You user is a member of all groups and the respective groups representing the org all have WRITE access to the same named org therefore Client1 has write access to all the Org. TM1 does not intersect element security for individual cells, if that's what you'd want, as Luc already elutes to, you'd likely end up using cell security.
However in your scenario, if Client1 remained member of all groups, that wouldn't change much IMHO as each of those groups would give this user access to the respective intersections with Planning nevertheless resulting in him still having full access to the full org. Think the confusion is partly here because of the group name being the same as the LowOrg element name whereas you are giving everybody with membership to group Org124 access to Planning in this case.
------------------------------
Hubert Heijkers
STSM, Program Director TM1 Functional Database Technology and OData Evangelist
------------------------------
Original Message:
Sent: Mon April 01, 2024 06:35 PM
From: Sudeep Rimal
Subject: Element level Security
Hi,
I am new to TM1 security and trying to understand how we can assign the element security for the below scenario,
We have below security cubes set up for Client1: Client 1 has been grouped as Contributor and access to Org123, Org 124 and Org 125
| | | Group | | |
| }ClientGroups | Dimension | | Contributor | Org 123 | Org 124 | Org 125 |
| Client1 | | Contributor | Org 123 | Org 124 | Org 125 |
ORG security cube has WRITE access to the respective ORG but READ to other ORG
| | | Group | | |
| }ElementSecurity_LowOrg | LowOrg | | Contributor | Org 123 | Org 124 | Org 125 |
| Org 123 | | | WRITE | READ | READ |
| Org 124 | | | READ | WRITE | READ |
| Org 125 | | | READ | READ | WRITE |
Requirement is: for the Planning Scenario we want Client1 to have READ access to Org 123, WRITE access to ORG124 and NONE to Org 125
| }ElementSecurity_Scenario | Scenario | | Contributor | Org 123 | Org 124 | Org 125 |
| Planning Scenario | | READ | READ | WRITE | |
| Budget Scenario | | READ | READ | READ | |
The above security set up doesn't fulfill the requirement. It allows Client1 access to all the Org (Org 123, 124 and 125) although we just provided WRITE access to Org 124.
Any suggestion how can i achieve the goal to allow Client 1 to have WRITE access to only ORG 124
Thank you,
Sudeep
------------------------------
Sudeep Rimal
------------------------------