Security Model for Analysis Services - Microsoft SQL Server 2008 Analysis Services - page 725

. Use the SQL Server Profiler application to monitor activities within your database. To

see all the activities on the server, you must be a server administrator. You won't see
Discover requests because they are performed as lightweight operations. Evaluating
the permissions involved in every Discover request can slow down server opera-
tions. The Analysis Services designers opted in favor of performance in this case, sac-
rificing the database administrator's ability to see Discover requests.

DataSourcePermission Object
This object is used to set permissions for data source objects. Set the ReadDefinition prop-
erty of the DataSourcePermission object to enable users to see the connection string used
in the data source object and get information about the relational database to which this
data source points.

A data source object enables you to connect to the relational database. If you specify the
ImpersonationMode property of the data source object as the ImpersonateService account,
Analysis Services establishes the connection under the Analysis Services service account.
To allow any data source to be impersonated with the service account, you must have
server administrator privileges.

DimensionPermission Object
The DimensionPermission object defines access to a dimension object. The
ReadDefinition property controls access to the DDL of the dimension. The Process prop-
erty controls whether members of the role can process the dimension.

Browsing the dimension object is not controlled by the Read property. Only database
administrators can browse database dimensions separately from the cube.

Dimension members are typically browsed by accessing a cube from a client application.
The DimensionPermission object provides default security settings for cube dimensions. If
a CubeDimensionPermission object is not specified, Analysis Services uses the
DimensionPermissions object to display cube dimensions.

The AttributePermissions collection enables you to define security for dimension attrib-
utes. (For information about the AttributePermission object, see Chapter 36, “Securing
Dimension Data.”)

CubePermission Object
The CubePermission object defines a set of access permissions for a cube object. To allow
the members of a Database role access to a cube, all you need to do is create a
CubePermission object and set the Read property to Allowed .

The CubePermission object has one property in addition to the set of properties common
to Permission objects. The ReadSourceData property defines whether a user has access to
raw data (not including cube or dimension calculations). This property is intended to
solve the following problem.