150 IBM Cognos Dynamic Cubes
? If there are no security filters for a hierarchy, all members are visible in the hierarchy.
However, absence of security filters on a hierarchy differs from the built-in
Grant All
Members
security filter.
? If there are security filters, but none of the filters have a grant scope, all members that are
not explicitly denied will be granted.
7.3 Grant versus deny approaches to security
In Dynamic Cubes dimensional security, deny has precedence over grant. After a member is
explicitly denied, it cannot be accessed. Using a combination of deny filters further restricts a
access of the user to the members in a hierarchy. Conversely, using a combination of grant
filters builds out a user’s access to the members in a hierarchy
Using a grant scope without the ascendants option can lead to visible ancestors.
The possibility of hitting the tuple security, described in 7.8.1, “Secured tuples” on page 164,
is found only with grant security when more than one hierarchy is secured, therefore using
deny security avoids the validation of that scenario.
7.4 Visible ancestors
If ancestors of a granted member are not explicitly granted, the ancestors are visible
ancestors. Visible ancestors are visible in the metadata tree and in reports, but their value will
always be secured.
Visible ancestors ensure there is a path from a root member of the hierarchy to any granted
members. Without a path from a root member to granted members, the Cognos Studios
cannot properly display members.
Because Dynamic Cubes does not support Visual Totals, visible ancestors ensure roll-up
values do not reveal information about secured descendants.
Visible ancestors occur only when using grant filters.
7.4.1 Example: Visible ancestors unnecessary
In this example, security view 1 grants access to United States, its ancestors, and its
descendants. For all the granted members, their ancestor tree to the root is granted. There is
no need for visible ancestors.
..................Content has been hidden....................
You can't read the all page of ebook, please click here login for view all page.