如何限制用户的 SSAS 层次结构级别？
我对 ssa 比较陌生，并且在某些方面遇到了麻烦。
场景：
- 具有公司层次结构（区域、子区域、国家/地区、公司）的多维数据集
- 通过将用户名链接到允许的公司列表来过滤公司维度，从而应用维度安全性。
- “启用可视总计”已打开，以便您只能查看您有权访问的公司的层次结构每个级别的总计。
问题：
有人要求，如果用户只能看到一个国家/地区的公司（例如），那么他们不应该能够看到层次结构中的更高级别（因为总数将相同）。 即，如果您只能看到英国公司，您应该只能看到层次结构的国家和公司级别，而不是次区域（欧洲）和地区（欧洲、中东和非洲）级别。
有谁对如何实现这一点有任何想法，或者即使可以做到吗？ 我们可以管理一个在报告层中工作的解决方案，但要求是这应该在多维数据集中处理，以允许未来的临时报告/替代报告解决方案。
我尝试过的想法/事情：
- 尝试查看设置默认成员是否对您可以看到的层次结构的级别有任何影响（它没有）
实现了多个视角 是相同的 他们使用的公司等级制度； 每个 透视图使用的层次结构具有 从越来越低的水平开始。
- 这在一定程度上是可行的，但我不知道如何将用户限制为只有一个视角
HideMemberIf - 据我所知，这用于创建一个参差不齐的层次结构并隐藏较低的成员而不是顶层的成员层次结构。
所以，总而言之，嗯。
I am relatively new to ssas and am having trouble with something.
The scenario:
- A cube with a company hierarchy (region, sub-region, country, company)
- Dimension security is applied by filtering the company dimension by linking username to a list of allowable companies.
- Enable Visual Total is switched ON so that you can only see totals at each level of the hierarchy for those companies for which you have access.
The problem:
It has been requested that if a user can only see companies for one country (for example) then they should not be able to see the higher levels in the hierarchy (as the totals will be the same). i.e., if you can only see UK companies you should only see the country and company levels of the hierarchy and not the sub-region (Europe) and region (EMEA) levels.
Does anyone have any ideas on how this can be accomplished, or even if it can be done? We can manage a solution to work in the reporting layer, but the requirement is this should be handled in the cube to allow for future ad-hoc reporting/alternative reporting solutions.
Ideas/things I have tried:
- Trying to see if setting default member has any effect on the levels of the hierarchy you can see (it doesn't)
Implemented multiple perspectives
that are identical apart for the
company hierarchy they use; each
perspective uses a hierarchy that has
starts at a lower and lower level.- this works up to a point, but i can't see how to restrict a user to only one perspective
HideMemberIf - as far as I can see this is used to create a ragged hierarchy and hides lower members not the top levels of the hierarchy.
So, in conclusion, hmmm.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
您可以通过删除角色查看关联层次结构中的成员的权限来执行此操作。
为此：
然后确保他们使用的视角不会尝试显示层次结构； 任何这样做的尝试都将导致客户端错误，因为毫无疑问您的多维数据集具有引用这些成员的各种互连查询。
此外，任何引用这些成员的计算都会引发不稳定； 权限在计算之前进行评估，因此您应该删除这些计算，或者采用在生产过程中将多维数据集的 ScriptErrorHandlingMode 属性设置为 IgnoreAll 的次优解决方案。
小旁注：视角不是用于安全性，而是用于演示。 因此，如果您不希望用户看到您在某个视角中屏蔽的内容，请记住他们可以通过其他方式查看它们，例如使用 MDX 或使用忽略视角的客户端功能。
其他小注释：有些人认为这种程度的安全性是客户端问题。 我不同意。
You can do this by removing the Role's permissions on viewing members in the associated hierarchies.
To do this:
Then ensure the perspective they're using doesn't attempt to display the hierarchies; any attempt to do so will result in a client error, because no doubt your cube has various interconnected queries referencing those members.
Also, any calculations that reference these members will throw wobblers; permissions are evaluated before calculations, so you should either remove those calculations, or resort to the sub-optimal solution of setting the cube's ScriptErrorHandlingMode property to IgnoreAll while in production.
Little side note: Perspectives aren't used for security, but for presentation. So if you don't want your users seeing things you've blocked off in a perspective, bear in mind that they can view them by other means, e.g. by using MDX, or by using client features that ignore perspectives.
Little other side note: some folk suggest that security to this degree is a client-side issue. I disagree.