Securing Dimension Data - Microsoft SQL Server 2008 Analysis Services - page 730

direct reports. With cell security defined to support such a model, Ann would see the
report shown in Figure 36.4.

Salary Sales

ALL 13,500 1,250

Ann 4,000 400

Nancy 1,000 100

To m 2,000 200

John N/A 200

Bob N/A 150

Susann N/A 200

FIGURE 36.4 Cell security allows Ann to see employees reporting to John, but not the values
of their salaries. However, the Salary value for the member ALL contains the total for all
employees and doesn't reflect cell security.

Defining Dimension Security

Dimension security fits in the role-based security model that we discussed in Chapter 35,
“Security Model for Analysis Services.” For each role, you define the dimension members
that you either allow or deny access to. You can also specify whether you want the total
values to include values corresponding to members denied by dimension security.

You can define dimension security for a database dimension or for a cube dimension (if
you want dimensions of different cubes to have different security settings). On the server,
you define dimension security by a collection of AttributePermission objects associated
with either a DimensionPermission object or CubeDimensionPermission object, as shown
in Figure 36.5.

AttributePermission is a minor object. In addition to the standard properties of most
Analysis Services objects, such as Name , ID , Description , and Annotation , the
AttributePermission object has the properties shown in Table 36.1.