Database Reference
In-Depth Information
These three expressions let us define which cells in the cube can be read or written
back to: they are evaluated for every cell in the cube and if they return true, we can
read or write to the cell, if they return false, we cannot.
Let's look at an example. If, for example, we check the
Enable read permissions
box
in the
Cell Data
tab in the Role Editor, and enter the following expression into the
Allow reading of cube content
box:
[Sales Territory].[Sales Territory Country].CurrentMember IS [Sales
Territory].[Sales Territory Country].&[Canada]
Then we are stating that the user will be able to see only the cells where
CurrentMember
on the Sales Territory Country hierarchy of the Sales Territory
dimension is Canada. If we query the cube, under this role, we will see this:
There are several interesting things to point out in the preceding screenshot:
•
Even if the role is able to access data only for Canada, users will see that
data for other existing countries. For all the cells the role can't read, the value
returned is
#N/A
; this, however, can be changed by setting the Secured Cell
Value connection string property.
•
Granting access to a Country also grants access to all of the Regions in
that Country. This is because there is an attribute relationship defined
between Country and Region, so when a Region is selected in a query, the
CurrentMember
on Country changes to be the Country that Region is in.
Granting access to members on an attribute therefore grants access to lower
granularity attributes that have a direct or indirect relationship with that
attribute. This does not happen on higher granularity attributes though, so
values for the North America member and the Grand Total (which is the All
Member on the hierarchy) cannot be accessed.
Search WWH ::
Custom Search