IP - Authorization type for hierachy

[Former Member]

Hi.

I've a hierarchy:

NODE1

NODE1.1

NODE1.2

NODE1.3

LEAF1.3.1

LEAF1.3.2

LEAF1.3.3

NODE1.4

I want to see my input-ready:

NODE1

NODE1.3

LEAF1.3.1

LEAF1.3.2

LEAF1.3.3

In rsecadmin I used this:

0 type authorization for NODE1 and 1 type authorization for NODE1.3

But after run input-ready, leaves of my hierarchy are were blocked.

How should I make authorization to use input-ready?

[gregor_dieckmann]

Hi,

this is a misunderstanding what BW authorizations do. With BW authorizations you define the data area one is allowed to display or to change but authorizations don't control whether cells are input-ready or not. The only 'side-effect' of an authorization check failing is that if one tries to open an input-ready query in change mode it will be opended in display mode.

To protect data cells in query you can use properties of structure elements in query defintion or data slices.

Regards,

Gregor

[Former Member]

Why is this misunderstanding?

The planning process is involved 20 users. Each user is responsible for a certain set of items. I want to use one input-ready format.

For this I need to configure access to items via authorization. If I use only the type authorization 1, the items are available for input. As soon as I add the the authorization 0, for any node of item hierarchy, input-ready format is blocked.

But the client wanted to see previous node of hierarchy to understand to whom section applies item (revenues or expenses). Yes, I agree that it is possible to use the data slices, but then all users will see all the items, and why should they see the items for which they are not responsible.

[gregor_dieckmann]

Hi Alexandra,

I just wanted to point out that with authorization you cannot control e.g. whether rows, columns or cells are input ready. So if you expect that you can control input-readiness of the above mentioned objects with authorizations this is a misunderstanding of what authorizations are designed for.

Of course you have to maintain display and change authorization to control what the user is able to see and is able to change.

You should also take into account the authorizations don't filter the result set. So in your example you don't need NODE1 at all, just give change authorization to subtree NODE1.3 and use only NODE1.3 in the filter of the query. To display NODE1 with the semantics being the total of

NODE1.1

NODE1.2

NODE1.3

is anyway misleading since your requirement excludes the value of NODE1.1, NODE1.2. By the way this is the reason that BW authorization don't filter objects.

Regards,

Gregor