December 1, 2011 at 4:55 am
I'm new to security in SSAS....
We have a set of users that need to access a cube via excel, but we need to hide some of the dimensions / measures from them. I have created a role for these users and this role denies them access to the data from the dimensions, but I can't see an option to stop them seeing the dimension all together? I know you can hide the dimension in the BIDS so no one can see it, but there are another set of users who need to see the dimensions.
Is it even possible to hide the definition of the dimensions / measures from certain users?
(I've read that perspectives can be used to show only certain dimensions, but this is only available in Enterprise)
Cheers
September 7, 2015 at 5:47 am
I am facing the same implementation challenge. Did you get any solutions for this.
September 7, 2015 at 7:27 am
anupamk (9/7/2015)
I am facing the same implementation challenge. Did you get any solutions for this.
Use Perspectives.
Need an answer? No, you need a question
My blog at https://sqlkover.com.
MCSE Business Intelligence - Microsoft Data Platform MVP
September 7, 2015 at 8:06 am
Hi Koen, i have seen people discussing to get this done using perspective. I have SQL Server 2008 R2. Could you tell how i can actually implement this using Perspective?
I have to make a Dimension and few measures visible to specific users only.
- Thanks
September 7, 2015 at 2:38 pm
In the SSAS cube, there's a specific tab for perspectives.
You create a new one, and you select only the dimensions and measures you want to users to be able to see.
Mind you that this is an Enterprise edition feature.
Need an answer? No, you need a question
My blog at https://sqlkover.com.
MCSE Business Intelligence - Microsoft Data Platform MVP
September 7, 2015 at 6:13 pm
Perspectives is not a security measure. If the dimensions are that secret, you should consider creating a separate cube, one with the extra dimensions, and one without. The permission can be set at the cube level. Without knowing more, I'm not sure this is the best solution in your case, but it's one that should be considered.
September 8, 2015 at 12:07 am
@Koen- I checked the perspective properties. I have created one for Cube. But could you tell me how I can use that in Role to make dimension/measure to specific user.
@RonKyle- I don't have feasibility to create another Cube. I have read in many places that "Perspectives is not a security measure". But is there any possibilities that I can fulfil my requirement using this.
- Thanks
September 8, 2015 at 1:16 am
anupamk (9/8/2015)
@Koen- I checked the perspective properties. I have created one for Cube. But could you tell me how I can use that in Role to make dimension/measure to specific user.
You can't. Perspectives inherit permissions from the parent cube.
(that's what they mean with "it's not a security measure")
Need an answer? No, you need a question
My blog at https://sqlkover.com.
MCSE Business Intelligence - Microsoft Data Platform MVP
September 8, 2015 at 6:21 am
@Koen- Ok. I checked in the Role as well nothing found for Perspective. In that case in your first answer you have mention "use Perspective", could you explain what you had in your mind.
- Thanks
September 8, 2015 at 7:11 am
anupamk (9/8/2015)
@Koen- Ok. I checked in the Role as well nothing found for Perspective. In that case in your first answer you have mention "use Perspective", could you explain what you had in your mind.- Thanks
The original question:
Is it even possible to hide the definition of the dimensions / measures from certain users?
Your question:
I am facing the same implementation challenge. Did you get any solutions for this.
Perspectives hide the definition of dimensions and measures for users.
Need an answer? No, you need a question
My blog at https://sqlkover.com.
MCSE Business Intelligence - Microsoft Data Platform MVP
September 8, 2015 at 7:52 am
You need to understand what perspectives are for.
Perspectives are a usability feature: you can hide dimensions and measures in a very complex cube so it's easier for them to browse the cube in Excel for example. It is not a security measure: when you want to hide objects from a set of users and not for another set, you're talking security and this should be resolved in roles.
Perspectives inherit the user security from their parent cube, meaning it's an all or nothing approach. (otherwise it would have been a security feature)
Denying access to a dimension object itself is not directly possible it seems.
(it's attributes and data on the other hand is fairly easy to do)
As mentioned before, the easiest option is to create separate cubes if you truly want to hide a dimension for a specific set of users.
Keep in mind that denying access to a dimension doesn't really make sense if you know that for in order to calculate any measure (without the dimension being selected), the cube still needs access to the default member of the dimension attributes. (By default this is the ALL member).
Need an answer? No, you need a question
My blog at https://sqlkover.com.
MCSE Business Intelligence - Microsoft Data Platform MVP
September 8, 2015 at 8:57 am
Hi Koen,
Thank you for the reply. Let's say that i create a perspective where i have selected few of the measures. So will the users will be able to browse only those selected objects? If a User has Read enabled for that Cube than whether he/she will be seeing only those Measures?
Thanks,
Anupam
September 9, 2015 at 12:54 am
anupamk (9/8/2015)
Hi Koen,Thank you for the reply. Let's say that i create a perspective where i have selected few of the measures. So will the users will be able to browse only those selected objects? If a User has Read enabled for that Cube than whether he/she will be seeing only those Measures?
Thanks,
Anupam
Yes, they will see only those measures.
But, if they are well versed in MDX, they can still access the other measures (if they know their names), by writing a script.
Need an answer? No, you need a question
My blog at https://sqlkover.com.
MCSE Business Intelligence - Microsoft Data Platform MVP
Viewing 13 posts - 1 through 12 (of 12 total)
You must be logged in to reply to this topic. Login to reply