBonus");
ENDFIX
The correct calculations is as follows, where the only change is for SANCESTVAL Instead of "Products" know we have "Total_SupplyPoint"
FIX(&Load_Mth, &Load_Year,&Load_Scenario, "Working", @REMOVE(@RELATIVE("Total_SupplyPoint",0), @LIST("SRC_KK01", "SRC_PMB3", "SRC_SF02")), "NA_Customer","YTD_Input")
"CM_YearEndBonus" = ("CM_COGS_Allocation" / @SANCESTVAL("Total_SupplyPoint", -1, "CM_COGS_Allocation")) * @SANCESTVAL("Total_SupplyPoint", -1, "CM_YearEndBonus");
ENDFIX
The literature saids,
@SANCESTVAL (rootMbr,genLevNum [, mbrName])
Where rootMbr: Defines a member that is used to search for the nearest occurrence of an ancestor of a shared member.
I hope is helpful for somebody else
Edited by: Pavel Moreno on Aug 30, 2010 9:10 AM
Edited by: Pavel Moreno on Aug 30, 2010 9:11 AM

How to determine if shared member is descendant

I have an account dimension that has several different alternate hierarchies. All of the leaf level accounts are in the Base Accounts hierarchy; these leaf members are then shared in the other hierarchies. What I would like to do is build a calculated measure that performs a particular formula if the current member is a descendant of a specific member, say X. I have tried to use IsAncestor and also the Count(Intersect(Descendants())) formula, but it apparently doesn't consider the shared members at the bottom as a descendant of X. I have also tried adding a UDA to the members in question and using the IsUDA function, but again, I can't use UDAs on the shared members. Note this is an ASO cube being built in EIS. Is there a way to determine whether a shared member is a descendant of a particular member in a hierarchy? Thanks, Matt

In general, shared members need careful handling in MDX. A couple of mechanical observations and a question. Yup, there's a paradox at hand. The query SELECT Filter ( Descendants ( [Diet] ), IsAncestor ( [Product].CurrentMember, [Diet] ) ) on axis (0) FROM [Sample.Basic] returns an empty set, while the following formula only returns 1 for those shared versions that are in fact under the share, so the [100-20] under [Colas] does not get a 1. Count ( Intersect ( { [Accounts].CurrentMember }, Descendants ( [[[Account Parent 1]]], [Accounts].Levels(0) ), ALL ) ) Somehow, IsAncestor() returns FALSE even for members obtained as descendants of the Ancestor, while intersecting that member with the set of Descendants returns identity. But it's a different member somehow, since Intersect ( { [Accounts].Levels(0) }, Descendants ( [[[Account Parent 1]]], [Accounts].Levels(0) ), ALL ) only returns 1 instance of each member, not 2. Intersect(x,y, ALL) should return duplicates found in x when they exist. It seems like you can use Count(Intersect(Descendants())) for all "shared" versions of the member, but not the first, "non-shared" use of the member. Meanwhile, it would be great to avoid the set construction/counting overhead. OK, enough of mechanics. What I'd like to inquire about is what you're trying to do. Are you trying to factor out logic into the shared parents, and then combine it based on what set of ancestors a member has? That would be clever, but maybe there's another approach. If you are trying to have different formulas for different shares, keep in mind that since a shared member is a shared instance of a member, it should have the same formula to calculate itself regardless of the parent it is under (since it is under all parents equally and simultaneously. A little more insight into your goals could give us a path to a solution.

HFM security filter ?

In HFM, I don't seem to have a way to achieve this:
One user has write access to Entity A + all products
The same user needs Read Only access to Entity B but a couple of the products only
Because the security classes attached to Entity and Product(Custom2 for us) dimensions are layed out flat on Shared Service. I can only assign one type of access to the same security class.
This is different in Essbase for example, I can create security filter and grante user access to different combination (intersection) of dimensions.
Is there such thing as security filter in HFM?
Thanks in advance!

I do plan to assign unique security classes to entities and products.
But how do we assign access to combos? In the Pivot table where you have all the security classes on the row, and all the users(groups) on the columns.
The goal is to prevent the product line leader user from reading other products in the entity that he's not responsible for.
For example, this user has Write access to E_Brazil, and all data loaded on C2 for Brazil. Then he needs to have Read access to E_China, but only C2_Golfball. We do not want him to see other products for China, however, he needs to load data to other products in Brazil. This is especially true with the Custom2 member [None] for all the data that do not require a product. Then what access shall we give to the security class C2_None ? It doesn't seem that we have a way to assign access to a combo, but just to each unique security classes ?

Issue in Implementing OR Logic in Security Filter for Essbase in OBIEE

I am implementing OBIEE using Essbase as the data source. The requirement is to implement OR logic in the security filter. And I got error message from the MDX query generated by OBIEE. Below is the details. Anyone knows how to solve this issue? Thank you very much.
1. The “Booking Location” dimension has three hierarchies (ragged hierarchies).
http://img.photobucket.com/albums/v216/stewart_life/1.png
2. I only want to take the first hierarchy, which is “Total booking”. Thus, I filter the Logical Table Source of “Booking Location” in the business model layer.
http://img.photobucket.com/albums/v216/stewart_life/2.png
3. The “Incorporation Country” dimension doesn’t have any multiple hierarchies.
http://img.photobucket.com/albums/v216/stewart_life/3.png
4. Thus, I don’t filter the Logical Table Source of “Incorporation Country” in the business model layer.
http://img.photobucket.com/albums/v216/stewart_life/4.png
5. I filter the permission of a user. This filter applied to the fact table (RISK) in the business model layer.
http://img.photobucket.com/albums/v216/stewart_life/5.png
6. Then the filter applied so that the particular user can only see the data where the Incorporation Country level is Singapore OR the Booking Country level is Singapore:
"Risk"."Incorporation Country"."Country" = 'SINGAPORE (INC)' OR "Risk"."Booking Location"."Booking Country" = 'SINGAPORE (CBE)'
http://img.photobucket.com/albums/v216/stewart_life/6.png
7. Here is the first report that is working fine if run by a user without any security filter.
http://img.photobucket.com/albums/v216/stewart_life/7.png
8. The result of that report when run by the user whose security filter above has been applied to.
http://img.photobucket.com/albums/v216/stewart_life/8.png
9. The MDX query generated from that report is shown below. Note that the error refers to the line 4, which is in bold below. Somehow, the query generated always include Incorporation Country and Booking Location in the “With” clause, since both of them are placed in the security filter.-----
Sending query to database named Risk-MI Essbase (id: <<399750>>):
With
set [Booking Location2|http://forums.oracle.com/forums/] as '{[Booking Location|http://forums.oracle.com/forums/].[Total booking|http://forums.oracle.com/forums/]}'
set [Booking Location4|http://forums.oracle.com/forums/] as 'Generate({[Booking Location2|http://forums.oracle.com/forums/]}, Descendants([Booking Location|http://forums.oracle.com/forums/].currentmember, [Booking Location|http://forums.oracle.com/forums/].Generations(4),SELF), ALL)'
*set [Incorporation Country4|http://forums.oracle.com/forums/] as ''*
set [Time3|http://forums.oracle.com/forums/] as 'Time.Generations(3).members'
set [Year2|http://forums.oracle.com/forums/] as 'Year.Generations(2).members'
member Measures.[MS1|http://forums.oracle.com/forums/] as 'Rank(Time.Generations(3).Dimension.CurrentMember, Time.Generations(3).Members)'
set [Axis1Set|http://forums.oracle.com/forums/] as 'crossjoin ({[Booking Location4|http://forums.oracle.com/forums/]},crossjoin ({[Incorporation Country4|http://forums.oracle.com/forums/]},crossjoin ({[Time3|http://forums.oracle.com/forums/]},{[Year2|http://forums.oracle.com/forums/]})))'
select
{Measures.[Netted EAD|http://forums.oracle.com/forums/],Measures.[Netted Nominal|http://forums.oracle.com/forums/],Measures.[Wt_LGD|http://forums.oracle.com/forums/],
MS1} on columns,
NON EMPTY filter({[Axis1Set|http://forums.oracle.com/forums/]}, [Incorporation Country|http://forums.oracle.com/forums/].currentmember IS [Incorporation Country|http://forums.oracle.com/forums/].[SINGAPORE (INC)|http://forums.oracle.com/forums/] OR [Booking Location|http://forums.oracle.com/forums/].currentmember IS [Booking Location|http://forums.oracle.com/forums/].[SINGAPORE (CBE)|http://forums.oracle.com/forums/]) properties ANCESTOR_NAMES, GEN_NUMBER on rows
from [http://RISK-P.RISK]
where ([CRG (ORG)|http://forums.oracle.com/forums/].[Good Book (ORG)|http://forums.oracle.com/forums/], Method.ADV)
+++stewart:370000:370021:----2009/02/17 13:56:06
Query Status: Query Failed: Essbase Error: Syntax error in input MDX query on line 4 at token '''

From what I have read on this forum, people have managed to get the DC In Board replaced for a little over US $100. This would be at an Apple authorized repair shop rather than by Apple itself. This is much less than the cost of a new MacBook. I don't know what might be available in your area, but it would be worth asking at a repair shop.
Good luck!

Essbase Security filter in OBIEE 11.1.1.6 request

Hello Experts
I have got a requirement whereby I need to apply Data Level Securityfor the Essbase sourced cube in OBIEE11g. But the issue is the dimension value where I need to apply security filter has 25K distinct values and is Unbalanced Hierarchy where the leaf members is distributed across differnet level . Actually it is ragged heirarchy in Cube which when imported in OBIEE becomes a Level Based Heirarchy where the leafs becomes shared across differnet level. Now the general OBIEE rule says - Create separate application groups for each lowest level dimension vales and apply security filters for each values respectively for each group and assign users in those groups.
But the issue is :
1. Here there are 25 K members in the dimesional value where I need to apply Data Level Security . So it is not possible to create 25K distinct group.
2. The dimension which needs to be used for Data level security has Ragged Hierarchy where the lowest leaf (which would eb used in security filter) is shared across differnet levels.So there is no single column that I can select in RPD to apply security filter.
Pls. suggest a solution.
Is there a way that I can source the Essbase Filters to work as Data Level security in OBIEE 11.1.1.6

You can upgrade to 11.1.1.7 and use Weblogic to assign security, then EAS to apply filters, and then OBIEE Enterprise Mgr to apply the application roles (i.e. via Essbase Filters). The gotcha is that you need to install OBIEE 11.1.1.7 and include the Essbase component as part of the install.
If you need more info let me know.
Daniel Poon

Financial Reporting prompt-Show only members as defined by security filter?

Hello all,
Maybe another simple question but i have been unable to perform this task so far-
We have created a security filter against the Company dimension in essbase, assigned it to a user, and that works ok.
We have a report that prompts the user to choose members from for the Company Dimension.
We would like this prompt to present the users only the members that are accessible per the security filter (i.e. al the descendants of the 'Northwest' member) for that particular user, since by default it presents all members of the Dim.
Is this possible to do?
Thank you very much for your help
Hector

I think what you want are METAREAD filters.Not that you're on Planning, but Planning goes to Essbase (eventually) and when it does so, it inexplicably uses READ instead of METAREAD -- it's the same issue.
Here's an overview of it: http://camerons-blog-for-essbase-hackers.blogspot.com/2009/07/fixing-plannings-filters.html
It should be as simple as clicking on the filter type dropdown in EAS to test if it works.
Regards,
Cameron Lackpour

Security Filter Problem

Hi ,
I am facing one problem related to security Filter for one user. We are on the Hyperion Version 11.1.2.1 Fusion Edition.
We had one user created in Shared Services with ID : TESTUSER and added in the group. Initially access for this user was working fine. Later on we deleted this user from shared services as we no longer needed this.
As per new requirement we are supposed to create a same user with same user name so we created again new user 'TESTUSER' and added into the same user group then we refreshed security from Planning Application through " Administration -> Application -> Refresh Database->Security Filters ". Refreshing security Filters created filter for above user and we checked this from EAS consol.
However when we log in to the Application through Smart View we are getting the below Error.
Cannot Open cube View.Essbase Error ( 1054060 ):Essbase Failed to select
Application APP1, because TESTUSER@Native Directory is not\
completely Provisioned by Planning.
Could you please advice how could we resolve this issue.

Check whether the user is only an Essbase user. (I don't think that is the case, but in case)
Try changing the access type using
alter user username add application_access_type Planning; (don't know whether this works in latest release)
Try the stepsRAvery and _RahulS_mentioned.
Tried that in 11.1.2.2 access_type Planning is defered.
Regards
Celvin
http://www.orahyplabs.com

Essbase Security Filter issue.

Hi,
Its regarding the security filter issue.
The major problem is whosoever user is provisioned under that security filter, if the user is trying to connect to Application using Excel Addin / Smartview, it crashes the essbase server [Network Error [10061], timed out error)]
When we figured out because of this filter essbase server is crashing, we tried to edit the filter. sometimes if we click on edit, it crashes the server or sometimes we can see some junk characters in the filter.
We have applied the security on Entities dimension and problematic filter is ASP.
Now the hirerachy is like this.
Entities dimesnsion and then ASP member and under ASP we have our several members.
Filter is like this:
Write : @Idescendants("ASP")
It was working fine for almost 15 days.
Now if i edit the filter, i can see like this:
Write : @Idescendants("ASP")
Metaread:@Idescendants("*&^%?)
Junk characters are coming in and no idea from where they are coming.
I can't delete the filter also, again it crashes the essbase server.
As a workaround i have created a temp filter and dome the assignation for this group, according to that.
Everything is working fine.
I just wanted to know, has anybody faced such kind of problem earlier.
What cud be the root cause for this.
How could I delete the filter.
I have also get messages like security file is corrupted (we have restored it from old backup) but really worried about security file as we are moving the whole thing to production server this weekend.
Please advise me on this, Please help me. Any help would be highly appreciated.
I am really in trouble.
Thanks,
Pankaj Mehta.

Try to edit the filter from MaxL command line using
alter filter sample.basic.filt7 add write on '@IDescendants("ASP")';
here sample=application
basic=database
filt7=filtername
have good luck

Formulas & Shared Member

My formula is a % of total. (What % does the child represent to the immediate parent?) Formula tested: Member%@parentval(dimension,Member)If the numerator is a shared member, it automatically pulls the parent of the stored member. Basically the level 0 data is being consolidated in two different ways. I need a % of total formula that will divide by the immediate parent versus the stored parent. @parentval and @sparentval will not work. My problems would be solved if there was a function called @ISShared. Any thoughts?

I'm not sure what you mean by the "immediate parent" - but I assume it means the parent of the shared member vs the parent of the Real member. If this is the case, then the following:@SPARENTVAL() % @PARENTVAL()should work. According to the documentation, the @SPARENTVAL function looks to the parent of the shared member rather than to the parent of the real member.However, you asked about an ISSHARED function - there isn't one, but I assume what you need this for is to calculate the ratio differently IF there is a shared member. Is this the case?Regards,Jade---------------------------------Jade ColeSenior Business Intelligence ConsultantClarity [email protected]

Security/Filter on a Shared Member Parent

Similar Messages

Maybe you are looking for