Security Refresh for Element Security
Posted: Fri Jul 06, 2012 11:13 am
Hello everyone,
I like to tricker the security settings for an element of a dimension in parameter cube. I think it's the best to explain it based on an example:
In my data model the cubes always have a dimension "Version". Data has always to be entered on the current version which is stored in a parameter cube.
Dimension "Version", elements 1,2,3,4,5.
Parameter cube: Current version is set 2 for example.
I'm using a rule in the }ElementSecurity_Version-cube to set the current version to WRITE and the other versions to READ.
The problem now is that non-admin user have to change the version in the parameter cube. But the element security is only updated after a "Security Refresh". I wrote a process which refreshes the security (SecurityRefresh()) but when non-admin user execute this process they get an error. Seems like they are not allowed to execute this function in a TI-Process.
I thought instead of using a rule I can use a process which directly updates the security setting. Then the users don't need to refresh the security (got this information out of this forum).
But when users run the process they get the error "no security access for CellPutS".
As far as I understood the TM1 security the TM1 processes run always as an Admin (not with the user specific security setting). He only has to have process read access. But when I review the errors I got it seems like TM1 is checking the security setting of the users who is executing the process when changing data in the security cubes and for some functions executed in a TI (at least the securityrefresh function).
An alternative would be to write a chore which refreshs the security frequently, but this would have an high impact on performance. A better solution, or lets call it workaround would be writing a chore which updates the security in the in the security cube (no sec. refresh required). The process would check the security setting in the parameter cube and set the security setting based on the selected version. It would very simple process but it is sill a ugly workaround for me.
Any other ideas?
I like to tricker the security settings for an element of a dimension in parameter cube. I think it's the best to explain it based on an example:
In my data model the cubes always have a dimension "Version". Data has always to be entered on the current version which is stored in a parameter cube.
Dimension "Version", elements 1,2,3,4,5.
Parameter cube: Current version is set 2 for example.
I'm using a rule in the }ElementSecurity_Version-cube to set the current version to WRITE and the other versions to READ.
The problem now is that non-admin user have to change the version in the parameter cube. But the element security is only updated after a "Security Refresh". I wrote a process which refreshes the security (SecurityRefresh()) but when non-admin user execute this process they get an error. Seems like they are not allowed to execute this function in a TI-Process.
I thought instead of using a rule I can use a process which directly updates the security setting. Then the users don't need to refresh the security (got this information out of this forum).
But when users run the process they get the error "no security access for CellPutS".
As far as I understood the TM1 security the TM1 processes run always as an Admin (not with the user specific security setting). He only has to have process read access. But when I review the errors I got it seems like TM1 is checking the security setting of the users who is executing the process when changing data in the security cubes and for some functions executed in a TI (at least the securityrefresh function).
An alternative would be to write a chore which refreshs the security frequently, but this would have an high impact on performance. A better solution, or lets call it workaround would be writing a chore which updates the security in the in the security cube (no sec. refresh required). The process would check the security setting in the parameter cube and set the security setting based on the selected version. It would very simple process but it is sill a ugly workaround for me.
Any other ideas?