DimensionSecurity Rules not being fired

Post Reply
tm123
Posts: 132
Joined: Thu Oct 23, 2014 10:15 pm
OLAP Product: tm1, cognos bi
Version: 10.2
Excel Version: 2010

DimensionSecurity Rules not being fired

Post by tm123 »

Hi guys,

I am on Planning Analytics Version 2.0 (TM1 Build Number: 11.0.00200.998) and I am experiencing a strange issue.

I need to secure Dimensions so I have written rules for }DimensionSecurity cube, but for some strange reason, the Ruled cells are not being populated. There is no feeder or anything, and If I try to key-in some text in the Ruled Cells, TM1 throws an error saying "Not a number value"

Attached is a screenshot with the Rules ( I have simplified the Rules just for testing purposes )

This happens randomly, usually after I make changes to other Security Cube Rules and click of SecurityRefresh, but I cant reproduce it all the time

I have similar rules for }CubeSecurity and }ProcessSecurity, but I have not seen this issue in those cubes?

Any Idea?
Thanks
DimensionSecurity Rules.GIF
DimensionSecurity Rules.GIF (39.03 KiB) Viewed 8568 times
DimensionSecurity Cube View.gif
DimensionSecurity Cube View.gif (63.43 KiB) Viewed 8568 times
Attachments
Data Entry Message.GIF
Data Entry Message.GIF (17.14 KiB) Viewed 8568 times
tomok
MVP
Posts: 2831
Joined: Tue Feb 16, 2010 2:39 pm
OLAP Product: TM1, Palo
Version: Beginning of time thru 10.2
Excel Version: 2003-2007-2010-2013
Location: Atlanta, GA
Contact:

Re: DimensionSecurity Rules not being fired

Post by tomok »

That's some of the weirdest looking syntax for a rule on the }DimensionSecurity cube I've seen.

Code: Select all

['{Clients'] = S:'WRITE';
['{Groups'] = S:'READ';
['{Dimensions'] = S:'READ';
Do you really have groups called }Clients, }Groups, and }Dimensions?????? That's what part of your rule is doing, it's assigning rights to those three specific groups.
Tom O'Kelley - Manager Finance Systems
American Tower
http://www.onlinecourtreservations.com/
Wim Gielis
MVP
Posts: 3103
Joined: Mon Dec 29, 2008 6:26 pm
OLAP Product: TM1, Jedox
Version: PAL 2.0.9.18
Excel Version: Microsoft 365
Location: Brussels, Belgium
Contact:

Re: DimensionSecurity Rules not being fired

Post by Wim Gielis »

Euh Tom, the OP assigns (the same) rights to all groups on the dimensions that are mentioned. They are not group names but dimension names. Also it’s } instead of {

Which is not to say that I agree with these rules or the way of working.
Best regards,

Wim Gielis

IBM Champion 2024
Excel Most Valuable Professional, 2011-2014
https://www.wimgielis.com ==> 121 TM1 articles and a lot of custom code
Newest blog article: Deleting elements quickly
tm123
Posts: 132
Joined: Thu Oct 23, 2014 10:15 pm
OLAP Product: tm1, cognos bi
Version: 10.2
Excel Version: 2010

Re: DimensionSecurity Rules not being fired

Post by tm123 »

tomok wrote: Wed Nov 01, 2017 10:42 pm That's some of the weirdest looking syntax for a rule on the }DimensionSecurity cube I've seen.

Code: Select all

['{Clients'] = S:'WRITE';
['{Groups'] = S:'READ';
['{Dimensions'] = S:'READ';
Do you really have groups called }Clients, }Groups, and }Dimensions?????? That's what part of your rule is doing, it's assigning rights to those three specific groups.
Hi Tom,

Those are Dimension Names, so I just wanted to illustrate with en example what I am experiencing. These dimensions exist in each model that's why I used those, but the rule that does not get fired is the rules that apply to the whole cube ( see the lines below )

Code: Select all

[ ] = S: IF ( SUBST ( !}Dimensions , 1 , 1 ) @= '}' , 'NONE', CONTINUE ) ;
[ ] = S: 'WRITE' ;
Thank you
User avatar
Steve Rowe
Site Admin
Posts: 2410
Joined: Wed May 14, 2008 4:25 pm
OLAP Product: TM1
Version: TM1 v6,v7,v8,v9,v10,v11+PAW
Excel Version: Nearly all of them

Re: DimensionSecurity Rules not being fired

Post by Steve Rowe »

I've seen issues in the past with "stuff" that hangs off the }Dimensions dimension. My understanding of the trigger for this is that the }Dimensions dimension can be fully deleted and rebuilt under some circumstances, like a restart.

I hit this once a long time ago with some attributes on the }Dimensions dimension getting cleared on a restart. Since then I've avoided touching this dimension so I don't know if this still happens.

Might be root cause though, if the }Dimensions dimension is deleted on restart (or otherwise) by the engine and related objects rebuilt then this would result in the rule sheet becoming detached.
Technical Director
www.infocat.co.uk
tm123
Posts: 132
Joined: Thu Oct 23, 2014 10:15 pm
OLAP Product: tm1, cognos bi
Version: 10.2
Excel Version: 2010

Re: DimensionSecurity Rules not being fired

Post by tm123 »

Steve Rowe wrote: Thu Nov 02, 2017 1:12 pm I've seen issues in the past with "stuff" that hangs off the }Dimensions dimension. My understanding of the trigger for this is that the }Dimensions dimension can be fully deleted and rebuilt under some circumstances, like a restart.

I hit this once a long time ago with some attributes on the }Dimensions dimension getting cleared on a restart. Since then I've avoided touching this dimension so I don't know if this still happens.

Might be root cause though, if the }Dimensions dimension is deleted on restart (or otherwise) by the engine and related objects rebuilt then this would result in the rule sheet becoming detached.
Thank you Steve,

I can guarantee that the Dimension is not being deleted on restart or anything, actually the TM1 Instance has not been restarted this week at all, but this issue has happened a couple of times each day, basically when I change Rules for some other Security Cubes, and after I click on Refresh Security, the dimension security is gone. I still can see the rule, and also the Rule applies for the Lines where I am specifying the Dimension Name (eg. ['}Clients'] = S: 'READ' works fine), but not for the Generic Rules ( eg [ ] = S: 'READ' does not get fired, and there is no STET rule anywhere in my Rules )

The problem is that if I delete the Rules and also I delete the }DimensionSecurity cube from my model, then non-admin users cannot open any of the cube views, so I need to populate the }DimensionSecurity somehow. I know I can write a TI process to populate that cube, but I don't understand why the Rule is not working

By the way, in my prior TM1 Implementations, I have used the same Rules and never had this issue

Thanks again
tomok
MVP
Posts: 2831
Joined: Tue Feb 16, 2010 2:39 pm
OLAP Product: TM1, Palo
Version: Beginning of time thru 10.2
Excel Version: 2003-2007-2010-2013
Location: Atlanta, GA
Contact:

Re: DimensionSecurity Rules not being fired

Post by tomok »

Steve Rowe wrote: Thu Nov 02, 2017 1:12 pm I've seen issues in the past with "stuff" that hangs off the }Dimensions dimension. My understanding of the trigger for this is that the }Dimensions dimension can be fully deleted and rebuilt under some circumstances, like a restart.

I hit this once a long time ago with some attributes on the }Dimensions dimension getting cleared on a restart. Since then I've avoided touching this dimension so I don't know if this still happens.

Might be root cause though, if the }Dimensions dimension is deleted on restart (or otherwise) by the engine and related objects rebuilt then this would result in the rule sheet becoming detached.
I don't know if the }Dimensions dimension is deleted but I do know for a fact that it is rebuilt on every server restart. If not, how would it ever work if you were to copy in a .dim file like during a promotion if you didnt have an instance with the EXACT same list of dimensions and you copied in the }Dimensions dimension as part of the promotion?
Tom O'Kelley - Manager Finance Systems
American Tower
http://www.onlinecourtreservations.com/
tm123
Posts: 132
Joined: Thu Oct 23, 2014 10:15 pm
OLAP Product: tm1, cognos bi
Version: 10.2
Excel Version: 2010

Re: DimensionSecurity Rules not being fired

Post by tm123 »

tomok wrote: Thu Nov 02, 2017 2:54 pm
Steve Rowe wrote: Thu Nov 02, 2017 1:12 pm I've seen issues in the past with "stuff" that hangs off the }Dimensions dimension. My understanding of the trigger for this is that the }Dimensions dimension can be fully deleted and rebuilt under some circumstances, like a restart.

I hit this once a long time ago with some attributes on the }Dimensions dimension getting cleared on a restart. Since then I've avoided touching this dimension so I don't know if this still happens.

Might be root cause though, if the }Dimensions dimension is deleted on restart (or otherwise) by the engine and related objects rebuilt then this would result in the rule sheet becoming detached.
I don't know if the }Dimensions dimension is deleted but I do know for a fact that it is rebuilt on every server restart. If not, how would it ever work if you were to copy in a .dim file like during a promotion if you didnt have an instance with the EXACT same list of dimensions and you copied in the }Dimensions dimension as part of the promotion?
That is true for other dimensions also ( }Cubes, }Processes, }ApplicationEntries etc) but I do not see the same behavior on the Security Rules for those objects.

It might be a bug on the version I am working with, otherwise it's like a ghost
lotsaram
MVP
Posts: 3651
Joined: Fri Mar 13, 2009 11:14 am
OLAP Product: TableManager1
Version: PA 2.0.x
Excel Version: Office 365
Location: Switzerland

Re: DimensionSecurity Rules not being fired

Post by lotsaram »

tm123 wrote: Thu Nov 02, 2017 1:44 pm The problem is that if I delete the Rules and also I delete the }DimensionSecurity cube from my model, then non-admin users cannot open any of the cube views, so I need to populate the }DimensionSecurity somehow. I know I can write a TI process to populate that cube, but I don't understand why the Rule is not working
The issue you are describing does sound like a bug.

But why do you need dimension security at all? If the }DimensionSecurity cube is deleted then the default security level for ALL dimensions is READ. The only reason you would ever need to apply dimension security would be to hide a dimension from some user altogether because the element names themselves are confidential in some way. Not very many models have this requirement and so have no need for dimension security.
Please place all requests for help in a public thread. I will not answer PMs requesting assistance.
tm123
Posts: 132
Joined: Thu Oct 23, 2014 10:15 pm
OLAP Product: tm1, cognos bi
Version: 10.2
Excel Version: 2010

Re: DimensionSecurity Rules not being fired

Post by tm123 »

lotsaram wrote: Thu Nov 02, 2017 3:25 pm
tm123 wrote: Thu Nov 02, 2017 1:44 pm The problem is that if I delete the Rules and also I delete the }DimensionSecurity cube from my model, then non-admin users cannot open any of the cube views, so I need to populate the }DimensionSecurity somehow. I know I can write a TI process to populate that cube, but I don't understand why the Rule is not working
The issue you are describing does sound like a bug.

But why do you need dimension security at all? If the }DimensionSecurity cube is deleted then the default security level for ALL dimensions is READ. The only reason you would ever need to apply dimension security would be to hide a dimension from some user altogether because the element names themselves are confidential in some way. Not very many models have this requirement and so have no need for dimension security.
Actually I tried deleting the }DimensionSecurity and after that, non-admin users cannot see any dimensions and therefore they cannot open any of the CubeViews

after deleting the }DimensionSecurity, if I go to Dimension Security Assignment grid, the default access for all Cognos BI Groups is "NONE"
pandinus
Posts: 78
Joined: Tue Mar 18, 2014 8:02 am
OLAP Product: TM1, Cognos Express
Version: 10.2.2
Excel Version: 2013

Re: DimensionSecurity Rules not being fired

Post by pandinus »

This is possibly because the rule also applies security to the ADMIN, DataAdmin and SecurityAdmin groups. This cannot be and TM1 does not know how to handle this correctly, leading to strange and inconsistent behavior.
Same weird stuff happens when you run a TI process and try to set security for one of these groups.
Try to exclude these groups from the rule and see if that helps.
tm123
Posts: 132
Joined: Thu Oct 23, 2014 10:15 pm
OLAP Product: tm1, cognos bi
Version: 10.2
Excel Version: 2010

Re: DimensionSecurity Rules not being fired

Post by tm123 »

Thank you, good suggestion

I actually gave up on that Rule so I write a process to populate the }DimensionSecurity cube, so far has not given any issues but for such a simple Rule, I had to complicate little bit my model just because the Rule was not doing what it is supposed to do.
tony.wijaya
Posts: 3
Joined: Fri Dec 12, 2014 2:37 am
OLAP Product: Planning Analytics
Version: PA 2.0.9.8 PAW 2.0.65
Excel Version: Excel 2016

Re: DimensionSecurity Rules not being fired

Post by tony.wijaya »

Hi,

Just want to share, i encountered the same issue before. If i am not mistaken, it happened to me every time there is a new group created or removed via TI. To fix that, i created a separate TI to load the rule from file again and call put security refresh. So basically, after the group maintenance is executed, i will trigger this TI to reload the rule for this dimension security.

Code: Select all

RuleLoadFromFile( '}DimensionSecurity', '}DimensionSecurity.rux');
SecurityRefresh;
I am not really sure why the group creation or deletion can cause the rule become invalid, but the ruleloadfromfile saved me.

Hope it can be helpful
Wim Gielis
MVP
Posts: 3103
Joined: Mon Dec 29, 2008 6:26 pm
OLAP Product: TM1, Jedox
Version: PAL 2.0.9.18
Excel Version: Microsoft 365
Location: Brussels, Belgium
Contact:

Re: DimensionSecurity Rules not being fired

Post by Wim Gielis »

Thank you tony.wijaya
Best regards,

Wim Gielis

IBM Champion 2024
Excel Most Valuable Professional, 2011-2014
https://www.wimgielis.com ==> 121 TM1 articles and a lot of custom code
Newest blog article: Deleting elements quickly
User avatar
Elessar
Community Contributor
Posts: 331
Joined: Mon Nov 21, 2011 12:33 pm
OLAP Product: PA 2
Version: 2.0.9
Excel Version: 2016
Contact:

Re: DimensionSecurity Rules not being fired

Post by Elessar »

tony.wijaya,

This is really strange. You can use the audit log to determine the culprit
Best regards, Alexander Dvoynev

TM1 and Data Science blog: 6th article - PAfE + VBA: Commit each cell without pressing “Commit” button.
Post Reply