topic Re: Regarding Analysis Authorization in Application Development and Automation Discussions

Regarding Analysis Authorization

gaddam_vinaykumar — Thu, 18 Oct 2012 08:42:48 GMT

Hello,

Currently we( Security team ) are trying to handle an authorization issue in our project, where the users having access to the role( in question ) are able to access all the org units through a BI query.

Ideally they should be able to access only their org unit...... I'm not referring to the summarized data here.

I checked the role; it contains,

S_rsec with * for each & every field, and

S_rs_auth with the analysis authorization having 0orgunit with I CP *.

I checked the query too, the variable Org Unit is of Hierarchy Node type & has Processing By=Manual Input.

Now can you please tell me, is this analysis authorization( in S_rs_auth ) causing the issue?

Thank you.

Re: Regarding Analysis Authorization

Former Member — Thu, 18 Oct 2012 09:28:54 GMT

Yes , remove * for characteristic 0ORGUNIT and maintain only those ourg units for which you want to give access to users via this AA.

Thanks

Amit

Re: Regarding Analysis Authorization

gaddam_vinaykumar — Thu, 18 Oct 2012 11:10:37 GMT

Thanks for your reply Amit.

So can I say; AA containing value auth( I CP * ) can affect a variable, which is of Hierarchy Node type?

Re: Regarding Analysis Authorization

Former Member — Thu, 18 Oct 2012 20:39:09 GMT

Hi Gaddam,

Does this solution provided by Amit worked for you?

This is possible by restricting query also .

In query designer , restrict Org unit for the Query XYZ you are looking for.

Thanks,

Varun Jain

Re: Regarding Analysis Authorization

Former Member — Fri, 19 Oct 2012 05:08:59 GMT

Yes, * will provide access to hierarchy nodes as well...

Re: Regarding Analysis Authorization

gaddam_vinaykumar — Tue, 23 Oct 2012 09:21:04 GMT

Thanks Amit, for the confirmation.

My understanding was, hierarchy node variables get values only from hierarchy auths.

Re: Regarding Analysis Authorization

shivraj_singh2 — Wed, 24 Oct 2012 21:13:01 GMT

Vinay,

Just adding one important point here, S_RSEC should not be assigned to reporting users. Reporting Users can get sufficient access from COMP, COMP1 & S_RS_AUTH objects.

Regards,

Shivraj

Re: Regarding Analysis Authorization

gaddam_vinaykumar — Fri, 26 Oct 2012 16:18:21 GMT

Right, we are addressing that too.

Thanks for your reply Shivraj.