Create an OLAP database role

 

1. From Administration, click Data marts. The Manage Data Marts page appears.
2. Select the data mart and click Go to data mart. The Reporting data mart page appears.
3. On the OLAP database roles tab, click Add. The Add database role screen appears. On this screen, you enter permissions for members of the database role to access the OLAP cube. For a detailed explanation of the options on this screen, see Add Database Role Screen.

4. On the General tab, enter a name and description for the database role, and select the database permissions to assign to the role.
   • To grant full access and write permissions to change the objects in the data mart, select Full control (Administrator).
   • To grant access to process database objects and to view metadata about the objects, select Process database. Users with this permission level cannot change dimensions and cubes or edit the data in them.

   • To allow users to view metadata about database objects but to deny access to the data in the cube, select Read definition.

5. On the Membership tab, click Add to select users and groups for the database role. The Add role members screen appears.

6. Enter the domain and user name for each member of the OLAP database role.
7. Click OK. You return to the Add database role screen.

8. On the Cubes tab, assign permissions to access the OLAP cube.
   1. In the Access column, select whether to assign read or read/write access to the OLAP cube. By default, users cannot access any cube in the database.
   2. In the Local Cube/Drillthrough Access column, select whether to allow users to create local cubes or to drill through the cube to more detailed data. Select “Drillthrough” to allow users to access detailed data within the cube but not to create local cubes. Select “Drillthrough and Local Cube” to allow users to do both. To create subsets of the OLAP cube with the OLAP Excel Reports feature, users must be able to create local cubes. Local cubes allow users to view data from the OLAP cube even when they are not connected to the server with the data.
   3. In the Process column, select whether to allow users to manipulate data in the cube.

9. In the Cell Data tab, assign permissions to individual cells in the OLAP cube and enter MDX expressions to enforce cell-level security.
   1. In the Cube field, select the OLAP cube.
   2. Select the permissions to grant users for the cube.
   • To grant read-only access to the cells in the cube, select Enable read permissions. With read-only access, users can view the cells in the MDX expression.
   • To grant read-contingent access to the sells in the cube, select Enable read-contingent permissions. With read-contingent access, users can view the cells in the MDX expression only if the database role has read permission on the cells they were derived from.
   • To grant read/write access to the cells in the cube, select Enable read/write permissions. Members of the database role can view and update the cells in the MDX expression, but they also must have read/write permissions for the entire cube.

   • In the box under each permission you select, enter an MDX expression to select the cells that the permissions apply to. For each cell, the MDX expression is calculated before the program displays the cell value. If the expression returns a value of true, the program displays the cell value. If it returns a value of false, the program does not display the cell value.

     To grant permissions on a subset of cube cells, you must include an MDX expression. If you assign cell-level permissions but do not include an MDX expression to specify the cells, the database role does not have permissions on any cells in the cube.

10. On the Dimension Data tab, filter the cube dimensions that users can access. Dimensions are variables such as date and location that are similar to fields in the database. To create reports with the OLAP cube, you calculate measures such as constituent count and revenue at the intersection of dimensions. On the Dimension Data tab, you can exclude data from dimension attributes or exclude entire attributes.
    1. In the Dimensions field, select a dimension, and in the Attribute hierarchy field, select one of its attributes.
    2. On the Basic tab, select the data to include in the dimension attribute. By default, the program includes all data in the attribute. To exclude data from the attribute, clear the checkboxes in the hierarchy. To exclude the entire attribute, select Deselect all members.
    3. The Advanced tab displays data about the data you filter in a dimension attribute. For Select all members on the Basic tab, any data you exclude appears under Denied member set. For Deselect all members, any data you include appears under Allowed member set. Any data that you cannot exclude from the attribute appears under Default member.
11. Click Save. You return to the OLAP database roles tab. The new database role appears in the grid.