Does Write access override Read access in dimension security

[guru1988fortm1]

Hi All,

I am using Cognos 9.5.2 with Cognos 10 BI security

We create the groups in BI and import to TM1 and assign access for those groups to cubes and dimensions

I have dimensional security Country wise, scenario wise and the measure dimension wise

My users sometimes close the forecast and they wanted to open only for few countries

LA_Brazil, LA_ARG , LA_MEX , LA_PremLoss , LA_Expense are the group names

LA_Brazil , LA_ARG, LA_MEX are mapped to country as well as Scenario

LA_premLoss, LA_Expense are mapped to scenario and elements of the Measure dimension

So,this wat i do

my Country and measure dimension security remain untouched


LA_BRA LA_ARG LA_MEX
brazil business units WRITE
argentina business units WRITE
mexico business units WRITE

Measure dimension

LA_PremLoss LA_Expense
GWP WRITE WRITE

i only alter the scenario dimensional security , For eg, i want only the argentina users to make changes,i change like this

LA_BRA LA_ARG LA_MEX LA_PremLoss LA_Expense
FQ1-M3 READ WRITE READ WRITE WRITE

So the argentina users have write access to the respective scenario

but the other county guys also have access to change the values, eventhough one group have read access

Eg;, brazil user , LA_BRA has read REad access to FQ1-M3 and the LA_PremLoss has Write access to FQ1-M3

The brazil user belong to both the LA_BRA and LA_PremLoss groups

Does write access of one group overrides the read access of another group in diemnsional security

Can anyone help me on this because i cannot do testing also as i dont have any additional id's and its a long process to get them and assign security acess after confirmation and aouthorizations

Thanks
Regards
Guru

[Alan Kirk]

First of all, it's nice to see a question which contains all of the actual detail of the problem instead of the more common, "suppose I have groups A and B, and suppose..."

It's a pain that the phpBB software that the forum runs on doesn't include table functionality, but if I understand your question correctly the grid of security looks like this:

Code: Select all

                    LA_Brazil      LA_ARG      LA_Mex      LA_PremLoss      LA_Expense
Country
	Brazil            WRITE
	Argentina                        WRITE
	Mexico                                       WRITE
Scenario
	FQ1-M3            READ           WRITE       READ       WRITE            WRITE
Measure
	GWP                                                     WRITE            WRITE

And the Brazil person would be a member of LA_Brazil, LA_PremLoss and LA_Expense, while the Argentine user would be a member of LA_ARG, LA_PremLoss and LA_Expense.

In that case, yes, you are correct in your assumption. TM1 runs on a least restrictive security model, meaning that if you pick up write access from one group it doesn't matter if you have only Read access in other groups. Consequently the Brazil person's membership of LA_PremLoss and LA_Expense will give them write access to FQ1-M3.

The solution is pretty simple; don't let LA_PremLoss LA_Expense assign any access in the Scenario dimension. It doesn't need to; that's not its job as I read your question. Its job as I read it is to assign access to the Measure dimension. If you want to assign a combination of country / scenario access, do that entirely through the three country groups.

[guru1988fortm1]

Hi Alan,

Your understanding is correct, this is the actual design of my TM1 Security

Also, Thanks for pointing out that the Write access of one group will override the READ access of another group to the element in the same dimension
(My understanding was complete opposite to this prior )

It really did work , when i removed the groups LA_PremLoss and LA_Expense from the Scenario security. i cleared those cells,

And when i made LA_Brazil as Write, only brazil user can have access and for others , it is grayed out

But i wanted to extend my security a bit more

Say , In brazil, i have two different types of users, premLoss Users and Expense Users

so, is there a possibility to limit the users further more

Provided that, GWP is not the only element in measure , it has around 150 elements in it
And
we always have two scenarios open in our TM1, one willl be Budget(done for 5 years) , other is forecast(done for an year), so we cannot make the measure dimension as read/write

Is there any other possibility to achieve this with my design

Thanks
Regards
Guru