Security for new data cube

[shinymcshires]

Fellow forum members -

I created a new data cube last week. I did not set up any security to the data elements. I published a report from a cube slice (OLAPObjects) and it worked as expected. When I went to demonstrate the report to a co-worker, there were *KEY_ERR in place of the data elements. I checked their assigned security group, they have write access to every element in every dimension in the cube (looks like the default setting is 'WRITE'). I must be overlooking some security setting.

I tried 3 times to upload screen shots of the published report, but seem to be encountering an error 'Could not upload attachment to ...', so I'll have to fly this one somewhat blind.

Thank you in advance for your time!

[shinymcshires]

I forgot to mention that when I went to demonstrate the report to my co-worker, she logged in with her credentials (which is not an administrator account).

[ajain86]

did your coworker try to view the same data from cube view? this would explain if it was a security question or an excel issue.

in excel, did you make sure that the function you are using to retrieve data from TM1 had all the proper elements in the correct order?

[Mike Cowie]

I would second the suggestion to try logging in as this user from the Perspectives/Architect clients. Often we set up a test user in TM1 and put that user in groups we're trying to test, then login as that user and validate that the security looks as we'd expect with that combination of group membership.

Chances are there's something missing at the Cube security or Element Security level (in one of the cube dimensions); you may also have Dimension security in the mix, too, but the Cube and Element security are more often the culprits. In the TM1 client/cube viewer you should be able to spot this kind of problem pretty easily in the form of cubes not showing up for the user or error messages about "No Read Access to Elements" for 1 or more dimensions in the cube when you go to browse the cube. Remember that adding a new cube to the TM1 server would default to NONE access for all non-admin groups...

Hope that helps.

Regards,
Mike

[shinymcshires]

Thanks for the reply. My co-worker isn't viewing from a cube viewer. She's viewing a published web report. I did check the order of the elements in the DBRW formula in the published worksheet. They are in the correct order. I did view the report using my credentials, and the data appeared correctly, as expected.

Mike - Excellent suggestion. I've logged in with my co-worker's credentials, and she does not have access to the data cube. I thought that the default setting with any new data cube was 'WRITE' access to the cube, dimension and data elements.

When I was troubleshooting the issue, I right clicked on the new data cube and selected 'Create Cell Security Cube'. After selecting 'Display Control Objects', I wasn't quite too sure what to do at that point, as there is no data in this cube, which I suppose means that none of the security groups have any access to this cube.

Is there a quick way to populate the entire cube with 'WRITE' values? I tried to do so manually, but got an error message 'Error creating view array'. My guess is that a rule is the best idea.

[Mike Cowie]

When I was troubleshooting the issue, I right clicked on the new data cube and selected 'Create Cell Security Cube'. After selecting 'Display Control Objects', I wasn't quite too sure what to do at that point, as there is no data in this cube, which I suppose means that none of the security groups have any access to this cube.

Is there a quick way to populate the entire cube with 'WRITE' values? I tried to do so manually, but got an error message 'Error creating view array'. My guess is that a rule is the best idea.

Once you've applied security to something in TM1 the default for any new items added is NONE for non-admins. That's generally a good thing since it's better to lock something down by default rather than find out 3 months later you've left the new Salary cube open to everyone.

I don't think you need to go the Cell Security route based on what you're describing. Cube Security is modified here: When you're logged in as an admin in Server Explorer right-click on the Cubes icon and select Security Assignments... This should let you give READ/WRITE/etc access to this new cube for the group(s) that this colleague's ID is located in. Dimension and Element security are modified through similar right-click options, but it sounds like Cube security alone may be all you need to update.

Cell security is the most granular level of security in TM1 (down to the individual cell level, not suprisingly), and is something we typically try to define through rules on that security cube. BUT, I really don't think you need cell security based on what you're describing. In fact, you may want to get rid of the }CellSecurity_ cube you just created the next time you have the TM1 server shut down (by physically deleting that .cub file) if you don't plan to use cell security for this cube.

Hope that helps. The PDF operations/admin manuals are pretty helpful for this sort of thing if you're looking for more details on security administration - I realize this may not be the sort of thing you do very often, but it is a very helpful reference when you need it.

Regards,
Mike

[shinymcshires]

Mike -

Exactly what I was looking for! I looked at the index for security settings in the pdf manuals, but wasn't having very much luck. Looks like that's two lunches I owe you (either that or a very nice dinner!)