IBM Cognos Dynamic Cubes

148 IBM Cognos Dynamic Cubes

7.1 Overview of dimensional security

Dynamic Cubes dimensional security restricts the members in a hierarchy that users are

allowed to access. The hierarchy members that a user has access to is defined through

dynamic query expressions.

Restricted members are either those members explicitly denied or, when there are members

explicitly granted, those members that are

not explicitly granted.

With Dynamic Cubes, level-based ragged and unbalanced hierarchies in dynamic cubes are

converted into balanced, non-ragged hierarchies through the use of padding members. To

remain consistent with the manner in which hierarchies are presented, the application of

dimensional security to a level-based hierarchy retains the non-ragged, balanced nature of

the hierarchy through the use of secured padding members. Secured padding members are

inserted in secured hierarchies where the restriction of members would otherwise have

created an unbalanced hierarchy.

When applying member security to parent-child (

recursive) hierarchies, secured padding

members are not needed.

In addition to secured padding members, Dynamic Cubes also supports visible ancestors,

where a member is visible, but any tuple value it is a part of will have a secured value.

Dimensional security does not change the structure of the cube:

򐂰 Levels are not removed.

򐂰 Members remain on their original levels.

򐂰 Members keep their ancestry trees.

7.2 Security model

The security model consists of security filters and security views that are defined in the

IBM Cognos Cube Designer.

7.2.1 Security filters

Zero or more security filters can be defined for each hierarchy within a cube. Each security

filter has a name that is unique within the scope of the hierarchy in which it is defined.

Each hierarchy has a built-in security filter named

Grant All Members that allows access to all

members in the hierarchy.

Except for the built-in security filter, all security filters have a member expression and scope.

The member expression can be any dynamic query expression that returns a member or a

set of members in the given hierarchy. Use the member browser to drag members into the

Cognos Cube Designer security filter expression editor.

Five scope options exist: four Grant options and one Deny option.