Security in Tabular (SSAS 2012)

hi all, 
I would like to omit entire tables (their measures, calculations, etc) for users belonging to a specific AD group (Active Directory) assigned to a Role.  Is this something that can be accomplished through a relatively simple Row Filters/DAX Filter condition?
In actuality, I would like to even hide these tables entirely, if feasible, for these roles.
thx a  big bunch for any thoughts.
Cos

Cos, 
There is not way to secure individual measures, you are able to see the all if you have read permissions. DAX calculations are based on the row that a user is able to see so with the below method you can limit the data returned to restrict certain measures.
To deny access to very row in a table you can set the filter condition to FALSE(), and you can set a table's Hide From Client Tools property to True. 
Just a note the security in Tabular is not as robust as Multidimensional. 
Hope this helps.
Reeves
Denver, CO

Similar Messages

  • Dynamic security using Security table in SSAS Tabular model

    Hi, 
    Platform : SSAS Tabular model (VS 2010)
    I need to apply Dynamic security using Security table(manually created) in Tabular model, Need to apply filter for 2 tables. I am able to
    create roles in Tabular model using USERNAME() and LOOKUP() function it worked fine. But the problem is when i am trying to give full access for a particular column and limit the access in other column, it is not working properly.
    Please find below table and guide me where i am falling short. In the Security table wherever you find ALL it means full access.
    Security table
    Login Name
    Dim_Country
    Dim_Customer
    DOMAIN\User1
    ALL
    2
    User1 should see all countries but Only 2,4 Customers
    DOMAIN\User1
    ALL
    4
    DOMAIN\User2
    2
    ALL
    User2 should see all customers but Only 2,3 countries
    DOMAIN\User2
    3
    ALL
    DOMAIN\User3
    ALL
    ALL
    User3 should see all Customers and Countries
    DOMAIN\User4
    1
    3
    User4 should see 1 Country and 3 Customer
    ALL - means NO restriction
    Numeric values indicate the Dimension IDs
    Do let me know if further explanations required.
    Thanks,
    Sundar

    Hi Sundar,
    According to your description, you want to implement dynamic security using Security table in SQL Server Analysis Services Tabular model, right?
    It is very common to have data security implementation in BI projects either at databases or Cubes and sometimes this security implementation and maintenance goes out of control due to the dynamic flow of business information. Here are some links which describe
    dynamic security implementation at SSAS tabular model using an external security table, please see:
    http://bipassion.wordpress.com/2012/10/01/ssas-tabular-dynamic-security/
    http://www.bidn.com/blogs/ChrisSchmidt/ssas/4332/dynamic-security-in-tabular
    Regards,
    Charlie Liao
    TechNet Community Support

  • SSAS 2012 Tabular. Analysis Services Query Log not working

    Hello.
    It is possible to configure Analysis Services Query Log on SSAS 2012 Tabular (11.0.3321) server? Or this feature works only with Multidimensional server mode?
    It is not a problem for me to configure Query Log on Multidimensional server. But when I'm trying to do this in Tabular server result is always the same: table S_OlapQueryLog created but no data there.
    This problem exist in our production server. And is fully reproduced in test environment. This problem was reproduced with SQL 2012 RTM, CU4, SP1 and SP1 CU1.
    I tryed to configure Analysis Services Query Log by using SQL account. Later by using windows authentification. Accounts was db owners. Later I have used accounts with sysadmin rights. Results was the same.
    In msmdsrv.log i can find only related events like this:
    (12/7/2012 9:22:59 PM) Message: The query log was started. (Source:
    \\?\P:\Olap\Log\msmdsrv.log, Type: 1, Category: 289, Event ID: 0x41210003)
    (12/7/2012 9:25:03 PM) Message: The query log was stopped. (Source:
    \\?\P:\Olap\Log\msmdsrv.log, Type: 1, Category: 289, Event ID: 0x41210004)
    I'm stuck completely with this functionality. So if someone was much luckier than I please write to me.
    Regards
    Audrius

    I agree with Gerhard's comments, but there are a couple of additional points
    - I am not 100 percent sure if queries that are answered by the SE cache are recorded in the query log
    Queries answered by the SE cache are not definitely not recorded in the QueryLog. So depending on the types of queries and the design of your cube you could possible miss a large proportion of the actual end user queries.
    The QueryLog records the QuerySubcube events and there are zero to many of these generated for a given end user query (zero if the query can be answered from cache). The optimizer may also choose to pre-fetch a wider range of data or to break a single range
    into a few smaller requests so it is not a true indication of the actual query that the end user generated.
    Doing a trace is the only way to catch the actual queries submitted by end users.
    http://darren.gosbell.com - please mark correct answers

  • Converting a SSAS 2008 R2 database into a SSAS 2012 Tabular database

    Hi,
    I'd like to know if it is possible to convert or migrate in whatever manner a SSAS 2008 R2 database (multidimensional) into a SSAS 2012 Tabular database.
    Many thanks

    Unfortunately there is no way to convert or migrate a multidimensional cube to a tabular model.
    This MSDN article says ...
    Because tabular is the newer solution, you might think that migrating an existing multidimensional solution to a tabular format is
    the correct course of action, but this is usually not the case. Tabular does not supersede multidimensional, and the two formats are not interchangeable.
    If you need to migrate a cube to tabular (maybe for performance reasons), unfortunately you need to build it from scratch.  I believe the reason for this is that there are concepts that do not translate across the technologies.  There are no good
    3rd party tools that I'm aware of that even attempt to do this.
    Christian Wade
    http://christianwade.wordpress.com/
    Please mark correct responses as answers!

  • SSAS 2012 Tabular Error: The operation was cancelled because of locking conflicts

    I have a 800 mb SSAS database that I refresh(Process current day partition) every 30 minutes. As soon as the processing starts all my users get error The operation was cancelled because of locking conflicts. I ran the deadlocks trace as described in http://blogs.msdn.com/b/sql_pfe_blog/archive/2009/08/27/deadlock-troubleshooting-in-sql-server-analysis-services-ssas.aspx
    but all I see is the processing start and all the users getting the error ("The operation was cancelled because of locking conflicts") 22 mil sec after the processing starts.
    I also ran "select * from $system.discover_locks" but I only see lock types 2,4 and 8. None of which seem to be exclusive
    This is SSAS 2012 with sp 1
    Database Architect

    Hi Derek,
    According to your description, you get the dead lock error when processing partition. Right?
    In Analysis Services, this error occurs when lock manager detects a dead lock. Lock type 2,4 and 8 can also have two transactions waiting each other and cause deadlock. In this scenario, please check the Dead Lock Graph in SQL Profiler
    and find the related processes. Check what the processes work for to see if you need to do parallel processing or process other objects before partition processing.
    Best Regards, 
    Simon Hou
    TechNet Community Support

  • SSAS 2012 , Role- Limit of users

    Hi Experts , 
    I am working on SSAS 2012 Cube .
    I am implementing Security on my cube for which I have created 2 Roles.
    Question: I need to know how many users can be added in one Role (Member Ship Tab)? What is the maximum limit ??

    Hi Rihan,
    According to your description, you want to know the maximum number of users can be add into a role, right?
    Here is a document that the list the maximum sizes and numbers of various objects defined in Analysis Services components under different server deployment modes.
    http://technet.microsoft.com/en-us/library/ms365363(v=sql.110).aspx
    However, the maximum number of users can be add into a role is not specify on that document. As per my understanding, we can add any numbers of users to the role as we want. In your scenario, how many users do you need to add into this role?
    If you really need to know the maximum number, you can open a support case with Microsoft. Visit this link to see the various support options that are available to better meet your needs:
    http://support.microsoft.com/default.aspx?id=fh;en-us;offerprophone
    Regards,
    Charlie Liao
    TechNet Community Support

  • SSAS 2012 (SP2) - Connecting to a Named Instance in a Failover Cluster

    I posted this question some months ago and never got a resolution...still having the same problem. (http://social.msdn.microsoft.com/Forums/sqlserver/en-US/4178ba62-87e2-4672-a4ef-acd970ac1011/ssas-2012-sp1-connecting-to-a-named-instance-in-a-failover-cluster?forum=sqlanalysisservices)
    I have a 3 node failover cluster installation (active-passive-passive) configured as follows:
    Node1: DB Engine 1 (named instance DB01)
    Node2: DB Engine 2 (named instance DB02)
    Node3: Analysis Services (named instance DBAS)
    Obviously, the node indicated is merely the default active node for each service, with each service able to fail from node to node as required.
    Strangely, when I attempt to connect to the SSAS node using the cluster netbios "alias" (dunno, what else it would be called, so I apologize if I am mixing terminology or somesuch), I am only able to do so by specifying the the alias _without_ the
    required named instance. If I issue a connection request using an external program or even SSMS using Node3\DBAS or Node3.domain\DBAS, it appears that the SQL Server Browser is offering up a bogus TCP port for the named instance (in my case TCP/58554), when
    in reality, the SSAS service is running on TCP/2383 (confirmed with netstat) -- which if I understand correctly after much, much reading on the subject is the only port that can be used in a failover cluster. In any case, I'm puzzled beyond words. As I think
    through it, I believe I've seen this issue in the past, but never worried about it since it wasn't necessary to specify the named instance when I had SSAS requirements... It's only a showstopper now because I'm finalizing my implementation of SCVMM/SCOM 2012
    R2, and for some strange reason the PRO configuration in VMM gets all butthurt if you don't offer up a named instance...
    Thank you much for reading. I appreciate any help to get this resolved.
    POSSIBLY NOT RELEVANT...?
    I've properly configured the SPNs for the SSAS service (MSOLAPSvc.3) and the SQL Browser (MSOLAPDisco.3), with the former mapped to the SSAS service account and the latter to the cluster "alias" (since it runs as "NT AUTHORITY\LOCALSERVICE"
    as is customary) and have permitted delegation on the service and machine accounts as required. So, I'm not getting any kerberos issues with the service...any more, that is... ;) I'm not sure that's important, but I wanted to be forthcoming with details to
    help solve the issue.

    When connecting to SSAS in a cluster, you do not specify an instance name.  In your case, you would use the name of the SSAS IP address to connect.
    See:
    http://msdn.microsoft.com/en-us/library/dn141153.aspx
    For servers deployed in a failover cluster, connect using the network name of the SSAS cluster. This name is specified during SQL Server setup, as
    SQL Server Network Name. Note that if you installed SSAS as a named instance onto a Windows Server Failover Cluster (WSFC), you never add the instance name on the connection. This practice is unique to SSAS; in contrast, a named
    instance of a clustered relational database engine does include the instance name. For example, if you installed both SSAS and the database engine as named instance (Contoso-Accounting) with a SQL Server Network Name of SQL-CLU, you would connect to SSAS using
    "SQL-CLU" and to the database engine as "SQL-CLU\Contoso-Accounting". See
    How to Cluster SQL Server Analysis Services for more information and examples.

  • SSIS Connection Manager: MSOLAP100 where is the one for SSAS 2012 ?

    I have an SSIS project under SSDT, that should process a SSAS 2012 Cube, when I setup the connection, the SSIS Connection Manager gives me only MSOLAP100 as a possible connection manager type. From my understanding this is the one for SQL 2008 R2. Where
    is the one for SSAS 2012 and how can I enable it ?
    I feel this is a bug in SSDT:
    I used another UI dialog and could create a new connection like this:
    Still it says ConnectionManagerType MSOLAP100, however in the connection string I now have Provider=MSOLAP.5, this seems to be another SSDT bug.

    If this issue can be reproduced in multiple machines, then you can you can submit a feedback at
    http://connect.microsoft.com/SQLServer/Feedback and hope it is released in the next release of service pack or product.

  • US Social Security withholding rate for 2012

    Hi Guys,
    The US Social Security withholding rate for 2012 will change to 6.2% (from 4.2%) for the employee withholding.  Our Business would be running the first payroll for 2012 on 12/22/11.  The social security withholding change needs to be in the system for this payroll run.  Do you know if this change is delivered via a TUB or HRSP and where exactly it has been made available? 
    Thank you,
    Subbaiah

    Hi,
       The changes have been already released, it is within TUB 45 in BSI
    Federal change:
    Increases the maximum wage base FROM $106,800 TO $110,100.
    Increases the tax rate FROM 4.2% TO 6.2%.
    We have already applied and tested it, you should have them applied before the first payroll of 2012
    Hope that helps,

  • SSAS 2012 multi-instance installation issue

    Hello,
    Just wanted to share an issue and the resolution. Any feedback will be appreciated.
    Symptoms
    After installing the second named instance of SSAS 2012 on the same machine the first instance stops working.
    Cause
    The problem is that the second SSAS instance installed on the same machine doesn’t create its own INI file, but overwrites the original one, created by the first instance. The second instance’s
    service is configured to use the overwritten INI. Note that the overwritten INI is still located in its original folder, ex. C:\Program Files\Microsoft SQL Server\MSAS11.SSAS01\OLAP\Config\msmdsrv.ini.
    As a result, the second instance’s service works well, but the first one will fail to start once it’s shut down for the first time.
    Resolution
    For the sake of simplicity we will use names SSAS01 and SSAS02 for the first and the second named SSAS instances installed on the same machine called SERVER01. The default instance root directory
    will be C:\Program Files\Microsoft SQL Server.
    1. Install both named instances normally, using same instance root directory, but separate folders for Data, Log. etc.
    2. Browse to the first instance “Config” folder C:\Program Files\Microsoft SQL Server\MSAS11.SSAS01\OLAP\Config. Make sure that the file msmdsrv.ini exists and folder locations within it
    point to SSAS02.
    3. Browse to the second instance folder C:\Program Files\Microsoft SQL Server\MSAS11.SSAS02\OLAP. Make sure that the “Config” subfolder does not exist.
    4. Create “Config” subfolder under C:\Program Files\Microsoft SQL Server\MSAS11.SSAS02\OLAP
    5. Change folder permissions:
    In C:\Program Files\Microsoft SQL Server\MSAS11.SSAS01\OLAP\Config
    Remove SQLServerMSASUser$SERVER01$SSAS02 local group
    Add SQLServerMSASUser$SERVER01$SSAS01 local group with Full permissions
    In C:\Program Files\Microsoft SQL Server\MSAS11.SSAS02\OLAP\Config
    Add SQLServerMSASUser$SERVER01$SSAS02 local group with Full permissions
    6. Copy INI file:
    C:\Program Files\Microsoft SQL Server\MSAS11.SSAS01\OLAP\Config\msmdsrv.ini
    To:
    C:\Program Files\Microsoft SQL Server\MSAS11.SSAS02\OLAP\Config\
    7. Edit the original INI file: C:\Program Files\Microsoft SQL Server\MSAS11.SSAS01\OLAP\Config\msmdsrv.ini.
    Replace all “SSAS02” appearances with “SSAS01”.
    8. Edit Registry:
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MSOLAP$UATSSAS02]
    Change ImagePath value to:
    "C:\Program Files\Microsoft SQL Server\MSAS11.UATSSAS02\OLAP\bin\msmdsrv.exe" -s "C:\Program Files\Microsoft SQL Server\MSAS11.SSAS02\OLAP\Config"
    9. Start the services for both instances.

    Hi Grab,
    Thank you for your sharing such useful information. It would be benefical to othere ofurms members who encounter the similar issue.
    Since this is not a question thread, I changed it form Question type to Discusstion type.
    Regards,
    Charlie Liao
    TechNet Community Support

  • TNS Listener Poison attack : Oracle Security Alert for CVE-2012-1675

    Hi,
    I'm looking to implement the following oracle document about COST but not sure what we need to do for Standby Environment ,
    Can you guys please advise.
    Oracle Using Class of Secure Transport (COST) to Restrict Instance Registration [ID 1453883.1]
    Oracle Security Alert for CVE-2012-1675
    Thanks

    user097815 wrote:
    with regrads to the below thread which mostly talks about Oracle Security Alert for CVE-2012-1675 "TNS Listener Poison Attack"....i just wanted to find out if this effect DB that are externally or internally....meaning 95% of our DB are in network(internally) behind our firewall....and rest of the 5% are outside our firewall facing the world wide web....so does this apply to both of just one ?The attack is on the Listener itself - so if you want to prevent this attack, you need to secure that Listener, irrespective of its location.
    IMO, mandatory if you expose your Listener to an unsecured or public network (e.g. internet).
    As for Listeners running on your internal network - if this attack is used, securing your Listeners mean very little IMO. Because your internal network already needs to be compromised in order for the attack to occur. Which means you have far more serious problems then someone attacking your Listeners.

  • Edition Required for SSAS 2012 Multidim Partitoning Feature

    I want to know what the edition requirement is for the SSAS 2012 Multidim Partitioning feature.  In 2008 I recall that enterprise edition was required, but I cannot tell what the requirement is for 2012.  Thanks.
    Mark

    Actually, the BI edition also supports SSAS partitions
    http://msdn.microsoft.com/en-us/library/cc645993.aspx#SSAS. BI edition doesn't support partitioning in the DB Engine though so each SSAS partition would likely most efficiently be sourced from a separate DB Engine table rather than being aligned to the
    partitioning function used to partition a single fact table.
    HTH, Martin
    <a href="http://martinsbiblog.spaces.live.com" target="_blank">http://martinmason.wordpress.com</a>

  • Error during the attach of a Tabular model - SSAS 2012

    Hi,
    I've changed the DataDir for a SSAS Tabular instance by specifying another drive letter and a path like "E:\Microsoft SQL Server\MSAS11.SQLSERVER2012\OLAP\Data".
    After the restarting of the SSAS service I'm trying to attach the tabular model but when I select a folder I've an error about the specified folder is not valid because it doesn't correspond to the naming convention.
    How can I solve this issue, thanks?

    Hi pscorca,
    After you rename the "DataDir" path for SSAS Tabular instance, please copy Tabular database files to the new location(E:\Microsoft SQL Server\MSAS11.SQLSERVER2012\OLAP\Data). Then, please follow the steps below:
    Right-click on the Tabular model instance-> Properties, switch to "General" page.
    Select "Show Advanced(All) Properties" option, and then set the following value for "AllowedBrowsingFolders" property.
    C:\Program Files\Microsoft SQL Server\MSAS11.TABULAR2\OLAP\Backup\|C:\Program Files\Microsoft SQL Server\MSAS11.TABULAR2\OLAP\Log\|C:\Program Files\Microsoft SQL Server\MSAS11.TABULAR2\OLAP\Data\|E:\Microsoft SQL Server\MSAS11.SQLSERVER2012\OLAP\Data
    Restart SSAS Tabular instance.
    When you attach a Tabular database, please select the corresponding database which under "E:\Microsoft SQL Server\MSAS11.SQLSERVER2012\OLAP\Data" path.
    Please let me know if you have any questions.
    Regards,
    Elvis Long
    TechNet Community Support

  • Are SSAS 2012 BI Tabular Semantic Models supported as data source for Cognos 10?

    Hello,
    As the title states, I need to have an official answer and if possible a URL  stating the same. We're implementing  a Tabular Semantic Model with SQL Server 2012 SP1 and SharePoint 2013 SP1 and since Power View doesn't support iOS (primarily managers
    consuming reports & dashboards with their iPads) at least not on-premises just yet, I understand that's fully supported in Office 365 with Power BI, unless this has changed lately, we're forced to find out alternative solutions and since
    our customer has Cognos 10 already deployed, it's critical to know whether it provides some level of support or if there's any  workaround to support iOS with the current deployment perhaps?
    Thanks in advance for the help.
    PS: I'm posting this question on Cognos' forums as well.
    Marcelo Estrada MCP-MCTS-MCITP-MCSA-MCSE

    Thanks Simon,
    Unfortunately having access to SSRS alone isn't good enough, our customer absolutely loves Power View but the fact that isn't supported for iOS is a huge drawback. I've seen this requirement in Microsoft Connect several times drawing a lot of attention,
    and now it appears closed, any chance you know what's the current status?
    https://connect.microsoft.com/SQLServer/feedback/details/738938/power-view-without-silverlight
    Furthermore, there's this article as well that points out Power View in HTML5, just wondering whether it might be available for on-premises, perhaps through an update any time soon? Please this is critical.
    https://support.office.microsoft.com/en-gb/article/Power-View-in-HTML5-c71dc902-2a2c-482e-b5a5-e9c884650a26?CorrelationId=c6913a00-3470-4eee-bc9d-a5b094e8afcf&ui=en-US&rs=en-GB&ad=GB
    Thanks again, looking forward to hearing from you soon,
    Marcelo Estrada MCP-MCTS-MCITP-MCSA-MCSE

  • SSAS 2012 Tabular Processing in 32 bit mode

    Hi All, My SSAS tabular connects to Teradata using the OLEDB providers from Teradata. Unfortunately Teradata only provides 32 bit OLEDB provider and not the 64 bit. So in SSDT I can connect to the Teradata source, select the tables but while importing it
    fails with the error TDOLEDB is not registered. I fear this is because SSAS is trying to find the 64 bit driver as my server is 64 bit. Any workarounds on how to proceed? SSIS has an option of specifying 32 bit runtime, is there something similar for SSAS
    Processing? Teradata is not going to provide the 64 bit driver soon, does this mean I should switch to ODBC? Any help appreciated.
    Thanks, Ashish Singh

    Have a look at this... This might help you...
    http://social.msdn.microsoft.com/Forums/sqlserver/en-US/1b10a45c-47cf-4d91-a8a4-d4cbeacec304/error-deploying-a-cube-using-an-oracle-client?forum=sqlanalysisservices
    Please mark as answer, if this has helped you solve the issue.
    Good Luck :) .. visit www.sqlsaga.com for more t-sql code snippetts and BI related how to articles.

Maybe you are looking for