Forum Discussion

frankyu's avatar
frankyu
New Contributor II
5 months ago

Switch data access security on users by time

I'm sure this question has been asked before in the forum, but I just couldn't find it in the community. We have this requirement where in the same Actual scenario, Corporate (a group of users) can o...
Metadata
Security
Time
T_Kress's avatar
T_Kress
Contributor III
4 months ago

We ended up landing on the following solution for this use case:

The selected approach is as follows:

  • Set up 12 security groups, one per month
  • Put "Corp Users" security group in those 12 security groups at the beginning of the year
  • Add 12 slices to the cube(s)
  • Once a month remove "Corp Users" from one of the 12 slices at a time (e.g. SLICE M1) to open up their access to each month going forward
  • Once a year update 12 slices on the cube(s) to the next year by changing the T# year in the slices and then adding "Corp Users" back in to 12 security group slices

This option was selected because it does not require an IIS reset (like using Global Time) and it only requires metadata changes once a year since monthly the only change needed is to a security group.

Here are sample slices on the cube:

<cubeDataCellAccessItem category="TEST SLICE WITH TIME M1" description="" accessGroup="SLICE_NO_ACCESS_M1" ScenarioMemberFilter="S#Actual" TimeMemberFilter="T#2021.TreeDescendantsInclusive" behaviorInGroupInFilter="ApplyAccessAndContinue" accessLevelInGroupInFilter="NoAccess" behaviorInGroupNotInFilter="SkipItemAndContinue" accessLevelInGroupNotInFilter="NoAccess" behaviorNotInGroupInFilter="IncreaseAccessAndContinue" accessLevelNotInGroupInFilter="ReadOnly" />
                    <cubeDataCellAccessItem category="TEST SLICE WITH TIME M2" description="" accessGroup="SLICE_NO_ACCESS_M2" ScenarioMemberFilter="S#Actual" TimeMemberFilter="T#2021.TreeDescendantsInclusive.Remove(2021M1)" behaviorInGroupInFilter="ApplyAccessAndContinue" accessLevelInGroupInFilter="NoAccess" behaviorInGroupNotInFilter="SkipItemAndContinue" accessLevelInGroupNotInFilter="NoAccess" behaviorNotInGroupInFilter="IncreaseAccessAndContinue" accessLevelNotInGroupInFilter="ReadOnly" />
                    <cubeDataCellAccessItem category="TEST SLICE WITH TIME M3" description="" accessGroup="SLICE_NO_ACCESS_M3" ScenarioMemberFilter="S#Actual" TimeMemberFilter="T#2021.TreeDescendantsInclusive.Remove(2021M1,2021M2)" behaviorInGroupInFilter="ApplyAccessAndContinue" accessLevelInGroupInFilter="NoAccess" behaviorInGroupNotInFilter="SkipItemAndContinue" accessLevelInGroupNotInFilter="NoAccess" behaviorNotInGroupInFilter="IncreaseAccessAndContinue" accessLevelNotInGroupInFilter="ReadOnly" />
                    <cubeDataCellAccessItem category="TEST SLICE WITH TIME M4" description="" accessGroup="SLICE_NO_ACCESS_M4" ScenarioMemberFilter="S#Actual" TimeMemberFilter="T#2021.TreeDescendantsInclusive.Remove(2021M1,2021M2,2021M3,2021Q1)" behaviorInGroupInFilter="ApplyAccessAndContinue" accessLevelInGroupInFilter="NoAccess" behaviorInGroupNotInFilter="SkipItemAndContinue" accessLevelInGroupNotInFilter="NoAccess" behaviorNotInGroupInFilter="IncreaseAccessAndContinue" accessLevelNotInGroupInFilter="ReadOnly" />
                    <cubeDataCellAccessItem category="TEST SLICE WITH TIME M5" description="" accessGroup="SLICE_NO_ACCESS_M5" ScenarioMemberFilter="S#Actual" TimeMemberFilter="T#2021.TreeDescendantsInclusive.Remove(2021M1,2021M2,2021M3,2021Q1,2021M4)" behaviorInGroupInFilter="ApplyAccessAndContinue" accessLevelInGroupInFilter="NoAccess" behaviorInGroupNotInFilter="SkipItemAndContinue" accessLevelInGroupNotInFilter="NoAccess" behaviorNotInGroupInFilter="IncreaseAccessAndContinue" accessLevelNotInGroupInFilter="ReadOnly" />
                    <cubeDataCellAccessItem category="TEST SLICE WITH TIME M6" description="" accessGroup="SLICE_NO_ACCESS_M6" ScenarioMemberFilter="S#Actual" TimeMemberFilter="T#2021.TreeDescendantsInclusive.Remove(2021M1,2021M2,2021M3,2021Q1,2021M4,2021M5)" behaviorInGroupInFilter="ApplyAccessAndContinue" accessLevelInGroupInFilter="NoAccess" behaviorInGroupNotInFilter="SkipItemAndContinue" accessLevelInGroupNotInFilter="NoAccess" behaviorNotInGroupInFilter="IncreaseAccessAndContinue" accessLevelNotInGroupInFilter="ReadOnly" />
                    <cubeDataCellAccessItem category="TEST SLICE WITH TIME M7" description="" accessGroup="SLICE_NO_ACCESS_M7" ScenarioMemberFilter="S#Actual" TimeMemberFilter="T#2021.TreeDescendantsInclusive.Remove(2021M1,2021M2,2021M3,2021Q1,2021M4,2021M5,2021M6,2021Q2,2021H1)" behaviorInGroupInFilter="ApplyAccessAndContinue" accessLevelInGroupInFilter="NoAccess" behaviorInGroupNotInFilter="SkipItemAndContinue" accessLevelInGroupNotInFilter="NoAccess" behaviorNotInGroupInFilter="IncreaseAccessAndContinue" accessLevelNotInGroupInFilter="ReadOnly" />
                    <cubeDataCellAccessItem category="TEST SLICE WITH TIME M8" description="" accessGroup="SLICE_NO_ACCESS_M8" ScenarioMemberFilter="S#Actual" TimeMemberFilter="T#2021.TreeDescendantsInclusive.Remove(2021M1,2021M2,2021M3,2021Q1,2021M4,2021M5,2021M6,2021Q2,2021H1,2021M7)" behaviorInGroupInFilter="ApplyAccessAndContinue" accessLevelInGroupInFilter="NoAccess" behaviorInGroupNotInFilter="SkipItemAndContinue" accessLevelInGroupNotInFilter="NoAccess" behaviorNotInGroupInFilter="IncreaseAccessAndContinue" accessLevelNotInGroupInFilter="ReadOnly" />
                    <cubeDataCellAccessItem category="TEST SLICE WITH TIME M9" description="" accessGroup="SLICE_NO_ACCESS_M9" ScenarioMemberFilter="S#Actual" TimeMemberFilter="T#2021.TreeDescendantsInclusive.Remove(2021M1,2021M2,2021M3,2021Q1,2021M4,2021M5,2021M6,2021Q2,2021H1,2021M7,2021M8)" behaviorInGroupInFilter="ApplyAccessAndContinue" accessLevelInGroupInFilter="NoAccess" behaviorInGroupNotInFilter="SkipItemAndContinue" accessLevelInGroupNotInFilter="NoAccess" behaviorNotInGroupInFilter="IncreaseAccessAndContinue" accessLevelNotInGroupInFilter="ReadOnly" />
                    <cubeDataCellAccessItem category="TEST SLICE WITH TIME M10" description="" accessGroup="SLICE_NO_ACCESS_M10" ScenarioMemberFilter="S#Actual" TimeMemberFilter="T#2021.TreeDescendantsInclusive.Remove(2021M1,2021M2,2021M3,2021Q1,2021M4,2021M5,2021M6,2021Q2,2021H1,2021M7,2021M8,2021M9,2021Q3)" behaviorInGroupInFilter="ApplyAccessAndContinue" accessLevelInGroupInFilter="NoAccess" behaviorInGroupNotInFilter="SkipItemAndContinue" accessLevelInGroupNotInFilter="NoAccess" behaviorNotInGroupInFilter="IncreaseAccessAndContinue" accessLevelNotInGroupInFilter="ReadOnly" />
                    <cubeDataCellAccessItem category="TEST SLICE WITH TIME M11" description="" accessGroup="SLICE_NO_ACCESS_M11" ScenarioMemberFilter="S#Actual" TimeMemberFilter="T#2021.TreeDescendantsInclusive.Remove(2021M1,2021M2,2021M3,2021Q1,2021M4,2021M5,2021M6,2021Q2,2021H1,2021M7,2021M8,2021M9,2021Q3,2021M10)" behaviorInGroupInFilter="ApplyAccessAndContinue" accessLevelInGroupInFilter="NoAccess" behaviorInGroupNotInFilter="SkipItemAndContinue" accessLevelInGroupNotInFilter="NoAccess" behaviorNotInGroupInFilter="IncreaseAccessAndContinue" accessLevelNotInGroupInFilter="ReadOnly" />
                    <cubeDataCellAccessItem category="TEST SLICE WITH TIME M12" description="" accessGroup="SLICE_NO_ACCESS_M12" ScenarioMemberFilter="S#Actual" TimeMemberFilter="T#2021.TreeDescendantsInclusive.Remove(2021M1,2021M2,2021M3,2021Q1,2021M4,2021M5,2021M6,2021Q2,2021H1,2021M7,2021M8,2021M9,2021Q3,2021M10,2021M11)" behaviorInGroupInFilter="ApplyAccessAndContinue" accessLevelInGroupInFilter="NoAccess" behaviorInGroupNotInFilter="SkipItemAndContinue" accessLevelInGroupNotInFilter="NoAccess" behaviorNotInGroupInFilter="IncreaseAccessAndContinue" accessLevelNotInGroupInFilter="ReadOnly" />

 

 

This solution worked best for this customer and use case.  No metadata changes monthly, only security group changes.  And no IIS reset required for change to take effect.  Once a year maintenance to metadata slices and security groups.