Securing the Cube - Expert Cube Development with SSAS Multidimensional Models - page 281

This task is not generally managed by the developers of the Analysis Services cube, it
is usually handled by someone else such as a network administrator or a DBA whose
job it is to look after the cube once it has gone into production. So, the question is:
how should these people add new users to a role? The answer should not be that
they need to open SSDT or SQL Management Studio and edit the roles directly. If
we have followed our rule to only add Windows groups as role members, it will
be possible to add or remove users purely by adding and removing these members
from domain groups. This will mean that whoever is managing security will not
need administrative access to the cube itself; it will also mean they do not need to
learn how to use potentially unfamiliar tools such as SQL Management Studio.
A different and more complex situation is when the Analysis Services developer
works in a domain that is not the same as the domain where Analysis Services is
installed. In this case, we cannot define the relationship between roles and Windows
groups in SSDT because we do not even have access to the domain where those
roles exist. The only thing we can do is to create empty roles and let whoever is
managing security create associations between roles and groups once the Analysis
Services database has been deployed. What's more, when this happens, we can no
longer deploy our cube from SSDT because doing so would overwrite the properly
configured roles on the server with the empty roles in our solution. Instead, we will
need to use the Analysis Services Deployment Wizard to deploy our solution: it gives
us the option to either deploy only roles that do not exist already on the server, or to
not deploy any of the roles in our solution at all.
Security and query performance
Applying security to a cube comes at a cost to query performance. However, since
we don't usually have a choice about whether to apply security or not, we then
need to understand which security features have the least impact on performance
when choosing which ones to use. In this final section, we'll give some details on the
relative impact on query performance of each type of security.