Setting the role for a calculated dimension (SSAS Cube) - ssas

The cube (sql Server 2016) contains dimensions [Unit].[Unit].&[1] and [Unit].[Unit].&[2]. I’ve created a calculated dimension:
CREATE MEMBER CURRENTCUBE.[Unit].[Unit].[All].[1/2] AS [Unit].[Unit].&[1]/[Unit].[Unit].&[2]
To restrict access to the dimension of [Unit].[Unit].[All].[1/2] I’ve created the Role.
But I can not select [Unit].[Unit].[All].[1/2] in DimensionData-Basic tab, because this attribute does not appear in the list of attributes.
If I specify the attribute [Unit].[Unit].[All].[1/2] in DimensionData-Advanced tab in the MDX-script Denied member set: {[Unit].[Unit].[All].[1/2]}, the user sees this attribute.
How do I restrict access to the calculated dimension?

If you change your DimUnit SQL table to include a "1/2" row then replace your CREATE MEMBER statement with the following it should work the same and you should be able to see this member in dimension data security after you deploy and process the cube:
([Unit].[Unit].[1/2])
= DIVIDE([Unit].[Unit].&[1], [Unit].[Unit].&[2]);
Then after you have created a role that makes the 1/2 member disappear you will get an error when browsing the cube with that user. Change the above line to the following:
(IIf(IsError(StrToMember("[Unit].[Unit].[1/2]",CONSTRAINED)),Head([Unit].[Unit].Members,0),StrToMember("[Unit].[Unit].[1/2]",CONSTRAINED))
= DIVIDE([Unit].[Unit].&[1], [Unit].[Unit].&[2]);
BTW, DIVIDE does safe divide so divide by zero won't cause problems.
Off the top of my head I can't recall if StrToMember is necessary vs. just a member reference so I played it safe. Feel free to try it without StrToMember.
To be clear the whole script should say:
CALCULATE;
(IIf(IsError(StrToMember("[Unit].[Unit].[1/2]",CONSTRAINED)),Head([Unit].[Unit].Members,0),StrToMember("[Unit].[Unit].[1/2]",CONSTRAINED))
= DIVIDE([Unit].[Unit].&[1], [Unit].[Unit].&[2]);

Related

Masking Dimension attribute / Security in SSAS

We have a cube where we implemented the dimension data level security based on ROLE. This security is working fine where we are restricting the user to see his records only. Now the Customer dimension has another Employee attribute. Based on the value of this field we want to restrict other dimension attributes. Like in the below example Manager_Id is the attribute that should be masked. We want to mask the attribute value of this field with "Employee” so that the restricted user only sees a masked attributes value.
Note: Both the attribute from the same dimension
User is allowed to see employee data
Name Manager_ID
Jon 123456
If the User is not allowed to see then the attribute value needs to be masked with Employee
Eg:
Name Manage_ID
Jon xxxxx
Thanks
Jay
If I'm interpreting your question correctly you're trying to disable a value in a dimension based on the user querying the dimension/cube. Unless you've build your own version of excel where you would add those overrides you should use different roles for the different types of users that use your application.
While I don't know how and if you can mask a value, you can use attribute security to disable the role from viewing the contents of a certain attribute of a dimension.
To do this from SQL Server Management Studio you can open the properties of a role, go to the dimension data tab and select the cube and dimensions you want to filter.
Warning: you can't disable values in a dimension, then the user will still be able to query them, you'll need to scroll down to the cubes and edit the dimension there.
(it's a long list of first your dimensions and then your cubes which can be extended to show the cubedimensions, which are the only thing relevant to us right now)
When you have the correct dimension you can select an attribute Manager_ID in your case and disable all values a user shouldn't be able to see. You can do this by unchecking all restricted values or deselect all members and then click the ones that should be available. That all depends on your useCase.
The result of this will be that when opening the dimension from excel or powerBI the disabled values won't show.
I hope this helps and good luck.

Managing PerformancePoint Filters With Slowly Changing Dimensions

Just a bit of background info:
I have dimension table which uses SCD2 to track user changes in our company (team changes, job title changes etc) See example below:
I've built an Analysis Services Cube and created all the necessary hierarchy's for the dimensions and it works well when navigating and drilling down through the fact table.
The problem I have is with the filters on the PerformancePoint dashboard. As I'm using the User Dimension table with it's multiple instances of users it's showing duplicates up in the list. I can understand why as the surrogate ID is being referenced on the Dimension. But if I choose the first instance of the A-team I will see all their sales for a particular period and if I choose the second instance I will see all their sales for a different period.
What is the best way to handle this type of behavior? Ideally I'd like to see a distinct list of teams in alphabetical order and when I choose the team name it shows all of their data over time.
I've considered using MDX query filters but I'd like to see if there's anything I haven't thought about.
I realise this isn't an easy and quick question but any help would be appreciated!
The answer was simple after having a trawl through my User Dimension table on the Cube.
Under my user dimension I added 2 duplicate attributes to my attributes list ("Team Filter" is a copy of "Team", "User Filter" a copy of "User Name") these will be used only for filtering the dashboard.
Under the attribute properties for each duplicate I then set AttributeHierarchyOptimizedState to "Not Optimized", I also set their AttributeHierarchyVisible to false as I'd shown the two duplicate attributes in the hierarchy window in the middle.
Deploy your Cube to the server and go in to PerformancePoint. Create a new MDX Filter (this image shows the finished filter)
This is the code I used, it only shows dimension members which have a fact against them (reduces the list a considerable amount) and by using allmembers at the dimension it also gives me the option to show "All" at the top of the list.
Deploy the new filters and now you can see the distinct list of users and teams, works perfectly and selects every instance (regardless of the SCD2 row)

SSAS : Unoknow Members still shows on Report Slicer

I have created Dimension - Vendors,Distributors and Time
And I have Fact tables Purchase and Total Paid Amount.
I have also set below properties for Dimension :
UnknownMember : Hidden
and for the Key Column Property
NullProcess : Error
I have also done properly Attribute Relationship on the Cube. So that it is giving me proper result as below.
It is showing values without Unknown Members.
Now, On my report I have put the slicer for the Venders.
And it still shows Unknown as a member. I don't even have any null key in any table.
Anyone has any idea, how to get rid of this unknown member with Best Practices?
I am using SQL Server 2012 with Latest NU update. So that I can create Power View reports using connection on sharepoint site.
Thank you,

Writeback partition secuirty in SSAS

I have a writeback partition working pretty well in a cube. The users access it through Excel 2010. At the moment there are 3 measures in the cube. I'd like to only give users access to writeback to 2 of them while being able to read all 3. Is there a way to accomplish this? I'm very much an MDX novice if MDX is involved. Thanks in advance.
The failproof way to prevent those users from writing to your measure is by including those in a special Role with writeback access. In the tab "Cell Data", check the box "Enable read/write permissions", and in the field below "Allow reading and writing of cube content" you can set an expression to limit the write measures, such as:
(Measures.CurrentMember IS [Measures].[X] OR Measures.CurrentMember IS [Measures].[Y])
In the upper field, that enables read access, allow access to all three measures:
(
Measures.CurrentMember IS [Measures].[X] OR
Measures.CurrentMember IS [Measures].[Y] OR
Measures.CurrentMember IS [Measures].[Z]
)
They will have a weird message saying that the cell was blocked, but at least you'll prevent them from writing to your beloved measure.
Another approach would be: create a Calculated measure ([Measures].[ZZ]) based on the one you want to hide ([Measures].[Z]). SSAS won't let the user writeback on a calculated measure. Make sure you hide the original by marking it VISIBLE = 0.
#mmarie is correct...if the measures are all in the same partition, then you'll need to move the 2 for writeback into a separate measure group. You can do this by creating separate views in the relational DW or via named queries in the DSV. Since both measure groups will have the same dimensionality (because they are based on the same table) SSDT will give you a warning - just ignore it ;-)

Access system tables in calculation

Is there a way to access system tables in a SSAS cube calcuation?
For example the following query can be executed on a SSAS cube to return a last processed date:
SELECT LAST_DATA_UPDATE FROM $System.MDSCHEMA_CUBES WHERE CUBE_NAME = 'Cube'
How would one access this information in a calculation?
Background: We were using ASSP before (a third party sproc) to get the last cube processed date. Recently, this sproc threw an exception on one of our cubes and caused SSAS to go down. Using the above line of MDX did not have this behavior. I would rather not have our cube depend on third party code so I am looking for a way to access LAST_DATA_UPDATE in a calc for a specific cube name.
I usually include a detached Dimension in my cubes e.g. ".Cube Information" which includes attributes like this. Other useful attributes could expose the currency of the data e.g. when did the last underlying ETL process complete, or the release/build of your cube.
I feed this "Cube Information" dimension from a SQL view which returns a single row with whatever data is needed - you could use your SELECT statement. It also needs to return a Key column with a fixed value e.g. 1.
By "detached" I mean the "Cube Information" dimension has no entries in the Cube Dimension Relationship tab.
In the cube Calculation script, I assign the DEFAULT_MEMBER property for that dimension to the fixed Key value from the SSAS view.
Any client tool can then access those Dimension attributes.