Security on Element Attribute

[winsonlee]

I have a dimension name call Employee with attribute name Description. I am trying to hide the Description from certain user so that they do not have the ability to view the alias. I try setting security for }ElementAttributes_Employee dimension which i have Description element set as None.

although the user do not have permission to }ElementAttribute_Employee cube but when the user open "Employee" dimension , he is still able to see the "Description" as an alias.

any work around for this ?

[lotsaram]

I have a dimension name call Employee with attribute name Description. I am trying to hide the Description from certain user so that they do not have the ability to view the alias. I try setting security for }ElementAttributes_Employee dimension which i have Description element set as None.

although the user do not have permission to }ElementAttribute_Employee cube but when the user open "Employee" dimension , he is still able to see the "Description" as an alias.

any work around for this ?

No. You can't use security to hide attributes from users, they are always there, if a user can see an element they can see the attribute values.

Your only alternatives are from a design perspective "segment your application" to either use another copy of the dimension and restrict access to it and have the description alias there or to store the description in a normal 2D cube and restrict access to that.

[winsonlee]

hi lotsaram,

thanks for the idea. seems like it is a good work around way.
I just wanted to clarify the two ideas that you mention.

Your only alternatives are from a design perspective "segment your application" to either use another copy of the dimension and restrict access to it and have the description alias there or

for the above method, did you mean that my cube will have Employee1 dimension and Employee2 dimension. Employee1 dimension will have all the element without description, Employee2 will have all the element with description and set security on the element user can see in Employee2 ?

to store the description in a normal 2D cube and restrict access to that.

for the above ideas, once the 2D cube is created, do i write rules on the }ElementAttribute_Employee cube to read the description from the 2D cube that has been created ? Will try this when i get to work first thing in the morning. Kinda able to picture how it works. but will put it in code to see if i am able to get it working.

[qml]

You can make your attribute/alias values rule-calculated. By using the function TM1User() in the rule you can personalise the attribute values and even make them totally different for each user. You would have to store the actual attribute values in another cube (like lotsa suggested) and just pull them from there using that rule and a simple condition (e.g. if user belongs to a certain group then get the attribute value, if not, leave empty).

The drawbak of this would be the need to recalculate the attribute values every time they're referenced, because there would be no caching of these attribute values on the server. Depending on your model this might be too much of a performance hit, but it might definitely be worth a try, as I have done similar things in small models with good results.

[winsonlee]

Not sure if this make sense.

I have created another cube name 'EmployeeAttribute' having Employee and EmployeeDescription dimension.

In my }ElementAttribute_Employee I have the following rule.

Code: Select all

['Description'] = S:DB('EmployeeAttribute',!Employee,!}ElementAttributes_Employee); 

I have already remove the user access from the EmployeeAttribute cube and also to the 'description' element in the EmployeeDescription dimension.

After the user login, although he cant see EmployeeAttribute cube, but when he goes in to }ElementAttribute_Employee cube, he is still able to see the description reference by the rule to EmployeeAttribute cube.

I would thought usually permission would have restrict the user from seeing the data in EmployeeAttribute cube although there are rule reference to it.

Have I miss something out ?

[lotsaram]

Not sure if this make sense.

I have created another cube name 'EmployeeAttribute' having Employee and EmployeeDescription dimension.

In my }ElementAttribute_Employee I have the following rule.

Code: Select all

['Description'] = S:DB('EmployeeAttribute',!Employee,!}ElementAttributes_Employee); 

I have already remove the user access from the EmployeeAttribute cube and also to the 'description' element in the EmployeeDescription dimension.

After the user login, although he cant see EmployeeAttribute cube, but when he goes in to }ElementAttribute_Employee cube, he is still able to see the description reference by the rule to EmployeeAttribute cube.

I would thought usually permission would have restrict the user from seeing the data in EmployeeAttribute cube although there are rule reference to it.

Have I miss something out ?

Hi Winson,

I think you have missed the point. As I told you it is not possible to restrict visibility of dimension attributes via security. Attributes are simply visible. Moving the physical storage location of the employee description to another cube and hiding it but then pulling the values through to the attribute cube via a rule doesn't achieve anything.

qml has given a good pointer as to a possible easy solution that doesn't require any redesign beyond the data separation you have already done. Provided there is no significant performance hit this might be worthwhile pursuing.

[winsonlee]

Thanks for the idea guys. That is what i am looking for.