TM1 Control Cube - SecurityOverlayGlobal

[pkubal]

Does any one know what is the purpose of the TM1 control cubes "}SecurityOverlayGLobal_<Cube Name>". I have noticed that these cubes are created for only those cubes which are exposed in contributor. These cubes have two dimensions, first is the Workflow dimension and other one is again a control object, dimension named "}SecurityOverlay". This dimension has one element "OverlayData". I am trying to find out how do these cubes work and what role they play in the TM1 security. Would really appreciate if someone could provide any insight.

Thanks
Pmesh

[eleuschk]

Pmesh:

I'm curious as well. I have the same scenario where these cubes exist only for cubes that are available in Contributor. I recently had an issue where a user had ownership of the Cost Center (the Approval Hierarchy is based on dimension Patt_Cost_Center), but the intersection of that Cost Center and OverlayData elements in the }SecurityOverlayGlobal cube was "1", and he was unable to edit. Once I changed this to blank, he was then able to edit. We had two Cost Centers open (and he had ownership of both at the same time) and he was able to edit the one without anything in the Cost Center/OverlayData intersection, but when the "1" was present, he was unable to edit for that specific cube. I'm sure there is a Control Process that changes these settings - but I have yet to find it.

eleuschk

[sophie]

Hi,

Could somebody help me with the function of the TM1 control cubes "}SecurityOverlayGLobal_<Cube Name>"?
I am not able to find much details about this cube.
I too recently had an issue where a user had ownership of the certain node but the intersection of that node and OverlayData elements in
the }SecurityOverlayGlobal cube was "1", and he was unable to edit. Once I changed this to blank, he was then
able to edit. Can anybody tell me how is the “ 1 “ getting populated in that control cube?
Can re-importing the application create '1' in the cell?
Appreciate your help.

Thanks
Sophie

[ViRa]

Nodes that have been 'locked' (after data submission) are updated with '1' in the }securityoverlay cube and hence uneditable.

[mce]

Do you know how can I make the cells uneatable via TI processes when it is 1 in }SecurityOverlayGlobal_ cube?

[tstroumbos]

I know this post is over a year old, but we were having the same issue where users had ownership, but all cells were still grey and they were unable to edit. Admin users, however, could edit data.

After some digging we found that this cube is being updated in the "}tp_workflow_reject_node" process. We're not sure what's causing the disconnect, but sometimes the reject process is hanging when we try to reject multiple users, and this security overlay cube isn't being updated.

Our resolution for the time being is that we've had to manually unlock users by updating both the "}tp_application_state}..." cube (changing the 4 to a 2) and then this "}SecurityOverlayGlobal_..." cube.

[lotsaram]

I know this post is over a year old, but we were having the same issue where users had ownership, but all cells were still grey and they were unable to edit. Admin users, however, could edit data.

After some digging we found that this cube is being updated in the "}tp_workflow_reject_node" process. We're not sure what's causing the disconnect, but sometimes the reject process is hanging when we try to reject multiple users, and this security overlay cube isn't being updated.

Our resolution for the time being is that we've had to manually unlock users by updating both the "}tp_application_state}..." cube (changing the 4 to a 2) and then this "}SecurityOverlayGlobal_..." cube.

Bit of a dead zone the aviana forum, but welcome back.

Yes the SecurityOverlayGlobal cubes are created in TM1 Application web by tp_ processes as a way of setting submitted of the approval hierarchy to read only but the effect is valid through the entire TM1 model. It is possible to create a security overly for any cube with a TI function
SecurityOverlayCreateGlobalDefault
Once created the extent of the read only area of the cube can be manipulated with a TI function
SecurityOverlayGlobalLockNode
And you can destroy a overlay cube with
SecurityOverlayDestroyGlobalDefault

For cube areas in in the target cube where the security overly is on (value of 1 in the overlay cube intersection) it makes the target cube read-only for all non-admin users regardless of group membership. The overly does not affect admin.