TM1 Forum

Hi!

I have a user who has permissions to processes Y, but not to a cube named X.
The Y process has a cellputs('text','X cube','dim1','dim2') command that it can run, so it can essentially write a cube that it doesn't have rights to.
Is that OK? How could this be avoided?

Thanks in advance!

monkey97 wrote: ↑Tue Feb 20, 2024 2:31 pm Hi!

I have a user who has permissions to processes Y, but not to a cube named X.
The Y process has a cellputs('text','X cube','dim1','dim2') command that it can run, so it can essentially write a cube that it doesn't have rights to.
Is that OK? How could this be avoided?

Thanks in advance!

Process security only controls whether you can either see, execute and/or change the process. The processes themselves always execute with admin privileges so cube, dimension and element security are not factored in by default. The only thing you can do is roll your own security check into the process by checking the appropriate security cubes to make sure the user that executed the process has rights. If not you exit the process or skips the record, all depending on exactly what you are doing with the process.

I have a user who has permissions to processes Y, but not to a cube named X.

to give permission to a group to access a process:

Cellputs('READ','}processsecurity',[TIprocessname],[usergroup]);

I have a user who has permissions to processes Y, but not to a cube named X.

to avoid access to the cube x:
cellputs('NONE','}cubesecurity','cube x',[usergroup]);

with those two commands, users in the group can run the TI process but cannot do editing to the cube. If I am not mistaken, the TI process will generate error if there is command to update the cube.

Regards
Veronika

No it will not give an error.

VRGultom wrote: ↑Thu Mar 21, 2024 2:08 am If I am not mistaken, the TI process will generate error if there is command to update the cube.

You are mistaken. TI processes always run with DataAdmin rights (full Admin if the "Security Access" option is also selected). Therefore users can update dimension and cubes they don't have the rights to edit directly by running a TI process. That's kinda the whole point of assigning non-admin users read access to TI processes!