Databases Reference
In-Depth Information
Server
Administrators
Role
Database
Database
permissions
Role
Dimension
Attribute
Dimension
permissions
Attribute
permissions
Cube
CubeDimension
Cube
permissions
CubeDimension
permissions
FIGURE 36.5
This hierarchy of objects used to define dimension security.
the set included in the
AllowedSet
properties of other attributes. For example, if you
define dimension security on the
State
attribute of the
Customer
dimension of the
FoodMart 2008 database by setting an
AllowedSet
property to
{[WA]}
, members of the
Country
attribute that exist with member
WA
—
[USA]
—is allowed, and other members are
denied. For the
City
attribute, members that exist with member
WA
—cities in Washington
state—are allowed, and cities in other states are denied. This rule enables you to allow a
member, its descendants, and its ancestors. Figure 36.6 shows members of the
Customer
dimension and attributes to which they belong. Members allowed by dimension security
are shaded.
When you define a
DeniedSet
property on an
AttributePermission
object, it affects
members of other attributes in a slightly different way from that of the
AllowedSet
prop-
erty. Members of the attributes to which the current attribute is not directly or indirectly
related are not affected by the
DeniedSet
property. (Related attributes are those on top of
the current attribute; for example,
Country
is related to
State
, but
State
is not related to
Country
.) However, members of the attributes to which the current attribute is related are
restricted if they exist with members of the set defined by the
DeniedSet
property. This
rule enables you to deny the member and its descendants but still allow its ancestors.
Search WWH ::
Custom Search