Forum Discussion

Martin_Gebhartl's avatar
Martin_Gebhartl
New Contributor III
5 months ago

Data Cell Access Security - we don´t get it

Hello,

we need to setup Data Cell Access Security based on our UD1 structure. UD1 defines our Business Unit structure and we need so setup security security on this. I spent days on this but I don´t get it to work the way we need it.

We have consolidation users on different levels in the UD1 hierarchy:

So some users are on to (group level - they need access on all data)

some on divisional level (they should see all data within their division, so divisional level and all business units below) but the need to be restricted to their own division and are not allowed to see data of another dvision or business units which are not part of their division.  

some on business unit level (they need so see all data within their business unit but not from other business units)

and finally entity users: the only should have access to data on their entity/entities.

How can I setup this so that it´sconvenient to maintain and all security need get met?

 

Regards Martin

Metadata
Methodology
Security
  • Henning's avatar
    Henning
    Valued Contributor II
    5 months ago

    Hi Martin, 

    I am not sure I follow the request in its fullest. Maybe an Excel mock-up would help me understand. I understand this as a matrix setup where the main issue is that users need to see all data in a given entity in the entity dimension and other user see only their division (UD1) across all entities.

    The way I have seen this being set up is by first put a No Access step for all users in place on cube security and then grant users access to the individual entities and UD1 divisions piece by piece as needed.

    Keep in mind to use the "And Stop" option when appropriate so that the system does not unnecessarily continue to check. E.g.

     

    • Martin_Gebhartl's avatar
      Martin_Gebhartl
      New Contributor III
      5 months ago

      Hi Henning,

      thanks for you quick reply. Please find a screenshot of our UD1 structure below. Each base Element represents some kind of a business unit which contains at least one entity. Going up the tree there are parent business units, the 4 divisions and on top "group" which represents the holding company. 

      So there are users which need to be restricted to one or more base elements, other users which need to be restricted to a parent business units, others to a division and some to the group. And for each level, all levels below need to be within the access as well.

      Regards

      Martin

       

      • KarlT's avatar
        KarlT
        Contributor III
        5 months ago

        Something to remember is that if the users who need to be able to see the business units want to see all entities, they will need read access to those entities (on the entity security settings).

        In effect, the data access security on the cube cannot give users more access than their entity security does. So if a user needs to see a single business unit across the entire company, you would need to:

        1. Give them Read access to all entities (on entity settings)
        2. As Henning notes, the first item on the Cube Data Access would effectively then remove this access.
        3. Then you gradually add this access back as appropriate

        I hope that makes sense