Switch data access security on users by time

[frankyu]

I'm sure this question has been asked before in the forum, but I just couldn't find it in the community. We have this requirement where in the same Actual scenario, Corporate (a group of users) can only access the Actual data after  the actual data is finalized by different entities. Any point of time leading to Day X, the entity has the control to pull the switch on releasing the data access to Corporate. On Day X, all the data is made accessible to Corporate. 

I thought about slice security, but it doesn't seem to accommodate this requirement due to the static nature of the DU filter; neither does Conditional Input, which doesn't control the general data access. Can someone please shed some light here on this design whether it's possible to lock down a group of users by time period? 

[T_Kress]

I am wondering if the Market Place Solution Exchange tool called PCM or Process Control Manager could be an option?  I do not have experience with it but I think it can solve for this need:

Another idea may be to leverage Hybrid Scenario data sharing options.  Perhaps you could have one scenario that is "Working Actuals" and another that is "Final Actuals" and then you hybrid share excluding the current working month.  And then update the current working month once finalized?  

Curious to hear other's thoughts.

[KarlT]

From my experience i don't think PCM would be able to deliver the required result as it is more based around limiting input rather than visibility of the data (i.e. it uses conditional input). But i'll be honest it's been years since i've used it so i could be missing something!

I like the second idea though - i think otherwise you would have to set up the data access slices to point to the current time and simply go and update them each month. Not so bad if we are talking 1 or 2 slices but probably not sensible for any significant number (and open to error). You can point the Data Access to T#Global but this only updates whenever you save the cube settings - so it would require you to go in and re-save it every time the Global time changes, which again feels like it could lead to error.

[FredLucas]

Hi @frankyu,

In case Corporate only needs read access to it, one option you could consider would be to load the data to a POV that Corporate would not have access to, e.g.: U8#Baseline, and then create a dynamicCalc, e.g.: U8#BaselineReporting that would have the logic to show/not show the data loaded against U8#Baseline.

That logic could be driven of a time dependent text attribute flag of the U8#Baseline member, an auxiliary register table, etc. A dashboard could be created to simplify the process of updating the flag.

[T_Kress]

We ended up landing on the following solution for this use case:

The selected approach is as follows:

• Set up 12 security groups, one per month
• Put "Corp Users" security group in those 12 security groups at the beginning of the year
• Add 12 slices to the cube(s)
• Once a month remove "Corp Users" from one of the 12 slices at a time (e.g. SLICE M1) to open up their access to each month going forward
• Once a year update 12 slices on the cube(s) to the next year by changing the T# year in the slices and then adding "Corp Users" back in to 12 security group slices

This option was selected because it does not require an IIS reset (like using Global Time) and it only requires metadata changes once a year since monthly the only change needed is to a security group.

Here are sample slices on the cube:

<cubeDataCellAccessItem category="TEST SLICE WITH TIME M1" description="" accessGroup="SLICE_NO_ACCESS_M1" ScenarioMemberFilter="S#Actual" TimeMemberFilter="T#2021.TreeDescendantsInclusive" behaviorInGroupInFilter="ApplyAccessAndContinue" accessLevelInGroupInFilter="NoAccess" behaviorInGroupNotInFilter="SkipItemAndContinue" accessLevelInGroupNotInFilter="NoAccess" behaviorNotInGroupInFilter="IncreaseAccessAndContinue" accessLevelNotInGroupInFilter="ReadOnly" />
                    <cubeDataCellAccessItem category="TEST SLICE WITH TIME M2" description="" accessGroup="SLICE_NO_ACCESS_M2" ScenarioMemberFilter="S#Actual" TimeMemberFilter="T#2021.TreeDescendantsInclusive.Remove(2021M1)" behaviorInGroupInFilter="ApplyAccessAndContinue" accessLevelInGroupInFilter="NoAccess" behaviorInGroupNotInFilter="SkipItemAndContinue" accessLevelInGroupNotInFilter="NoAccess" behaviorNotInGroupInFilter="IncreaseAccessAndContinue" accessLevelNotInGroupInFilter="ReadOnly" />
                    <cubeDataCellAccessItem category="TEST SLICE WITH TIME M3" description="" accessGroup="SLICE_NO_ACCESS_M3" ScenarioMemberFilter="S#Actual" TimeMemberFilter="T#2021.TreeDescendantsInclusive.Remove(2021M1,2021M2)" behaviorInGroupInFilter="ApplyAccessAndContinue" accessLevelInGroupInFilter="NoAccess" behaviorInGroupNotInFilter="SkipItemAndContinue" accessLevelInGroupNotInFilter="NoAccess" behaviorNotInGroupInFilter="IncreaseAccessAndContinue" accessLevelNotInGroupInFilter="ReadOnly" />
                    <cubeDataCellAccessItem category="TEST SLICE WITH TIME M4" description="" accessGroup="SLICE_NO_ACCESS_M4" ScenarioMemberFilter="S#Actual" TimeMemberFilter="T#2021.TreeDescendantsInclusive.Remove(2021M1,2021M2,2021M3,2021Q1)" behaviorInGroupInFilter="ApplyAccessAndContinue" accessLevelInGroupInFilter="NoAccess" behaviorInGroupNotInFilter="SkipItemAndContinue" accessLevelInGroupNotInFilter="NoAccess" behaviorNotInGroupInFilter="IncreaseAccessAndContinue" accessLevelNotInGroupInFilter="ReadOnly" />
                    <cubeDataCellAccessItem category="TEST SLICE WITH TIME M5" description="" accessGroup="SLICE_NO_ACCESS_M5" ScenarioMemberFilter="S#Actual" TimeMemberFilter="T#2021.TreeDescendantsInclusive.Remove(2021M1,2021M2,2021M3,2021Q1,2021M4)" behaviorInGroupInFilter="ApplyAccessAndContinue" accessLevelInGroupInFilter="NoAccess" behaviorInGroupNotInFilter="SkipItemAndContinue" accessLevelInGroupNotInFilter="NoAccess" behaviorNotInGroupInFilter="IncreaseAccessAndContinue" accessLevelNotInGroupInFilter="ReadOnly" />
                    <cubeDataCellAccessItem category="TEST SLICE WITH TIME M6" description="" accessGroup="SLICE_NO_ACCESS_M6" ScenarioMemberFilter="S#Actual" TimeMemberFilter="T#2021.TreeDescendantsInclusive.Remove(2021M1,2021M2,2021M3,2021Q1,2021M4,2021M5)" behaviorInGroupInFilter="ApplyAccessAndContinue" accessLevelInGroupInFilter="NoAccess" behaviorInGroupNotInFilter="SkipItemAndContinue" accessLevelInGroupNotInFilter="NoAccess" behaviorNotInGroupInFilter="IncreaseAccessAndContinue" accessLevelNotInGroupInFilter="ReadOnly" />
                    <cubeDataCellAccessItem category="TEST SLICE WITH TIME M7" description="" accessGroup="SLICE_NO_ACCESS_M7" ScenarioMemberFilter="S#Actual" TimeMemberFilter="T#2021.TreeDescendantsInclusive.Remove(2021M1,2021M2,2021M3,2021Q1,2021M4,2021M5,2021M6,2021Q2,2021H1)" behaviorInGroupInFilter="ApplyAccessAndContinue" accessLevelInGroupInFilter="NoAccess" behaviorInGroupNotInFilter="SkipItemAndContinue" accessLevelInGroupNotInFilter="NoAccess" behaviorNotInGroupInFilter="IncreaseAccessAndContinue" accessLevelNotInGroupInFilter="ReadOnly" />
                    <cubeDataCellAccessItem category="TEST SLICE WITH TIME M8" description="" accessGroup="SLICE_NO_ACCESS_M8" ScenarioMemberFilter="S#Actual" TimeMemberFilter="T#2021.TreeDescendantsInclusive.Remove(2021M1,2021M2,2021M3,2021Q1,2021M4,2021M5,2021M6,2021Q2,2021H1,2021M7)" behaviorInGroupInFilter="ApplyAccessAndContinue" accessLevelInGroupInFilter="NoAccess" behaviorInGroupNotInFilter="SkipItemAndContinue" accessLevelInGroupNotInFilter="NoAccess" behaviorNotInGroupInFilter="IncreaseAccessAndContinue" accessLevelNotInGroupInFilter="ReadOnly" />
                    <cubeDataCellAccessItem category="TEST SLICE WITH TIME M9" description="" accessGroup="SLICE_NO_ACCESS_M9" ScenarioMemberFilter="S#Actual" TimeMemberFilter="T#2021.TreeDescendantsInclusive.Remove(2021M1,2021M2,2021M3,2021Q1,2021M4,2021M5,2021M6,2021Q2,2021H1,2021M7,2021M8)" behaviorInGroupInFilter="ApplyAccessAndContinue" accessLevelInGroupInFilter="NoAccess" behaviorInGroupNotInFilter="SkipItemAndContinue" accessLevelInGroupNotInFilter="NoAccess" behaviorNotInGroupInFilter="IncreaseAccessAndContinue" accessLevelNotInGroupInFilter="ReadOnly" />
                    <cubeDataCellAccessItem category="TEST SLICE WITH TIME M10" description="" accessGroup="SLICE_NO_ACCESS_M10" ScenarioMemberFilter="S#Actual" TimeMemberFilter="T#2021.TreeDescendantsInclusive.Remove(2021M1,2021M2,2021M3,2021Q1,2021M4,2021M5,2021M6,2021Q2,2021H1,2021M7,2021M8,2021M9,2021Q3)" behaviorInGroupInFilter="ApplyAccessAndContinue" accessLevelInGroupInFilter="NoAccess" behaviorInGroupNotInFilter="SkipItemAndContinue" accessLevelInGroupNotInFilter="NoAccess" behaviorNotInGroupInFilter="IncreaseAccessAndContinue" accessLevelNotInGroupInFilter="ReadOnly" />
                    <cubeDataCellAccessItem category="TEST SLICE WITH TIME M11" description="" accessGroup="SLICE_NO_ACCESS_M11" ScenarioMemberFilter="S#Actual" TimeMemberFilter="T#2021.TreeDescendantsInclusive.Remove(2021M1,2021M2,2021M3,2021Q1,2021M4,2021M5,2021M6,2021Q2,2021H1,2021M7,2021M8,2021M9,2021Q3,2021M10)" behaviorInGroupInFilter="ApplyAccessAndContinue" accessLevelInGroupInFilter="NoAccess" behaviorInGroupNotInFilter="SkipItemAndContinue" accessLevelInGroupNotInFilter="NoAccess" behaviorNotInGroupInFilter="IncreaseAccessAndContinue" accessLevelNotInGroupInFilter="ReadOnly" />
                    <cubeDataCellAccessItem category="TEST SLICE WITH TIME M12" description="" accessGroup="SLICE_NO_ACCESS_M12" ScenarioMemberFilter="S#Actual" TimeMemberFilter="T#2021.TreeDescendantsInclusive.Remove(2021M1,2021M2,2021M3,2021Q1,2021M4,2021M5,2021M6,2021Q2,2021H1,2021M7,2021M8,2021M9,2021Q3,2021M10,2021M11)" behaviorInGroupInFilter="ApplyAccessAndContinue" accessLevelInGroupInFilter="NoAccess" behaviorInGroupNotInFilter="SkipItemAndContinue" accessLevelInGroupNotInFilter="NoAccess" behaviorNotInGroupInFilter="IncreaseAccessAndContinue" accessLevelNotInGroupInFilter="ReadOnly" />

This solution worked best for this customer and use case.  No metadata changes monthly, only security group changes.  And no IIS reset required for change to take effect.  Once a year maintenance to metadata slices and security groups.