Database Reference
In-Depth Information
Dynamic security
Dynamic security can slow down the process of connecting to a cube if the MDX
expressions we're using to determine what data a user can see take a long time to
be evaluated. In almost all cases, a purely data-driven approach, where security
information is stored within the cube itself, will perform noticeably better than
approaches that use Analysis Services Stored Procedures, so this another good
reason to avoid using Stored Procedures for security.
Dynamic dimension security also completely prevents Analysis Services from
sharing values in the Formula Engine cache between users. Unlike regular dimension
security, with Dynamic dimension security, a user can never access values in the
Formula Engine cache that are there as a result of queries run by other users. As
a result, on cubes with very complex calculations, we recommend you try to use
regular dimension security unless the number of roles that would be required is
genuinely too many to manage.
Summary
In this chapter, we have learned that:
•
The only form of authentication supported by Analysis Services is Windows
authentication. If access need to be granted from outside the domain the
Analysis Services server belongs to, it is possible to configure HTTP access to
Analysis Services via IIS.
•
Analysis Services security is based on roles. Only Windows users and groups
can be members of roles.
•
If a user belongs to multiple roles, they will have all of the permissions
granted to them by every role they are a member of; there is no concept of
"deny wins over grant".
•
We can use Cell security to secure individual cell values within the cube. Cell
security can cause poor query performance and should only be used if there
is no other option.
•
Dimension security lets us allow or deny access to members on a hierarchy.
Using the Enable Visual Totals option then controls whether values at higher
granularities are calculated based on all of the members on the hierarchy or
just the members that the user has access to.
Search WWH ::
Custom Search