TM1 Forum

Hi All,

TM1 9.5 and Contributor 9.5

I'm trying to restrict the employees that can be viewed by Department. I have gone to my Element Security control cube for this employee list. So far, in that cube, I have defined the employees in these two departments; those in 101 and those in 102.

Since I have access to both departments, I can see the employees of both departments when I am in EITHER Department 101 or Department 102. This may be logical, but I want to see ONLY the employees in Dept 101 when I select Dept 101, and ONLY the employees in 102 when I select that Department. Ideally, it will work that way in Contributor as well.

Is the only way to do this by using cell level security? If so, what's the fastest way to do that? If I have to populate every Department, every Cost Center, every Employee type, every Role, and every Month manually in the control cube, I'll be older than Methusala by the time I'm done!

I appreciate any ideas.
Thanks!

What you can see as an admin is not so much relevant as what a user can see who has ONLY access to either dept 101 or 102 ...

lotsaram wrote:What you can see as an admin is not so much relevant as what a user can see who has ONLY access to either dept 101 or 102 ...

Right, but if a user has access to 4 departments, they open Dept 101, and there, they see ALL of the employees for their 4 departments, that's not going to fly. I guess I could create subsets in each department.

This is a tricky situation that isn't particularly well handled by TM1. You have a few options. The first is to stick your people and department into the same dimension - but this only works if one person can only ever belong to one department.

Another option is to use cell level security with rules (not for the faint hearted though as this post shows). Set up a two (or three if you want to include clients) dimensional cube with department and people. Put a 1 flag at intersections where the two can be seen together and then use that 2D cube to populate the much bigger }CubeSecurity_Cube.

Another possible option (but again it'll only work if people are in just the one dept) is to store the department as an attribute in the people dimension and write a rule along the lines of ['Show'] = if(attrs('People', !People, 'Dept')@=!Dept), 1, 0); and zero suppress this. The feeders will be tricky though.

Hmm, with all those qualifiers I'm not sure if I've helped or not...

Martin

AFAIK there is no way to do this in TM1, there is no way to make the security dynamic enough to say if a user has selected Dept 101 then only show employees of that department in the employee dimension.

Perhaps if you explain a bit more about the context in which you are trying to achieve this someone can point you at a workaround.
Cheers

2c
Creating subsets or MDX of employees by department and educating those people who may have access to multiple departments is probably the easier option than trying to overcome this!

Hello,

Is this cube for budgeting or for read-only reporting?
- If it is a read-only application then splitting the information into 2 dimension (employee and dept) and using suppress-zero you can create the required view.
Do you need a solution in a cubeview or you can live together with Active form?
- In Active form you can create a dynamic solution where selecting element from one (title) dimension can drive the MDX definition subset on the row dimension.

Regards,
Peter

Thanks Guys,

This is actually for views in TM1 Contributor v9.5 and is a budget application, not read-only reporting.

I think the answer is, what I am used to, and pictured, can be done, but a little knowledge transfer to the users and subset creation in TM1 Contrib is going to be the path of least resistance. I've discussed this with the client and they are OK with it.

Fortunately, we only have about 25 contributor users, so we can customize this for them.

Thanks for all of the ideas, I've stored those away for sure.

Take care,
Christian