TM1 Forum

Dear forum,

Our TM1 9.4.1 system has complex security mechanism, that there are many }ElementSecurity cubes to control the element in different dimensions. Some groups have READ access to cube data, while some groups have WRITE access.

There is a new task that all users should have READ only to access the cube data. Setting each }ElementSecurity cube to READ for all groups will be tedious work, or tend to miss something. I also heard that to delete all }ElementSecurity cubes, then restart Server. But I am not sure if it will effect the cube data.

Could some one give me one suggestion how to do it?

Thanks a lot.

Learn_TM1

There are a number of ways to resolve this, a simple rule statement in each cube would force all cells to be READ, a TI process to load 'READ' into all cells or as you've already pointed out you could delete }ElementSecurity_ cubes and restart

I would delete the ElementSecurity cubes but be sure to check Security on the Cubes to achieve READ only access.

Given the existing complexity I would take a backup so you can revert back to a known position and ideally test on a development server first

Edward Stuart wrote:... but be sure to check Security on the Cubes to achieve READ only access

In this snippet Edward gave you the right answer but the rest might lead you down the wrong path.

Learn_TM1 wrote:There is a new task that all users should have READ only to access the cube data.

The answer is staring you in the face. You don't need to do ANYTHING to the element security cubes. (You probably could since more than likely most of them aren't needed but you don't HAVE to.)

Element security can only ever restrict a group's access to cube data; that is demote from write to read (or none). Element Security can not elevate cube access to write. Therefore it is completely irrelevant if element security is write (that is in end effect the default element security level when there is no element security.) If there is s requirement that users should only have read access to cube data then the answer is simple, make sure that access to all cubes in }CubeSecurity is READ and not WRITE. Nothing more and nothing less and no need to make it more complicated than that.

Hi Lotsaram,

Thanks a lot for your hint. I set }CubeSecurity for all users READ only access. For the other security cubes, I didn't change anything. And it worked! The users really have only READ access for all data.

Best regards

Learn_TM1