Filter Cube Data

Hi

i am using pivot table 11 to display the data from SSAS Cube. the problem is

1- pivot table fetches all the data and display it according to the design. but what i need is

a- the user could only see the data which was posted by himself.

b. He must be unaware of the data posted by other users.

in database table there is a field named userId which is also which is part of dimenssion in myCube.

i dont want to use filteraxes for this purpose actually i want the user to be unaware of other users of system also

any single helping word will be appriciated

Regards

Salman Bashir

Hi Salman,

You can define custom dimension security rules for the "UserID" attribute - the MDX function: UserName (which returns "domain\user") is typically used for this purpose:

http://msdn2.microsoft.com/en-us/library/ms175366.aspx

>>

SQL Server 2005 Books Online

Granting Custom Access to Dimension Data

...

Understanding the IsAllowed Property

The IsAllowed property determines whether the database role can access attribute members. By default, a database role that has access to a dimension cannot access attribute hierarchies.

Understanding the AllowedSet Property

The AllowedSet property uses a Multidimensional Expressions (MDX) expression to determine which attribute members can be viewed by the database role (the allowed set). The allowed set can include no (default), all, or some attribute members. If you allow access to an attribute and do not define any members of the allowed set, access to all members is granted. If you allow access to an attribute and define a specific set of attribute members, only the specifically allowed members are visible. Specifically defining an allowed set may limit the visibility of attribute members added after the allowed set is defined.

...

Understanding the VisualTotals Property

The VisualTotals property indicates whether the aggregated cell values that are displayed are calculated according to all cell values or only according to the cell values that are visible to the database role.

By default, the VisualTotals property is disabled (set to False). This default setting maximizes performance because Analysis Services can quickly calculate the total of all cell values, instead of having to spend time selecting which cells values to calculate.

However, having the VisualTotals property disabled could create a security issue if a user can use the aggregated cell values to deduce values for attribute members to which the user's database role does not have access. For example, Analysis Services uses the values for three attribute members to calculate an aggregated cell value. The database role has access to view two of these three attribute members. Using the aggregated cell value, a member of this database role would be able to deduce the value for the third attribute member.

If a user can deduce values for attribute members to which the user's database role does not have access, security best practice dictates that you enable (set to True) the VisualTotals property for the attribute. When you enable the VisualTotals property, a database role can only view aggregated totals for dimension members to which the role has permission. For example, enabling the VisualTotals property means that the database role will see an aggregated total that includes only those states (that is, members of the State attribute) that are visible to the role. The aggregated total will not include the values for all states.

Understanding the DefaultMember Property

The DefaultMember property determines the data set that is returned to a client when an attribute is not explicitly included in a query. When the attribute is not explicitly included, Analysis Services uses one of the following default members for the attribute:

If the database role defines a default member for the attribute, Analysis Services uses this default member.
If the database role does not define a default member for the attribute, Analysis Services uses the default member that is defined for the attribute itself. The default member for an attribute, unless you specify otherwise, is the All member (unless the attribute is defined as non-aggregatable).
|||

Dear sir

i am really thankful to you for your such a quick reply. it is no doubt very much helpful but my requirments are a bit different

i have custom role management system and i dont use the roles and user accounts in operating system but there are roles which are defined in my personal database and there are user accounts under those roles.

whenever a user inserts a record in database it leaves a refference tag (His LoginName (which is from a table named users in the same database and have no relation with os or domain users) with that record) which identify that which user is owner of that record.

when user sign in with my application (basically with my own role management system) a global reference to his LoginName (which is from User table in my role management system) is created when his session starts. now from this application he opens a form on which a pivot table is placed which is getting data from the cube (whose datasource is the database i defined in 2nd paragraph) now i want pivot table to send a LoginNameas parameter and cube send back the data with this username and all calculations must be performed on this filter data

|||

Actually, dynamic dimension data security as described above should still work - if you set the SSAS "CustomData" connection property to the custom "LoginName" managed by your app. Then you would access the user "LoginName" via the "CustomData" MDX function:

http://msdn2.microsoft.com/en-us/library/ms145582.aspx

>>

SQL Server 2005 Books Online

CustomData (MDX)

Updated: 17 July 2006

Returns the value of the CustomData connection string property if defined; otherwise, null.

...

For example, this function can be used in a dynamic security expression to select the allowed/denied set members for the string value in the CustomData connection string property.

>>

|||

Hi Salman,

were you able to figure out the solution. if yes could you please post you example details.

Thanks

Milind

|||

I am also having the same problem of filtering the cube data based on users defined in a database. were you able to find a solution for this?

Thanks,

Maximus11

Filter Cube Data

Hi

i am using pivot table 11 to display the data from SSAS Cube. the problem is

1- pivot table fetches all the data and display it according to the design. but what i need is

a- the user could only see the data which was posted by himself.

b. He must be unaware of the data posted by other users.

in database table there is a field named userId which is also which is part of dimenssion in myCube.

i dont want to use filteraxes for this purpose actually i want the user to be unaware of other users of system also

any single helping word will be appriciated

Regards

Salman Bashir

Hi Salman,

You can define custom dimension security rules for the "UserID" attribute - the MDX function: UserName (which returns "domain\user") is typically used for this purpose:

http://msdn2.microsoft.com/en-us/library/ms175366.aspx

>>

SQL Server 2005 Books Online

Granting Custom Access to Dimension Data

...

Understanding the IsAllowed Property

The IsAllowed property determines whether the database role can access attribute members. By default, a database role that has access to a dimension cannot access attribute hierarchies.

Understanding the AllowedSet Property

The AllowedSet property uses a Multidimensional Expressions (MDX) expression to determine which attribute members can be viewed by the database role (the allowed set). The allowed set can include no (default), all, or some attribute members. If you allow access to an attribute and do not define any members of the allowed set, access to all members is granted. If you allow access to an attribute and define a specific set of attribute members, only the specifically allowed members are visible. Specifically defining an allowed set may limit the visibility of attribute members added after the allowed set is defined.

...

Understanding the VisualTotals Property

The VisualTotals property indicates whether the aggregated cell values that are displayed are calculated according to all cell values or only according to the cell values that are visible to the database role.

By default, the VisualTotals property is disabled (set to False). This default setting maximizes performance because Analysis Services can quickly calculate the total of all cell values, instead of having to spend time selecting which cells values to calculate.

However, having the VisualTotals property disabled could create a security issue if a user can use the aggregated cell values to deduce values for attribute members to which the user's database role does not have access. For example, Analysis Services uses the values for three attribute members to calculate an aggregated cell value. The database role has access to view two of these three attribute members. Using the aggregated cell value, a member of this database role would be able to deduce the value for the third attribute member.

If a user can deduce values for attribute members to which the user's database role does not have access, security best practice dictates that you enable (set to True) the VisualTotals property for the attribute. When you enable the VisualTotals property, a database role can only view aggregated totals for dimension members to which the role has permission. For example, enabling the VisualTotals property means that the database role will see an aggregated total that includes only those states (that is, members of the State attribute) that are visible to the role. The aggregated total will not include the values for all states.

Understanding the DefaultMember Property

The DefaultMember property determines the data set that is returned to a client when an attribute is not explicitly included in a query. When the attribute is not explicitly included, Analysis Services uses one of the following default members for the attribute:

If the database role defines a default member for the attribute, Analysis Services uses this default member.

If the database role does not define a default member for the attribute, Analysis Services uses the default member that is defined for the attribute itself. The default member for an attribute, unless you specify otherwise, is the All member (unless the attribute is defined as non-aggregatable).
|||

Dear sir

i am really thankful to you for your such a quick reply. it is no doubt very much helpful but my requirments are a bit different

i have custom role management system and i dont use the roles and user accounts in operating system but there are roles which are defined in my personal database and there are user accounts under those roles.

whenever a user inserts a record in database it leaves a refference tag (His LoginName (which is from a table named users in the same database and have no relation with os or domain users) with that record) which identify that which user is owner of that record.

when user sign in with my application (basically with my own role management system) a global reference to his LoginName (which is from User table in my role management system) is created when his session starts. now from this application he opens a form on which a pivot table is placed which is getting data from the cube (whose datasource is the database i defined in 2nd paragraph) now i want pivot table to send a LoginNameas parameter and cube send back the data with this username and all calculations must be performed on this filter data

|||

Actually, dynamic dimension data security as described above should still work - if you set the SSAS "CustomData" connection property to the custom "LoginName" managed by your app. Then you would access the user "LoginName" via the "CustomData" MDX function:

http://msdn2.microsoft.com/en-us/library/ms145582.aspx

>>

SQL Server 2005 Books Online

CustomData (MDX)

Updated: 17 July 2006

Returns the value of the CustomData connection string property if defined; otherwise, null.

...

For example, this function can be used in a dynamic security expression to select the allowed/denied set members for the string value in the CustomData connection string property.

>>

|||

Hi Salman,

were you able to figure out the solution. if yes could you please post you example details.

Thanks

Milind

|||

I am also having the same problem of filtering the cube data based on users defined in a database. were you able to find a solution for this?

Thanks,

Maximus11

Filter and Except Function

Can any one quickly explain me the difference between the two?

I have a cube which contains dimensions such as REGION , MARKET,PRODUCT etc. While I cretaed this cube the ALL level was populated in cube as I did not have any control over it. I want to access the OLAP data with the MDX. I am trying something like this but its not working.Any suggestions?

strSource = "With "
strSource = strSource & " member REGION.region_all as 'aggregate({except({[REGION].members},{[REGION].[ALL]})})'"
strSource = strSource & " member market.market_all as 'aggregate({except({[market].members},{[market].[ALL]})})'"
strSource = strSource & " member PRODUCT.product_all as 'aggregate({except({[PRODUCT].members},{[PRODUCT].[ALL]})})'"
strSource = strSource & "SELECT "
strSource = strSource & "{[Measures].members} ON COLUMNS,"
strSource = strSource & _
"NON EMPTY [METRIC].members ON ROWS"
strSource = strSource & " FROM ocwcube"
strSource = strSource & " where (region_all,market_all ,product_all)"
Debug.Print strSource

Can you describe the desired layout of results in more detail - it's not clear what you want from the above code? Also, for simplicity, you might want to first debug the MDX query in a tool like Management Studio, then develop the code to construct it.sql

Filegroup is full error

Hello,
This is a server post even though I mention Analysis Services!
I am getting an error as follows when I try to process a cube:
Data source provider error: Could not allocate space for object '(SYSTEM
table id: -76163232)' in database 'TEMPDB' because the 'DEFAULT' filegroup is
full.;42000; Time:16/11/2004 7:05:34 PM
It looks like a SQL Server problem rather than AS.
The TEMPDB data file and transaction log are set on automatically grow and
unrestricted growth, and there is plenty of overall disk space (it's on a
RAID system).
Any ideas as to what the problem might be? Does the number 42000 mean
anything? A bad stripe has been suggested (i.e. hardware). I am going to
try adding another file to the PRIMARY filegroup but beyond that I am a bit
lost.
Hope someone can help.
LesSometimes it can not grow fast enough. Don't rely on autogrow if you know
you need more space. Manually grow the file(s) in that filegroup and try
again.
--
Andrew J. Kelly SQL MVP
"Les Russell" <LesRussell@.discussions.microsoft.com> wrote in message
news:8157C0BC-32E4-4C9C-85AF-50D8683A829B@.microsoft.com...
> Hello,
> This is a server post even though I mention Analysis Services!
> I am getting an error as follows when I try to process a cube:
> Data source provider error: Could not allocate space for object '(SYSTEM
> table id: -76163232)' in database 'TEMPDB' because the 'DEFAULT' filegroup
> is
> full.;42000; Time:16/11/2004 7:05:34 PM
> It looks like a SQL Server problem rather than AS.
> The TEMPDB data file and transaction log are set on automatically grow and
> unrestricted growth, and there is plenty of overall disk space (it's on a
> RAID system).
> Any ideas as to what the problem might be? Does the number 42000 mean
> anything? A bad stripe has been suggested (i.e. hardware). I am going to
> try adding another file to the PRIMARY filegroup but beyond that I am a
> bit
> lost.
> Hope someone can help.
> Les|||I had the same thing a while back if Im not mistaken. What it came out to be
was that tempdb couldnt grow fast enough to keep up with the demands. I
increased the size to 100 megs and havent had the problem since.
"Les Russell" <LesRussell@.discussions.microsoft.com> wrote in message
news:8157C0BC-32E4-4C9C-85AF-50D8683A829B@.microsoft.com...
> Hello,
> This is a server post even though I mention Analysis Services!
> I am getting an error as follows when I try to process a cube:
> Data source provider error: Could not allocate space for object '(SYSTEM
> table id: -76163232)' in database 'TEMPDB' because the 'DEFAULT' filegroup
is
> full.;42000; Time:16/11/2004 7:05:34 PM
> It looks like a SQL Server problem rather than AS.
> The TEMPDB data file and transaction log are set on automatically grow and
> unrestricted growth, and there is plenty of overall disk space (it's on a
> RAID system).
> Any ideas as to what the problem might be? Does the number 42000 mean
> anything? A bad stripe has been suggested (i.e. hardware). I am going to
> try adding another file to the PRIMARY filegroup but beyond that I am a
bit
> lost.
> Hope someone can help.
> Les|||Andrew,
Thanks to you and ChrisR. I think you are right.
I have redesigned the cube so that it is smaller, and it is OK now, but I
will check up how to grow the file manually for future reference.
Les

File system error in created local cubes

Hi everyone,

I have created a stored procedure in SQL 2005 which will create (sliced) local cubes using the CREATE GLOBAL CUBE (MDX) statement. This procedure will be started from a SSIS package which is deployed on the same server. A SQL server login with sysadmin permissions can start this SSIS package and create multiple (sliced) off line cubes on the file system.

Everything seems to work fine and no errors where raised during execution. However when I try to open the .cub file in ProClarity 6.2, or even Excel, I get the following message. "File System Error: An error occurred while opening the <file path and name> local cube file."

The strange thing is...., whenever I exectue this package using a domain account with admin permission, the cube file turns out fine.

Furthermore the same package works just fine in our test enviroment. (32 bit virtual server)

The machine that is causing these symptoms is a 64 bit server. Logically I suspected the difference between these enviroments could be a cause. I have tried to narrow the possibilities down to just the creation of off line cubes (and SSAS).

Could security be the cause of this problem? If so, what to do?

Have you checked the file permissions on the .cub file? Try explicitly granting access to the user account that you are running ProClarity or Excel under.|||

Also make sure when you try and open local cube you got correct version of AS OLEDB provider installed.

You can get it from http://www.microsoft.com/downloads/details.aspx?familyid=50b97994-8453-4998-8226-fa42ec403d17&displaylang=en

Edward.
--
This posting is provided "AS IS" with no warranties, and confers no rights.

|||

Hi everyone,

Thanks a lot for your replies. I have found the cause of the problem. As stated before we use a stored procedure to execute a package. However on a 64 bit server command "dtexec" has two versions. One for 32 bit which is installes on the folder "Program Files (x86)" and a 64 bit version which is installed on folder "Program Files". Is T-SQL adresses dtexec from a stored procedure it will by default use the 64 bit version. This was the cause of the problem and not security or Analysis Services.

To solve this, please execute the "dtexec" by using the full path ("Program Files (x86)") and referring to the version you want to use.

For this reason, this post is not directly related to Analysis Services. Appologies for any inconvenience.

With kind regards,

Wan Chi

file name or extension is too long

Hi All,
I am receiving the following message when I run Dts package which is
creating a cube.

Error Source : Microsoft Data transmission Services (DTS)
Package
Error Description: File name or extension is too long

Any help will be appreciated!
Thanks in advance,
Mohammed Sarwar
Ocp dba oracle 9i,8i,8.0

*** Sent via Developersdex http://www.developersdex.com ***
Don't just participate in USENET...get rewarded for it!Mohammed Sarwar <msarwar@.ubid.com> wrote in message news:<3fb3f814$0$193$75868355@.news.frii.net>...
> Hi All,
> I am receiving the following message when I run Dts package which is
> creating a cube.
> Error Source : Microsoft Data transmission Services (DTS)
> Package
> Error Description: File name or extension is too long
> Any help will be appreciated!
> Thanks in advance,
> Mohammed Sarwar
> Ocp dba oracle 9i,8i,8.0
>
> *** Sent via Developersdex http://www.developersdex.com ***
> Don't just participate in USENET...get rewarded for it!

You didn't mention which version of SQL Server you have, but if it's
7, then this KB article may apply to you:

http://support.microsoft.com/defaul...kb;en-us;243545

If the article isn't helpful, then you should post some more
information - your version of SQL Server, which step the package is
failing on etc. You might also want to post to
microsoft.public.sqlserver.dts.

Simon