SSAS Dynamic Dimension Security based on another dimension attribute - security

In my project I have to apply security based on a dimension attribute.
I think the best way to explain my scenario is with an example, if you need more info please request me and I'll love to told you if it will help me find a solution.
I have some main dimension, the dimcustomer, dimseller, fact, data and geographic.
The fact table are related with dimseller ids, the dimcustomer is related to the dimseller based on one dimseller specific attribute(CNPJ)(another dimensions that i didnt described are related the same way).
So my goal is to apply a role security based on the dimseller CNPJ, so then when the user related with that seller trys to browse data he will be allowed to view only the data that are related to his seller CNPJ.
Table example:
DIM Seller: DIM Customer FactTable
id name cnpj id name dimseller.cnpj dimseller.id dimcustomerid measure
1 ME 1234 1 guest1 1234 1 1 50,00
2 you 5678 2 guest2 5678 2 2 100,00
So if i login as ME i will be able to se that i have the customer guest1 with one sold product that was sold by 50 bucks.
Got my point?
What is the best way of doing it?
For now I'm considering the following guide: Claim Authentication with dynamic dimension security, but at that way I should define it attribute by attribute.
Is there a way that i can define this security need? I can easy filter the data using sql statements, but i have no ideia how i can apply this kind of security in the ssas.
Thank you guys anyway!

To apply security within a dimension, you need to use roles. For each roles, you can then specify which element in the cubes/dimensions that are available to that role. So, what you got to do is to create a role by CNPJ that will be able to view only their CNPJ.

Related

Restrict user to change class o_invisible_modifier from developer tools Odoo11

I am showing certain notebook/page according to user groups in Odoo11 form.
As per my architecture i am unable to use access record rule as per groups for all employee but as an alternative i made all fields invisible employee form(except employee name) for other employee and user can see full information for his/her record only. But now i can see security issue with inspect element(developer tool) where users able to see other employee information by removing class(.o_invisible_modifier) from developer tool. So, how i can secure my system by removing this issue?
Note: I am already block keyboard short-cuts and events for inspect element by J query.
Please suggest me best solution.
Thanks in advance.
For same reason Employee model is changed starting form Odoo 13.
Now its split between 2 models. Where personal info is present on one model and public info is on the other model.
But you can maybe do extra manual check. When you overwrite write and i think it was read.
https://github.com/odoo/odoo/blob/5b335396addb16456d61273ae6b0446913f7f489/addons/project/models/project.py#L1607
https://github.com/odoo/odoo/blob/5b335396addb16456d61273ae6b0446913f7f489/addons/project/models/project.py#L1625

Join Account to Sub Account

I am trying to create a GI to retrieve a list of GL Accounts with each associated Sub Account value. I have looked in the database and found the GroupMask column which ties the Account and Sub tables together with a bit relationship but I don't know how to join them in the GI. Is there another resolution table I can use to link the two entities?
The only thing I find in standard Acumatica is screen GL403000 (Account by Subaccount). This screen is an inquiry into historical GL data. Although I may be wrong, I believe accounts and subaccounts are defined as separate entities and then become a legitimate combination when used together. For instance, a sub account might be mapped to a department and an inventory account mapped to the item. Material issued to the department would result in the reportable combination of account and subaccount. That means you would have to look for historical usage of an account/subaccount to get the list. That's what GL403000 appears to be doing.
I can't tell you for sure that this is proper, but see if you can find what you need from:
GL.Account -> GL.GLHistory -> GL.Sub
Join Account to GLHistory via AccountID and GLHistory to Sub via SubID. You will want to aggregate the results to unique combinations or filter by period.
The actual code behind GL403000 is:
PXSelectBase<GLHistoryByPeriod> cmd = new PXSelectJoinGroupBy<GLHistoryByPeriod,
InnerJoin<Account,
On<GLHistoryByPeriod.accountID, Equal<Account.accountID>, And<Match<Account, Current<AccessInfo.userName>>>>,
InnerJoin<Sub,
On<GLHistoryByPeriod.subID, Equal<Sub.subID>, And<Match<Sub, Current<AccessInfo.userName>>>>,
LeftJoin<GLHistory, On<GLHistoryByPeriod.accountID, Equal<GLHistory.accountID>,
And<GLHistoryByPeriod.ledgerID, Equal<GLHistory.ledgerID>,
And<GLHistoryByPeriod.branchID, Equal<GLHistory.branchID>,
And<GLHistoryByPeriod.subID, Equal<GLHistory.subID>,
And<GLHistoryByPeriod.finPeriodID, Equal<GLHistory.finPeriodID>>>>>>,
LeftJoin<AH, On<GLHistoryByPeriod.ledgerID, Equal<AH.ledgerID>,
And<GLHistoryByPeriod.branchID, Equal<AH.branchID>,
And<GLHistoryByPeriod.accountID, Equal<AH.accountID>,
And<GLHistoryByPeriod.subID, Equal<AH.subID>,
And<GLHistoryByPeriod.lastActivityPeriod, Equal<AH.finPeriodID>>>>>>>>>>,
Where<GLHistoryByPeriod.ledgerID, Equal<Current<GLHistoryEnqFilter.ledgerID>>,
And<GLHistoryByPeriod.accountID, Equal<Current<GLHistoryEnqFilter.accountID>>,
And<GLHistoryByPeriod.finPeriodID, Equal<Current<GLHistoryEnqFilter.finPeriodID>>,
And<
Where2<
Where<Account.accountID,NotEqual<Current<GLSetup.ytdNetIncAccountID>>,And<Where<Account.type, Equal<AccountType.asset>,
Or<Account.type, Equal<AccountType.liability>>>>>,
Or<Where<GLHistoryByPeriod.lastActivityPeriod, GreaterEqual<Required<GLHistoryByPeriod.lastActivityPeriod>>,
And<Where<Account.type, Equal<AccountType.expense>,
Or<Account.type, Equal<AccountType.income>,
Or<Account.accountID,Equal<Current<GLSetup.ytdNetIncAccountID>>>>>>>>>>>>>,
Aggregate<
Sum<AH.finYtdBalance,
Sum<AH.tranYtdBalance,
Sum<AH.curyFinYtdBalance,
Sum<AH.curyTranYtdBalance,
Sum<GLHistory.finPtdDebit,
Sum<GLHistory.tranPtdDebit,
Sum<GLHistory.finPtdCredit,
Sum<GLHistory.tranPtdCredit,
Sum<GLHistory.finBegBalance,
Sum<GLHistory.tranBegBalance,
Sum<GLHistory.finYtdBalance,
Sum<GLHistory.tranYtdBalance,
Sum<GLHistory.curyFinBegBalance,
Sum<GLHistory.curyTranBegBalance,
Sum<GLHistory.curyFinYtdBalance,
Sum<GLHistory.curyTranYtdBalance,
Sum<GLHistory.curyFinPtdCredit,
Sum<GLHistory.curyTranPtdCredit,
Sum<GLHistory.curyFinPtdDebit,
Sum<GLHistory.curyTranPtdDebit,
GroupBy<GLHistoryByPeriod.ledgerID,
GroupBy<GLHistoryByPeriod.accountID,
GroupBy<GLHistoryByPeriod.subID>>>>>>>>>>>>>>>>>>>>>>>>>(this);
As you can see, it joins Account to GLHistoryByPeriod and then Sub to GLHistoryByPeriod. AH inherits from GLHistory.
Account and Subaccount entities are separate entities without a relationship between each other. GroupMask field is not about their relationship, it is about access restriction. Please correct your question and explain what do you really need? Note that Account and Subaccount are only connected in the scope of some transactional or historical entities, such as GL Transactions (GLTran), AR/AP Documents (ARRegister, APRegister) and many many others.
As it was already mentioned Account and sub account doesn't have direct link between them. If you still want to have some kind of connection between them, then consider adding custom column(s). Before doing this, give an answer on this question:
What will be relationship between account and sub account?
One to one, one to many, or many to many?
What kind of rules regarding defaulting of sub accounts be applied?
As an option if some account is selected on some entity, what sub account should be picked?
Opposite to 4, if some sub account is selected at some entity, what Account should be selected.
And so on. Then you can build customization package which will provide an answer on relationshops.

Load Runner facing isse during Dyanmic data handling

I am using load runner 9.5. I am facing a problem during Dyanmic data handling. Scenario is given below-
I have Library management application. Login-> Select book(data display based on User credential) -->Purchage and Logout.
Ex: Guest user: 50 Books display to choose
Admin : All Books display choose
Normal user : 100 Bokks display choose
Please help me How to handle these type of dynamic data based on user role. Is there need to create different script with different role ?
Please follow the below steps -
Record the same flow with the same user credential 2 times (Replica of first script)
Compare the scripts using W diff
Find the values which are different like purchase order, timestamp and user session.
Correlate the values which are highlighted in yellow means value which is different in each script.
Have you had the benefit of training in LoadRunner and a mentor for your first year of work in this field?

CRM 2011 Filtering view on related record type

I want to create a new view for the activities entity. My aim was to show only the activities that were related to a record of a certain type eg account. But when i was creating it i saw that aside from saying if it contains data or not, and for specific records, there isnt an option for entity type.
I can understand why this isnt an option in the list, as its not really something people would need to do, but is this possible at all?
Thanks
Create an Advanced Find and specify the following criteria:
Look for: Activities
Related > Regarding (Account)
This will get you all activities which are related to an account.

expression engine: best way to handle user data, defined member fields or tie to a channel?

In expression engine:
I have a site that businesses can sign up and then sell 1 type of widget. Each business just needs name, widget and price. Then there will be a page that shows all business, with their widget and price.
What is the best way to handle the extra parameters 'widget' and 'price'?
From what I can work out there are two options
1/ Sign up the business as a user in a group with no admin privilages. Add the two custom member fields 'widget' and 'price' for the users. (It may not be called 'member' field, I'm going off my memory). To show these business I then grab the users.
or
2/ Sign up the business as a user in a group with no admin privilages. Add a one custom member field called 'id'. Then create a 'business' channel and to that channel add the custom fields 'name', 'widget', 'price', 'user_id'. Then link the instance of the business channel to the user with the 'id' property. When I want to show these business I grab the details from the channel.
Sorry if this is already answered somewhere. I'm not getting much luck from google, most likely because i'm having trouble phrasing my question succinctly enough.
Thanks
Dave
Dave,
If you're dead set on using users to organize these businesses, then your best bet would be the two custom fields. They're easier to use in templates and you don't have to worry about pulling in the channel data for the item in the custom member field 'id'. That being said, you should check out Solspace's User Module—it'll give you more flexibility with the member information.
Another thought, and depending on whether or not these businesses should be able to edit their widget and price, is you could just make it a channel and skip using users altogether. Using Freeform, you could create a form where businesses add that information, you get an email, and you add the information to the channel you want.
Wes

Resources