Hi,
As per documentation the most restrictive security that applies to a cell is that which is applied.
For the same dimension element if a user is a member of two groups, one that gives read access and one that gives write access then the user ends up with write access. This is wrong as per the documentation.
I just want to double check the cfg, I seem to remember there is one that reverses the most restrictive rule. I can not find any trace of it though. Does it still exist? Can anyone remind me of it incase it is being applied by default?
TM1 Version is 2.0.7
Dimension Element Security - Most restrictive
- Steve Rowe
- Site Admin
- Posts: 2416
- Joined: Wed May 14, 2008 4:25 pm
- OLAP Product: TM1
- Version: TM1 v6,v7,v8,v9,v10,v11+PAW
- Excel Version: Nearly all of them
Dimension Element Security - Most restrictive
Technical Director
www.infocat.co.uk
www.infocat.co.uk
-
- MVP
- Posts: 2832
- Joined: Tue Feb 16, 2010 2:39 pm
- OLAP Product: TM1, Palo
- Version: Beginning of time thru 10.2
- Excel Version: 2003-2007-2010-2013
- Location: Atlanta, GA
- Contact:
Re: Dimension Element Security - Most restrictive
This is the way it has always been for as long as I have been using TM1. I actually had no idea the documentation said otherwise. Not surprising since I haven't looked at the manuals in probably ten years or so.Steve Rowe wrote: ↑Fri Dec 18, 2020 11:58 am For the same dimension element if a user is a member of two groups, one that gives read access and one that gives write access then the user ends up with write access.
Maybe the documentation is referring to the rule that says if you have WRITE to the cube, WRITE to the dimension, but READ to the element then you have READ. You have to have WRITE all the way down to have WRITE.
- Steve Rowe
- Site Admin
- Posts: 2416
- Joined: Wed May 14, 2008 4:25 pm
- OLAP Product: TM1
- Version: TM1 v6,v7,v8,v9,v10,v11+PAW
- Excel Version: Nearly all of them
Re: Dimension Element Security - Most restrictive
Thanks Tom, I had the feeling that I was off somewhere, the documentation doesn't really cover when the security model applies differently to the same object.
Not sure of the logic of implementing the security priority in different directions depending on the context.
Anyway this was quicker than reaising a support request, thanks!
Cheers,
Not sure of the logic of implementing the security priority in different directions depending on the context.
Anyway this was quicker than reaising a support request, thanks!
Cheers,
Technical Director
www.infocat.co.uk
www.infocat.co.uk
-
- MVP
- Posts: 3113
- Joined: Mon Dec 29, 2008 6:26 pm
- OLAP Product: TM1, Jedox
- Version: PAL 2.0.9.18
- Excel Version: Microsoft 365
- Location: Brussels, Belgium
- Contact:
Re: Dimension Element Security - Most restrictive
That would be new to me. READ access to a dimension is sufficient for WRITE access to the cell, when WRITE is given at CUBE and ELEMENT level.
Best regards,
Wim Gielis
IBM Champion 2024
Excel Most Valuable Professional, 2011-2014
https://www.wimgielis.com ==> 121 TM1 articles and a lot of custom code
Newest blog article: Deleting elements quickly
Wim Gielis
IBM Champion 2024
Excel Most Valuable Professional, 2011-2014
https://www.wimgielis.com ==> 121 TM1 articles and a lot of custom code
Newest blog article: Deleting elements quickly
- macsir
- MVP
- Posts: 782
- Joined: Wed May 30, 2012 6:50 am
- OLAP Product: TM1
- Version: PAL 2.0.9
- Excel Version: Office 365
- Contact:
Re: Dimension Element Security - Most restrictive
There is a flag CELLSECURITYMOSTRESTRICTIVE in }CubeSecurityProperties.
Is it what you are after? It is still there an works fine as expected.
https://www.ibm.com/support/knowledgece ... ights.htmlWhen CELLSECURITYMOSTRESTRICTIVE is yes, Element and Cell Security behave such that the most restrictive applies. For instance, if Element Security for a specific element is set to READ for a given Group and Cell Security for a cell referencing that dimension element is set to WRITE, then security will resolve to READ. If the CELLSECURITYMOSTRESTRICTIVE parameter is set to any value other than YES, then the server behaves as it did in the prior releases.
Is it what you are after? It is still there an works fine as expected.
- Steve Rowe
- Site Admin
- Posts: 2416
- Joined: Wed May 14, 2008 4:25 pm
- OLAP Product: TM1
- Version: TM1 v6,v7,v8,v9,v10,v11+PAW
- Excel Version: Nearly all of them
Re: Dimension Element Security - Most restrictive
Thanks macsir, no wonder I couldn't find the switch, looking in the wrong place!
Cheers
Cheers
Technical Director
www.infocat.co.uk
www.infocat.co.uk