SSAs-Impact of role settings on xmla

 

 

Roles

Before discussing how the newly created role affects the xmla code of the oalkaline database, let's briefly describe the role in SSAs. The following is a role editing interface. Although it has seven option configuration interfaces (not discussed about the mining structure Interface), all of them can be classified into three categories:

1.Read defined Permissions

A person with this permission can connect to the OLAP database, and then it will see the dimension and cube at the database level, but it cannot do anything else.

2.Database processing Permissions

A person with this permission can process multi-dimensional database objects, but cannot view data, because the process database first needs to see the database objects, therefore, the read definition and processing permissions are granted to the role that needs to process the permissions at the same time.

3.Read data permission

Users with this permission can read the data of OLAP database objects. OLAP databases only have data objects.DimensionAndCubeTherefore, the so-called data read permission is cube data and Dimension Data. Number below1The marked option window allows us to set permissions on the coarse granularity of the corresponding object. If cube is used, whether the user can access the data of a cube is required, for dimensions, it is whether the user can access the data of a certain dimension.2The marked option window allows us to control permissions in fine granularity. For cube, we can control the cell data of a cube, and for dimension, we can control a certain dimension.HierarchyOr even a hierarchyMember:

650) This. width = 650; "src =" http://s3.51cto.com/wyfs02/M00/4C/31/wKiom1Q4ptOTvKpwAADkEaA3Uwo700.jpg "Title =" 1.png" alt = "wkiom1q4ptotvkpwaadkeaa3uwo700.jpg"/>

The access permissions of dimension data are compared, because dimensions belong to OLAP databases first.OLAP dimensionBut each cube references the used OLAP dimension, so the cube level also hasCube dimensionSo you can set the permissions of the dimension and dimension members at these two levels, as shown in.

Through the above instructions, we will understand why the database-level dimension access permissions cannot be set after the "readdefinition" option is selected, read Definition specifies that the user can view all database dimensions (only the dimension can be viewed, but not necessarily the data of the dimension). Therefore, the dimension option window cannot be changed.

650) This. width = 650; "src =" http://s3.51cto.com/wyfs02/M01/4C/32/wKioL1Q4pxawXc9eAADXPxsq1kI438.jpg "Title =" 2.png" alt = "wkiol1q4pxawxc9eaadxpxsq1ki438.jpg"/>

Role impact on xmla

Assume that the current OLAP database has a cube named olapinfor, which has a date dimension and a partition dimension. If you want to view the xmla script of the cube, there is no permission code in it.

Cube and cell Permissions

First, create a user named commonuser, attach the readdefinition permission to the user, and pay the read permission to the role on the cube tab:

650) This. width = 650; "src =" http://s3.51cto.com/wyfs02/M01/4C/31/wKiom1Q4pufQLf7GAADdLll8JC0712.jpg "Title =" 3.png" alt = "wkiom1q4pufqlf7gaaddlll8jc0712.jpg"/>

Now, check the xmla script of the cube and you will find that there is an additional <cubepermissions> label in the script, where each <Cubepermission> Indicates a role. For the current commonrole role with the permission to read the cube, its content is as follows:

650) This. width = 650; "src =" http://s3.51cto.com/wyfs02/M02/4C/31/wKiom1Q4pu_R-fBFAADgjA5HiHg961.jpg "Title =" 4.png" alt = "wKiom1Q4pu_R-fBFAADgjA5HiHg961.jpg"/>

Then, modify the configuration on the cell data interface and view the xmla script of the cube.CubedimensionOne more tagCellpermissionsTags:

650) This. width = 650; "src =" http://s3.51cto.com/wyfs02/M02/4C/31/wKiom1Q4pvbBxvKeAAFKW7TBHAY308.jpg "Title =" 5.png" alt = "wkiom1q4pvbbxvkeaafkw7tbhay308.jpg"/>

Dimension and Dimension member Permissions

We can set this role in the dimension options window to only see the partition dimension. As we mentioned earlier, we can set this permission at the database level or cube dimension level. If it is a database dimension, it will affect the xmla role of the dimension but has no impact on the script of the cube. We will find the following section in the xmla script of the partition dimension:

650) This. width = 650; "src =" http://s3.51cto.com/wyfs02/M00/4C/32/wKioL1Q4pzaAyityAAE44iKilEE998.jpg "Title =" 6.png" alt = "wkiol1q4pzaayityaae44ikilee998.jpg"/>

If we set the access permission for the partition dimension of the olapinfor cube, we will find the following code in the xmla script of the cube:

650) This. width = 650; "src =" http://s3.51cto.com/wyfs02/M01/4C/32/wKioL1Q4pz7xWliCAAF3ZYFJwSU532.jpg "Title =" 7.png" alt = "wkiol1q4pz7xwlicaaf3zyf%su532.jpg"/>

The same applies to Dimension member settings. If the Dimension member is set for the database, the xmla script for the corresponding database dimension is affected. If the Dimension member is set for the cube, The xmla script for the cube is affected.

 

SSAs-Impact of role settings on xmla