Comments on: SSAS advanced dimension level security using SSRS reports, showing parent of a level you have no access

By: Kasper de Jonge

Kasper de Jonge — Fri, 06 Nov 2009 10:07:18 +0000

@Cube
Hi, I think you mean the same as on this SSRS forum:
http://social.technet.microsoft.com/Forums/en-US/sqlreportingservices/thread/bc3e411c-6d9f-47c1-8991-0b6ae66407e7 let me know if you mean something else ?

By: Cube

Cube — Tue, 03 Nov 2009 10:43:19 +0000

Cube : HI, this article 100% apt for my requirement, but when i am using that cube data in my ssrs environment i didn’t get filtered, it gives me complete data so can u please guide me on this

By: Kasper de Jonge

Kasper de Jonge — Wed, 28 Oct 2009 07:36:56 +0000

@Haojie Qiao Hi Haojie, yes when you want to enable user to analyse the cube themselves this is not a viable option. But MDX won't serve you in Excel 2007 either. But i agree MDX is the neatest solution, but also the most difficult.

By: Haojie Qiao

Haojie Qiao — Wed, 28 Oct 2009 00:30:45 +0000

I agreee this might be the easy workaround in SSRS based solution. Alternatively, you can split the dimension into 2 and apply security on one of them.

However, both way don’t work nicely if you allow end user to use Excel 2007 to browse the cube. The “duplicate dimension way” cannot secure the data at all. The “split into 2 dimension way” works, but you have to see 2 dimension tables in field panel and you cannot build hierarchy on top of it.

MDX solution is best option thought it is the most complex one.

By: Kasper de Jonge

Kasper de Jonge — Sun, 25 Oct 2009 08:48:29 +0000

@Tomislav Piasevoli
Hello Tomislav, Thank you for your reply.

I’m sure you could attain the same result with the use of MDX. But is see a few major problems with this:
- You have to remove the role with the security to let user access all the levels leaving the cube all open
- Using roles with different postal code per user let the report automatically show the right data, no selection necessary
- I have to create multiple, different, reports using this security, so i have to create MDX for every report. My client is no MDX expert and they want to do it themselves

And i understand that creating two almost identical dimensions isn’t very pretty but it’s still the most report builder friendly solution.

By: Tomislav Piasevoli

Tomislav Piasevoli — Sun, 25 Oct 2009 07:51:43 +0000

How about providing an advanced, MDX based calculation where you deny access to descendants of states which are not ancestor of certain postal codes, but are in the same country?

Additionally, you can deny access to other countries on the grain of your choice, using one more condition.

By: Kasper de Jonge

Kasper de Jonge — Sun, 25 Oct 2009 06:55:22 +0000

@Greg Galloway hi Greg, you're absolutely right. I did try it but didn't even look at the numbers. But it still doesn't do what i want in my scenario, i want to report over dimension levels i don't have access to thanks to autoexists, visual totals doesn't change this.

By: Greg Galloway

Greg Galloway — Sat, 24 Oct 2009 22:59:33 +0000

I think you’ve got it backwards (unless I’m having a senile moment). Visual totals means the totals are made up of only what you can see. So checking that box (not the default) means the totals obey the security you setup. Try it.

By: Kasper de Jonge

Kasper de Jonge — Sat, 24 Oct 2009 07:30:35 +0000

@Greg Galloway Hi Greg, thx for replying.
Visual totals is not an option in this scenario, what visual totals does is make sure when you sum a parent level of the secured level it shows the sum and of only the levels you have access to. As you can read here: http://www.sqlserveranalysisservices.com/OLAPPapers/DynamicVisualTotals.htm

I wish it was that simple

By: Greg Galloway

Greg Galloway — Fri, 23 Oct 2009 20:06:52 +0000

Couldn’t you have just checked the Visual Totals checkbox on the advanced tab? I don’t think you would have to use a separate dimension for security in this scenario, but I could be wrong.