Interaction of element and cell security rules

[David Usherwood]

Had a client come through with something rather odd.
They have security groups dividing up access by cost centre. So in the cost centre security rules, we have

['Div1Grp'] = s: if(elisanc('CC','Div1',!CC) = 1 % !CC @= 'Div1',
'WRITE',
#ELSE
'READ'
);
which works fine. But in the salaries cube (dimensioned by staff member and CC) they want something tighter ie
['Div1Grp'] = s: if(elisanc('CC','Div1',!CC) = 1 % !CC @= 'Div1',
'READ',
#ELSE
'NONE'
);

On the main cube, putting users in more than one 'divisional' security group works fine, they can work with CCs under each division. But in the salaries cube, if users are in more than one 'divisional' security group, they get access only to the _last_ group.

Views welcome. If I haven't explained it clearly, ask and I'll try to provide moredetails. I've played around with FEEDSTRINGS which did nothing (as usual). I feel an SR coming....

[Steve Vincent]

Have you got multiple sections in one rule file for the same group?

[David Usherwood]

No - but the user is in 2 groups, which is the broken bit.

[belair22]

Appears you have defined 2 different types of security:

* Dimension security (Cost Centre dim)
* Cell level cube security (Salaries cube)

From the example below there's going to be a conflict in these rules - i'd have assumed the cell level security would have taken precedence (might not be the case). I'd suggest using the rules tracer on the Salaries Cube cell security to see what's happening.

[Marcus Scherer]

Would the tighter rule work for the main cube?