how to set current user in TI process?

[wang_chris]

I have created different users on a dimension (such as division), which works when I open cube.

But when I run a process that read data from such cube as a user of division A, the process accessed data of all divisions. The dimension permision doesn't work in process. I have added DatasourceUserName=TM1User() statement in process, still no effect.

Is there anyway for me the set the cuurent user in TI process?


Statement as below.

--------------------------------------------------------------------
DataSourceType = 'VIEW';
DatasourceNameForServer = 'Emp_Raw_info_3' ;
DatasourceCubeview = vViewName;
DatasourceUserName=TM1User() ;
--------------------------------------------------------------------


Chris

[Wim Gielis]

Hello

If I understand you correctly, you need to create the view (vViewName) in your Prolog tab and populate its subsets with the desired element(s) for each dimension.
You could use the function TM1User() to have the current logged on user.

[EvgenyT]

tatement as below.

--------------------------------------------------------------------
DataSourceType = 'VIEW';
DatasourceNameForServer = 'Emp_Raw_info_3' ;
DatasourceCubeview = vViewName;
DatasourceUserName=TM1User() ;
--------------------------------------------------------------------


Chris

Correct me if I am wrong, but intended use of DataSourerUserName local variable is to pass user name in conjunction with DatasourcePassword to ODBC source. In context of DataSourceType = 'View' it doesn't make a lot of sense.

I would follow Wim's suggestion of assigning subsets to a View. Just declare variable = TM1USER() and pass it to the subset.

[hyunjia]

Please correct me if I am wrong , DatasourceUserName would only be valid when using a ODBC or ODBO source .

[EvgenyT]

Correct me if I am wrong, but intended use of DataSourerUserName local variable is to pass user name in conjunction with DatasourcePassword to ODBC source. In context of DataSourceType = 'View' it doesn't make a lot of sense.

Please correct me if I am wrong , DatasourceUserName would only be valid when using a ODBC or ODBO source .

Doesnt it just repeat what was said above

[hyunjia]

oOo , Sorry , my bad , haven't gone throught the whole answer stack

[EvgenyT]

oOo , Sorry , my bad , haven't gone throught the whole answer stack

Friday afternoon...

[wang_chris]

Let me clarify the scenario in a simple model.

I have a cube with 3 dimensions of below.

Dim 1: Division
All_Divisions
-> Division_A
-> Division_B
-> Division_C

Dim 2: Year
Dim 3: Account, like Revenue, Costs, etc.

Also, there is a process to read all data of that cube and write down the data to a file (just for easy to understand).

Now I create staff for each division. for example: Staff_A has write permission for Division_A, none permission for other divisions. Similar for Staff_B and Staff_C.


Now when I login with Staff_A in archtect and perspective, and open the cube, I can only see the content of Division_A, since the permission of Staff_A, which is correct.

Then when I run a process with the user Staff_A . In addition to data of division A, the process can access the data of division B and C, and write them out as well.

This is what I won't see in the process. I still want the process to deal with data of division A only according to its premission, because the process is common for all staffs.

What's the solution for that process?


Regards,
Chris

[deepakjain2020]

I still want the process to deal with data of division A only according to its premission, because the process is common for all staffs.

Hi Chris,

You need that Staff A should be able to access only it's division A via process. Correct me if my understanding is wrong.

If what I understood is correct then pls go through below link as discussed in earlier topics in forum (http://www.tm1forum.com/viewtopic.php?p=32121)
http://www-01.ibm.com/support/docview.w ... wg21459638

Regards,
Deepak Jain

[declanr]

I still want the process to deal with data of division A only according to its premission, because the process is common for all staffs.

Hi Chris,

You need that Staff A should be able to access only it's division A via process. Correct me if my understanding is wrong.

If what I understood is correct then pls go through below link as discussed in earlier topics in forum (http://www.tm1forum.com/viewtopic.php?p=32121)
http://www-01.ibm.com/support/docview.w ... wg21459638

Regards,
Deepak Jain

This technote (as do a lot of previous replies) fully explain why what you are trying to do isn't working.


It's a bit of an unusual requirement but can quite easily be achieved.


In the prolog of your TI:

Code: Select all

sSubset = <YOUR SUBSET NAME, THIS MUST BE UNIQUE PER EXECUTION>;
sUser = TM1User();

SubsetCreate ( '}Groups', sSubset );

iCount = 1;
iMax = DimSiz ( '}Groups' );
While ( iCount <= iMax );
         sGroup = DimNm ( '}Groups', iCount );
         If ( Scan ( 'admin', lower ( sGroup ) ) = 0 );
                  If ( CellGetS ( '}ClientGroups',  sUser, sGroup ) @= sGroup );
                             SubsetElementInsert ( '}Groups', sSubset, sGroup, 1 );
                  EndIf;
         EndIf;
         iCount = iCount + 1;
End;   

So at this point you have a subset created of all the groups that the user in question has access to.
Execute a second process that looks at your }ElementSecurity cube in question and pass in the subset you've just created while leaving the actual dimension as "all", for any cell where a given group has 'WRITE'; add that element to a new subset. (You can also include "Read" if required.)

At this point you now have a subset of all the elements that the user in question has access to; assign this to your view.


Job done.

[BariAbdul]

Thanks Declanr,nicely done!

[wang_chris]

Thank you all.

I will read the technote.

[BariAbdul]

Hi Declan,We can use Random function and concatenate with subset so to get unique subset each time it gets excuted.Thanks for your reply.

[declanr]

Hi Declan,We can use Random function and concatenate with subset so to get unique subset each time it gets excuted.Thanks for your reply.

There are 101 different ways to get unique names for subsets and views; RAND() is probably overkill in this instance since the process only really needs to be specific to the user running it and as such combining the TI name with their own USER name is probably sufficient.

Using RAND() on it own to get unique subsets is something I would stay away from since although it is highly unlikely; there is a chance that 2 RAND() functions will return the same number.
Depending how concurrent a process is likely to be you can use a combination of: Process Name, User Name (be careful with special characters when using CAMs), TimeStamp etc etc etc
You can also loop through the directory to find what subsets already exist that have the same prefix and then increment the suffix by one to guarantee uniqueness... but that's usually overkill.


I know a lot of people use RAND() and may have done so for years and years without any issue but in my mind if there is even the slightest chance of it returning a non-unique number it should be avoided... not least because if it does happen, the probability is so small that you would have one hell of a hard time working out why it had failed (seems contradictory I know but I think there is sense in there somewhere.)

[lotsaram]

Let me clarify the scenario in a simple model.

I have a cube with 3 dimensions of below.

Dim 1: Division
All_Divisions
-> Division_A
-> Division_B
-> Division_C

Dim 2: Year
Dim 3: Account, like Revenue, Costs, etc.

Also, there is a process to read all data of that cube and write down the data to a file (just for easy to understand).

Now I create staff for each division. for example: Staff_A has write permission for Division_A, none permission for other divisions. Similar for Staff_B and Staff_C.


Now when I login with Staff_A in archtect and perspective, and open the cube, I can only see the content of Division_A, since the permission of Staff_A, which is correct.

Then when I run a process with the user Staff_A . In addition to data of division A, the process can access the data of division B and C, and write them out as well.

This is what I won't see in the process. I still want the process to deal with data of division A only according to its premission, because the process is common for all staffs.

What's the solution for that process?


Regards,
Chris

This is a relatively common requirement. Declan has shown you how to do it by looping through group memberships and element security to compile an "effective permissions profile" but why oh why IBM can't introduce a ExecuteWithuserPermission('user') function in TI is beyond me, it would save an awful lot of hassle.

[wang_chris]

I have read the technote. Thanks all for your reply.

Chris

[wang_chris]

Just for a curiosity, why the developer keeps TM1 process from inheriting the running owner's permission? it looks common in other system.

Chris

[declanr]

Just for a curiosity, why the developer keeps TM1 process from inheriting the running owner's permission? it looks common in other system.

Chris

As to why it was developed this way you would probably need to ask the people at IBM who originally developing the concept of Turbo Integrator... all of whom probably no longer work for IBM.

Speculation could be that TI was originally for primarily administrative tasks; now it's quite common for the TI to include a section that requires changes to objects that you wouldn't want a user to change manually (such as metadata.) Personally I would say it seems to be set up the correct way; as per Lotsa's suggestion it would be nice to have a "ExecuteWithUsersAccess" style option but that can currently be done manually as I showed above. If you swapped the method to running with a user's credentials as standard though it would be more difficult to flip it the other way.

[wang_chris]

Thanks.