Securing Your Data in Analysis Services - Professional SQL Server Analysis Services 2005 with MDX - page 1012

hierarchize (exists ([Employee].[Employee].members,
strtomember
("[Employee].[login].[login].&["+username+"]")),
post).item (0).item (0).parent,
hierarchize (exists ([Employee].[Employee].members,
strtomember
("[Employee].[login].[login].&["+username+"]")),
post).item (0).item (0))
).item (0)
, employee.employee.currentmember))
> 0 ) // Check 2
or
(strcomp (employee.employee.currentmember.properties
("login"),username) =0)
// Check 3
In this expression two checks are performed to give access to the cells for the
employee. The first conditional check (Check 1 AND Check 2) is for providing
access to the aggregated cell for the managers, which involves checking if
the employee corresponding to the current cell has more than two direct re-
ports followed by the second condition (Check 3), which is an OR condition to
allow access to the cells of the employee themselves. The second check
(Check 3) is a simple check to match the employee with the login name be-
cause login is a member property for the employee attribute. The first condi-
tion has two conditional checks, Check 1 and Check 2, which are combined
by a logical AND. By default parent members can see the cell values of their
descendants (Check 2). In order to make sure individual cell values are not
seen by managers, rather just the aggregated cell values can be seen, the
additional conditional check (Check 1) is done in the preceding expression.
If the first argument of the IIF function evaluates to false, the result of the third
argument of the IIF function will be the result of the function. The third argu-
ment is basically the MDX expression to allow regular employees or man-
agers with less than or equal to two direct reports to see their individual re-
sponses of the Poll.