Dimension restriction in an analytic privilege

[BenedictV]

Hi,

While reading the HANA security guide, I came across the following line. 

"Within one dimension restriction, all value filters on the corresponding dimension attribute are combined with logical OR. "

eg. Can someone explain this with an example?

"Within one Analytic Privilege, all dimension restrictions are combined with logical AND. "

eg. YEAR=2008 AND COUNTRY=US

What does a dimension in HANA mean. Is it a single field or is a attribute view in am analytic view?

I am from  a BW background. Dimensions in a BW infocube are a grouping of related fields.

Thanks,

Benedict

[alexandre_dussac · Accepted solution]

Hi Benedict,

A dimension is like a characteristic in BW. Let's take this example:

Dimension 1	Dimension 2	Measure 1
FRANCE	PRODUCT A	100
CHINA	PRODUCT A	50
US	PRODUCT B	20

So it makes perfect sense to use a OR operator for an analytical privilege on a dimension. Restrictions happen in the WHERE clause so if I'm authorized to see France and China, it will look like (just to give you an idea):

SELECT .... WHERE DIMENSION 1 = FRANCE OR CHINA

If you try this with a AND operator you will never retrieve anything as there is no dimension with a value France and China.

F the AND operation is also logical for the 2 dimensions, if you are authorized to Product B in addition of France and China. You need a AND condition otherwise you'll see non authorized information.

SELECT .... WHERE (DIMENSION 1 = FRANCE OR CHINA) AND DIMENSION 2 = PRODUCT B

Result should be empty as they were no Product B sold in France or China.

Hope I was clear enough

[BenedictV · Accepted solution]

Thanks Alex. You were very clear

If I may ask one more....

There's another line which says -  "Can add several conditions per field (combined via “AND”)", and I am again confused. What's a field and what's a dimension? are they not the same?

Benedict

[alexandre_dussac · Accepted solution]

In which guide do you see this? I didn't find it in the security guide.. this one is more difficult without context for me too

[BenedictV · Accepted solution]

Here it is,

Thanks,

Benedict

[alexandre_dussac · Accepted solution]

Hi Benedict, this time field means dimension.

HANA studio allows you to create several conditions like:

AMOUNT > 2000

AND

AMOUNT < 10000

They are then combined with a AND condition.

Best-

[justin_molenaur2 · Accepted solution]

Hi Alexandre - I read this post and found it very similar to a previous discussion, shown in this thread.

Essentially the question comes down to multiple analytic privileges and which one "wins" when the system evaluates them together. For example, one privilege on Analytic View 1 contains a restriction on an attribute view, the other privilege on Analytic 1 contains no restrictions on any attribute views.

The approach would be that you could restrict a given user/group based on an attribute view characteristic (only US, only EUR, etc), and then also assign new Analytic Views as they are created.

Thanks,

Justin

[BenedictV · Accepted solution]

Hi Justin, thanks for the help. I am having difficulty understanding the whole picture.

Can you please explain the same relating it to the screen I have given above?

Benedict

[justin_molenaur2 · Accepted solution]

Hi Benedict - to make it more clear - you are really talking about a single analytical privilege. What Alexandre was explaining is that all of the restrictions operate as a big OR condition.

What I am describing is what happens when two analytical privileges collide and which one would be the 'winner'. What seems to be happening is that when two analytic privileges are defined, one with a restriction that says COLOR = "BLUE", and the other analytic privilege has no restriction on color, it seems that ALL colors will be allowed to the user. This would operate in a similar fashion as an "OR" statement as Alexandre explained - and I was just hoping to get a confirmation on.

The whole point is that it may be possible to assign attribute view restrictions one time and then incrementally add analytic view privileges.

Thanks,

Justin