Security is always an important aspect of any BI solution. Especially for big enterprise solutions the security-concept can become very complex. Analysis Services Multidimensional in general offers two option on how to define security: Cell Data Permissions and Dimension Data Permissions. Because of the huge impact on performance Cell Data Permissions are barely used. Dimension Data Permissions are usually the way to go and can cover probably 98% of the security requirements. Though, also Dimension Data Permissions can get quite complex, especially for large-scale cubes with 100+ or even 1000+ users. Just think of an Analysis Services that holds sales data associated to KeyAccounts – further assume that we have 100 KeyAccounts. Each of this KeyAccounts is managed by one user, so we would end up creating 100 roles – one for each KeyAccount and its manager. In terms of maintenance this can get quite complex and in the long run unmanageable.
To address this issue Analysis Services offers the concept of Dynamic Security. Dynamic Security is evaluated at runtime for each user and allows you to consolidate your roles. So for our example from above instead of having 100 different roles we would end up having one dynamic role serving all 100 users. Basically, when a user connects it queries internal data (within the cube using MDX) or external data (using Analysis Services Stored Procedure (ASSP)/Assemblies) to get the security settings for the current user. Especially in combination with ASSP this can be quite powerful as you can use any datasource that you can query using .Net-code to derive your security from.
To make a role "dynamic" you basically have two options:
1) Username() – returns the current users in format "MyDomainMyUser"
2) CustomData() – returns whatever was specified in the connectionstring’s CustomData-property
Both are native MDX-functions and can be used in an expression to build your Allowed Set, Denied Set or DefaultMember.
This works just fine, as long as the expressions returns a valid MDX set/member of course.
But what about the Visual Totals – setting? You can only check or uncheck the checkbox and you are not able to use any dynamic expressions. That’s what the UI offers you – no more no less. But there might be some rare scenarios where you also need to make the Visual Totals dynamically based on Username() or CustomData() – and this is what this post is about.
So, as we have already seen above, it is not possible to make the Visual Totals dynamically using the UI. Fortunately there are also other ways besides the UI to work with the cube and modify its structure. I am talking about XMLA (XML for Analysis Services) here, which is the protocol that is used for all communications between a client and Analysis Services. Instead of writing XMLA on your own there is also a programmatically way to do this: AMO (Analysis Management Object). AMO is a .Net library that allows you to integrate calls to Analysis Services within any .Net code. After modifying any object in the code AMO generates the according XMLA for you and sends it to the server which is a much more convenient way than writing plane XMLA on your own.
This means that you can also create/modify your security roles using AMO – this approach is already very well described by Benny Austin in his blog about SSAS: Using AMO to Secure Analysis Service Cube. I recommend reading this article before you continue here.
For this little example I create a slimmed down version of Adventure works. The model contains only the Date and the Product dimension. We will put our dynamic security on the Category attribute of our Product dimension. The model also already contains a predefined empty role called "DynamicVisualTotals" that we will modify later (after the model has been deployed) using AMO. Please note here that AMO only work with the Analysis Service directly (online) but not at design time in Visual Studio. Once everything is deployed this is the AMO code to use to modify the predefined role:
namespace ModifyRole_AMO
{
class Program
{
static void Main(string[] args)
{
using (Server oServer = new Server())
{
oServer.Connect("localhost");
using (Database oDB = oServer.Databases.GetByName("DynamicVisualTotals"))
{
Role oRole = oDB.Roles.GetByName("DynamicVisualTotals");
Dimension oDim = oDB.Dimensions.GetByName("Product");
DimensionAttribute oAttr = oDim.Attributes.FindByName("Category");
DimensionPermission oDimPermission = oDim.DimensionPermissions.FindByRole(oRole.ID);
AttributePermission oAttrPermission = oDimPermission.AttributePermissions.Find(oAttr.ID);
// can be done in the UI
oAttrPermission.AllowedSet = "DynamicSecurity.DynamicAllowedSet(CustomData())";
// can not be done in the UI
oAttrPermission.VisualTotals = "DynamicSecurity.DynamicVisualTotals(CustomData())";
oDimPermission.Update();
}
}
}
}
}
1) connect to server "localhost"
2) connect to database "DynamicVisualTotals"
3) get the Role-object for role "DynamicVisualTotals" from the database
4) get the Dimension-object for dimension "Product"
5) get the DimensionAttribute-object for attribute "Category"
6) get the DimensionPermission that is associated to our Role for dimension "Product"
7) get the AttributePermission that is associated to our attribute "Category"
So far this is straight forward. The AttributePermission object actually represents the UI that we have seen above. It has properties for all the fields and textboxes on the UI. The most important of course are:
– AllowedSet
– DeniedSet
– Defaultmember
– and VisualTotals
For the first three I was already aware that they are of type String but the VisualTotals I expected to be Boolean which turned out to be wrong – it is also a String!
Naïve as I am I simply put a MDX expression in there that resolves to "1" or "0" (Boolean, similar to the Checkbox in the UI, it could probably also resolve to "true" or "false" or a Boolean type directly but I did not further test this) – and, it worked like a charm! The MDX expression I used refers to an ASSP called DynamicSecurity which contains a function called "DynamicVisualTotals" that returns "1" or "0" based on what was passed in the connectionstring using CustomData():
namespace DynamicSecurity
{
public static class DynamicSecurity
{
public static string DynamicVisualTotals(string customData)
{
if (customData == "1")
return "1";
return "0";
}
public static Set DynamicAllowedSet(string customData)
{
string mdxEpression;
Expression exp;
Set s;
if (customData == "1")
mdxEpression = "{[Product].[Category].&[1]}";
else
mdxEpression = "{[Product].[Category].&[3], [Product].[Category].&[4]}";
exp = new Expression(mdxEpression);
s = exp.CalculateMdxObject(null).ToSet();
return s;
}
}
}
(This ASSP has to be compiled and added to the database first to make the Dynamic Security work. This is describe here in more detail.)
And that’s it!
Once everything is done
1) Deploy the solution to the sever
2) (add ASSP if not already included in the solution)
3) Execute the AMO code (first listing)
we can use Excel to check the results:
The used connection strings are as follows:
Make sure to also use the Roles-property for testing as if you are administrator these privileges would overwrite all other security settings!
Additional Notes:
As AMO is just a wrapper for XMLA we could also use XMLA directly to modify our role:
<Object>
<DatabaseID>DynamicVisualTotals</DatabaseID>
<DimensionID>Dim Product</DimensionID>
<DimensionPermissionID>DimensionPermission</DimensionPermissionID>
</Object>
<ObjectDefinition>
<DimensionPermission xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:ddl2="http://schemas.microsoft.com/analysisservices/2003/engine/2" xmlns:ddl2_2="http://schemas.microsoft.com/analysisservices/2003/engine/2/2" xmlns:ddl100_100="http://schemas.microsoft.com/analysisservices/2008/engine/100/100" xmlns:ddl200="http://schemas.microsoft.com/analysisservices/2010/engine/200" xmlns:ddl200_200="http://schemas.microsoft.com/analysisservices/2010/engine/200/200" xmlns:ddl300="http://schemas.microsoft.com/analysisservices/2011/engine/300" xmlns:ddl300_300="http://schemas.microsoft.com/analysisservices/2011/engine/300/300" xmlns:ddl400="http://schemas.microsoft.com/analysisservices/2012/engine/400" xmlns:ddl400_400="http://schemas.microsoft.com/analysisservices/2012/engine/400/400">
<ID>DimensionPermission</ID>
<Name>DimensionPermission</Name>
<RoleID>Role</RoleID>
<Read>Allowed</Read>
<AttributePermissions>
<AttributePermission>
<AttributeID>Product Category Name</AttributeID>
<AllowedSet>DynamicSecurity.DynamicAllowedSet(CustomData())</AllowedSet>
<VisualTotals>DynamicSecurity.DynamicVisualTotals(CustomData())</VisualTotals>
</AttributePermission>
</AttributePermissions>
</DimensionPermission>
</ObjectDefinition>
</Alter>
Please note that XMLA always uses the internal IDs which may not be the same as the name of the objects!
In this post I showed how to use AMO and XMLA to modify a security role and use an expression to make the VisualTotals setting dynamic which is not possible using the UI only. This is just a very simplified example but I used this approach on some of my enterprise deployments and it works just fine also for very complex scenarios.
The attached zip-file includes everything that is necessary to recreate this example:
– SSAS project
– ASSP project
– AMO project (and XMLA script)
– final Excel with results