Rights and Rules

[EP_explorer]

I find one problem.

I have a Cube with some Rules which make calculation in some elements. I want to hide these elements from users. So I did such things - put None for dimension elements for User Groups in dimension security; created CellSecurity Cube and put 'None' for User Group again. But result is the same - user can see that elements.

So is it known problem and I read help inattentively or I do something incorrectly?

[tomok]

You basically didn't do anything right. To hide an element you need to create element security for the dimension in question and then assign NONE for the elements you want to hide for the user group(s) you want to hide from. To create element security you can right click on the dimension in Server Explorer and choose Security, Elements Security Assignments.

[lotsaram]

I wouldn't necessarily be as harsh as Tomok. I'll give the benefit of the doubt that you might have deployed element security corectly but just not explained it very well.

Perhaps you are meaning this? Yes it is a known issue that even if certain elements are hidden via security from users, if these elements are used in rule based calculations then users can still see the elements via the trace calculation feature in the perspectives cube viewer. This can be an issue but generally it isn't too much of a concern.

[EP_explorer]

You basically didn't do anything right. To hide an element you need to create element security for the dimension in question and then assign NONE for the elements you want to hide for the user group(s) you want to hide from. To create element security you can right click on the dimension in Server Explorer and choose Security, Elements Security Assignments.

Of course I did what you said.

And after it (when it hadn't helped) I tried to adjust rights using CellSecurity Cube. But elements with rules are shown in both cases (I must say some elements with rules are shown and some aren't)

[EP_explorer]

I wouldn't necessarily be as harsh as Tomok. I'll give the benefit of the doubt that you might have deployed element security corectly but just not explained it very well.

Perhaps you are meaning this? Yes it is a known issue that even if certain elements are hidden via security from users, if these elements are used in rule based calculations then users can still see the elements via the trace calculation feature in the perspectives cube viewer. This can be an issue but generally it isn't too much of a concern.

Actually user can see elements not only in perspectives cube viewer but also in TM1WEb and Contributor. Is it possible to correct it. Or the best way is to conceal these elements using Views?

[tomok]

Actually user can see elements not only in perspectives cube viewer but also in TM1WEb and Contributor. Is it possible to correct it. Or the best way is to conceal these elements using Views?

If this is the case then you haven't done something right. Sorry to be harsh but that's just the way it is. People always think there is a bug in TM1 when they don't see the results they expect. 99.9999% of the time it is because they have not understood the tool or unwittingly done something wrong. The situation that lotsaram is talking about is quite unique and only manifests itself inside the calculation tracing tool. This is not your issue. Are you absolutley sure you assigned the rights correctly to the user groups and are you sure you have the proper members in those groups? Were you aware that rights in TM1 are additive? What I mean by that is my rights in TM1 are the combination of the ALL the groups I am a member of. For example, If I am in two groups, one which restricts my rights to an object, and another which grants me rights to an object then I am going to have rights to the object. That's because the group that gives me rights to an object will trump the group that takes them away. I am guessing that this is your problem. List all the groups this test user user is in and then chart out the righst assigned to those groups. I'll bet you have an overlap where you have taken away the rights in one group but another group is giving out the rights.

[EP_explorer]

Yes you were right.

There was a group which also contained user and also have read rights for elements

[AbsolutVodka]

Regarding to the conversation and the topic,

I wanna know more about the rights when I have to restrict privilege to each user per view. Can I just set the security of each users/user groups to the views directly?

I know that in 9.5.1, we can not do it (in deed, we can use it in TM1 web but I have to focus on contributor), but I'd like to know if we can make it in 9.5.2.

I wanna mention this one cos I think it's much easier for configuring and maintaining than set each security to any group by element.