Cognos Analytics

Cognos Analytics

Connect, learn, and share with thousands of IBM Cognos Analytics users! 


#Product
#Analytics
#CognosAnalytics
#Analyticstools
#TechXchange Partner
#TechXchange Session
#TechXchange Presenter
#AI
 View Only
  • 1.  Data security for data modules

    Posted 10/28/21 03:46 PM
    We have one area (sales) where we want our data modules to have security based on location, but in other areas (equipment, inventory) we want the users to be able to see all locations. We have multiple data modules, but they share a common location dimension table. Adding security to that table for the sales modules and reports means the security is applied everywhere. What we really need is security based on a user's role (sales vs equipment, for example) and the area of reporting/data module in use.

    So far, I haven't figured out a way to accomplish this, but data module security is fairly new to me. Anyone have any ideas?

    ------------------------------
    Jonathan McKnight
    5x IBM Champion
    BI Analyst @ Rogers Group Inc.
    Nashville, TN
    www.linkedin.com/in/jonathanmcknight
    ------------------------------

    #CognosAnalyticswithWatson


  • 2.  RE: Data security for data modules

    Posted 10/28/21 05:57 PM
    Edited by System Admin 01/20/23 04:10 PM

    I think this pattern could help you, at least by giving you an approach to think through.

    Put the security filter on your fact table with the keys which represent entities in the dimension which you either want to deny or allow in the appropriate expression.  The latter will tend to fail safe in more situations than the former (as it is in the lock down and then allow mode).

    If the grain of detail for a fact does not match the grain of dimension detail which you want to use for your security filter you might need to figure out what keys belong to the appropriate dimension entity.  

    For example, as in your case, you want to allow access to all countries for some facts and allow access to only some countries for other facts. Assume that the grain of detail for a fact is at the employee level (for sales as they were presumably sold by some sales dude ). You would need to identify which employees belong to which country.

    I did this method for my work for implementing security filters for my test materials (I wasn't directly involved in the initial implementation of it but I need to have it if for no other reason than realism ) and it was a bit cumbersome.  I ended up creating a spreadsheet with columns with the security filter grains and the matching fact grain keys  in which I concatenated the keys into strings which I could then use in the appropriate security filter expressions.

    This could also allow you to specify a more restrictive expression for one dimension than another.  For example, an employee dimension country restricted to the UK only but a customer dimension country covering all countries, covering the case of a UK sales dude selling to France, Germany, etc.

    Since the filters would be on the facts and not the dimensions, you could use your dimension with all of your facts as the restrictions would be on the facts and so, for the facts where you do not want locations restricted will not have restrictions generated in the sql.

    update (forgot to add this):

    Also, the use of a generic dimension is not a good practice.  Here is a brief (one paragraph) explanation from Kimball.

    https://www.kimballgroup.com/data-warehouse-business-intelligence-resources/kimball-techniques/dimensional-modeling-techniques/abstract-generic-dimension/



    ------------------------------
    IAN HENDERSON
    ------------------------------



  • 3.  RE: Data security for data modules

    Posted 10/29/21 10:33 AM

    Hi Jonathan ,

    Apologies for the sales-pitch  - I'm with Attain Insight an IBM Business Partner out of Ottawa (homeland of Cognos) and we developed a product (purpose-built for IBM Cognos) that does exactly what your looking for called Security 4X!  You can put security on anything - folders, reports, connections. And assign by user-roles!  

    Product does many more things from migration to license compliance. Happy to set-up a demo for you with a product expert.
    Stephanie Kajenski,
    Attain Insight,stephanie.kajenski@attaininsight.com

    Attain Insight Security 4X

    ATTAIN INSIGHT SECURITY 4X remove preview
    Attain Insight Security 4X
    ​Content Security Folders, Reports, Connections Data Security Tables, Cubes, FM Objects Policy Management Web-based User Administration Authorized User Application Access Control License Management Entitlement Utilization
    View this on ATTAIN INSIGHT SECURITY 4X >





    ------------------------------
    Stephanie Kajenski
    VP of Marketing & Administration
    Attain Insight
    ------------------------------