Hitachi Vantara Pentaho Community Forums
Results 1 to 21 of 21

Thread: Pentaho Cube - role setup not working

  1. #1

    Default Pentaho Cube - role setup not working

    I designed a cube and tried to set access controls for the cube by adding roles. But the access levels i designed is not reflecting when i viewed the cube via Pentaho User Console.
    Tools Used:
    ===========
    Pentaho Community Edition BI Suite 3.0 RC2
    Schema Workbench 3.0.4
    Datasource: HSQLDB
    Database: SampleData
    The steps i followed in the above issue is,
    Step 1:
    *******
    I designed a cube using Schema Workbench 3.0.4, which will list all the cities, the customer names in each of those cities, and number of customers in each city. This cube has a role called 'Admin' for which, the dimension 'Cities' has to be hidden.
    Schema for the cube is as follows,
    **********************************
    <Schema name="CubeTesting">
    <Cube name="CustomerCube" cache="true" enabled="true">
    <Table name="CUSTOMERS" schema="PUBLIC">
    </Table>
    <Dimension type="StandardDimension" foreignKey="CUSTOMERNUMBER" name="Cities">
    <Hierarchy hasAll="true" allMemberName="All Cities">
    <Table name="CUSTOMERS" schema="PUBLIC">
    </Table>
    <Level name="Country" column="COUNTRY" type="String" uniqueMembers="true" levelType="Regular" hideMemberIf="Never">
    </Level>
    <Level name="City" column="CITY" type="String" uniqueMembers="true" levelType="Regular" hideMemberIf="Never">
    </Level>
    </Hierarchy>
    </Dimension>
    <Dimension type="StandardDimension" foreignKey="CUSTOMERNUMBER" name="CustomerNames">
    <Hierarchy name="New Hierarchy 0" hasAll="true" allMemberName="All Customers">
    <Table name="CUSTOMERS" schema="PUBLIC">
    </Table>
    <Level name="CustomerName" column="CONTACTFIRSTNAME" type="String" uniqueMembers="false" levelType="Regular" hideMemberIf="Never">
    </Level>
    </Hierarchy>
    </Dimension>
    <Measure name="CustomerCount" column="CUSTOMERNUMBER" datatype="Integer" formatString="####" aggregator="count" visible="true">
    </Measure>
    </Cube>
    <Role name="Admin">
    <SchemaGrant access="none">
    <CubeGrant cube="CustomerCube" access="all">
    <DimensionGrant dimension="Cities" access="none">
    </DimensionGrant>
    </CubeGrant>
    </SchemaGrant>
    </Role>
    </Schema>
    Step 2:
    *******
    I published the cube into the pentaho server in the following path "biserver-ce\pentaho-solutions\bi-developers\analysis" (username & password used to publish was 'Joe' & 'password' respectively)
    Got 'Publish successful' message as well.
    Step 3:
    *******
    Again, in pentaho user console, logged in as user 'joe' who has the role 'Admin'.
    Clicked on 'New Analysis View' button. It listed out the schema and cube i published in step 2.
    Step 4:
    *******
    In the analysis view window, it is showing the complete cube instead of hiding the dimension 'Cities' which was orginally expected based on my 'Dimsension Grant' setting in schema file.

    If anyone can guide me on this, it will be really helpful. Or let me know if you need more details.
    Please advice.
    - Senthil Kumar.

  2. #2

    Default

    New Analysis View doesn't enable roles by default. You can hack the xaction behind it, or deploy your own xaction with roles enabled.

    Tom
    This is a signature.... everyone gets it.

    Join the Unofficial Pentaho IRC channel on freenode.
    Server: chat.freenode.net Channel: ##pentaho

    Please try and make an effort and search the wiki and forums before posting!
    Checkout the Saiku, the future of Open Source Interactive OLAP(http://analytical-labs.com)

    http://mattlittle.files.wordpress.co...-bananaman.jpg

  3. #3

    Default Pentaho - hacking xaction files for enabling roles

    Hello Tom,

    Thanks for your swift reply.

    Can you tell me where i can find the .xaction file for my cube?

    As I am not knowledged in this, pls help me on hacking the xaction file (or to deploy my own xaction file) to enable the roles.

    - Senthil Kumar.

  4. #4
    Join Date
    Oct 2006
    Posts
    219

    Default try

    Try this:

    biserver-ce\pentaho-solutions\system\mondrian\analysis_view_template.xaction

    I was speaking to Tom about it yesterday. Turns out Tom is completely insane.. Who would have thought?

    Haza
    www.ivy-is.co.uk - Ivy Information Systems

    Come join the non official Pentaho IRC chat room on irc.freenode.net in the ##pentaho channel

  5. #5

    Default Roles not working

    hey haza,

    To enable roles, what i have to do in that file you have specified...? If you have any such sample xaction files for enabling roles, pls provide me.

    Or is there any sample available (other than foodmart) to learn about setting access controls for cube?

    - Senthil Kumar.

  6. #6
    Join Date
    Oct 2006
    Posts
    219

    Default

    Senthil Kumar,

    Have you got roles and OLAP permissions working at all? Or is this what you are trying to do? If so i can dig out some samples i made a while back to test this.

    Cheers,

    Harris
    www.ivy-is.co.uk - Ivy Information Systems

    Come join the non official Pentaho IRC chat room on irc.freenode.net in the ##pentaho channel

  7. #7

    Default

    hey,

    thnx 4 ur rply. I am explaining my problem for you again. Pls help me on this.
    For past so many days, I am working on this Pentaho Community Edition BI Suite 3.0 stable version and Pentaho Schema Workbench 3.0.4. Uses HSQLDB SampleData as DB.

    My requirement is, i need to setup access controls for cube ie) different users to see to different contents of cube based on their privileges.
    For ex, like 'Foodmart' sample in mondrian download, user with role 'California Manager' can see only 'CA' region details in the cube.

    To achieve this, as a first step, i tried a simple scenario by designing a cube with two dimensions 'Cities' & 'CustomerNames'. This cube has a role called 'Admin'.
    <Role name="Admin">
    <SchemaGrant access="none">
    <CubeGrant cube="CustomerCube" access="all">
    <DimensionGrant dimension="Cities" access="none">
    </DimensionGrant>
    </CubeGrant>
    </SchemaGrant>
    </Role>

    My intention here is, for users with role 'Admin', when they try to view this cube via Pentaho User Console (by clicking on 'New Analysis View' button or in any other possible ways), i have to hide one of the dimensions (for ex, as per the cube schema definition, i've to hide the dimension 'Cities') in the cube. For other users i've to show the complete cube.

    So I designed the cube, published it into pentaho server. Opened the Pentaho User Console, logged in as user 'joe' (who is the user with role 'Admin' assigned to him). Clicked on 'New Analysis View' button. I then chose the schema from the schema list, but the complete cube is getting loaded instead of hiding the dimension 'Cities'.

    Please note that in the above scenario, till the last i have not did anything related to 'role' setup other than defining the <role> tag in cube schema file. I don't know about the xaction files, how it is created automatically while loading the cube, why it is needed etc.
    But, I did noticed that while the cube is getting loaded, inside the Pentaho server, in a temp folder some <123...>.analysisview.xaction files are getting created.

    To setup access controls for cubes & its contents, in what places i've to configure roles other than defining a <role> tag in schema file? What are those files and what are those changes?

    As this task took more time for me, i have to come to a conclusion and need to submit a report on this. So please help me on this clearly as soon as possible.


    Thanks.....!!!!!!!
    Senthil Kumar

  8. #8

    Default

    I have the same problem. After creating role in Workbench and assigning it to user in PAC I can still see everything.
    How can I force this roles to work correct?

  9. #9

    Default

    Hi, wich version of biserver are you using?.

  10. #10

    Default

    Hi, it is 3.8.0

  11. #11

    Post

    Hi,
    try with this steps:

    1- Stop the biserver
    2- Edit the file pentahoObjects.spring.xml located in /biserver-ce-3.8.0-stable/biserver-ce/pentaho-solutions/system and uncomment this lines:

    <bean id="Mondrian-UserRoleMapper"
    name="Mondrian-One-To-One-UserRoleMapper"
    class="org.pentaho.platform.plugin.action.mondrian.mapper.MondrianOneToOneUserRoleListMapper"
    scope="singleton" />
    3- Start the biserver
    4- Define the same role names in the Worckbench and in PAC and define the grant permissions for every role.

    This method of Role mapper is one of the three available in Pentaho.

    Bye,

    Marcos Pierri

  12. #12

    Default

    Still can see everything....

  13. #13

    Default

    Hi,
    how do you define the roles and grants in Workbench??

  14. #14

    Default

    as in attached screens
    /deleted/
    Last edited by Bezan; 10-18-2011 at 05:34 AM.

  15. #15

    Default

    Hi,
    what are you trying to restrict??. Can you tell me what is the expected behavior?

  16. #16

    Default

    There are 2 cubes: Sales, Excel.
    I would like role MAG to allow access only to Excel cube.

  17. #17

    Default

    Hi,
    in the role MAG define another "Cube Grant" and in the attributes, Acces: none and cube: Sales. With this option you shouldn't access the Excel cube with the MAG rol.

    bye,

    Marcos

  18. #18

    Default

    I added another Cube Grant.
    Now entering Excel I have only "Slicer:" text and no data
    Trying open Sales cube i have following error: "An error occurred while rendering Pivot.jsp. Please see the log for details."

  19. #19

    Default

    Hi,
    in the MAG role delete the "Dimension Grants" and the "Hierarchy Grant". You should have only defined the "Cube Grant".
    The error trying open the Sales cube, I suppose is about the cube grant restriction. See the log file "pentaho.log" in /biserver-ce/tomcat/bin/ to be sure.

    bye,

    Marcos

  20. #20

    Default

    I think cube with "all" is working ok. There is still problem with "none". In log there is: "MDX cube 'Sales' not found". It is not very important but without this error will be better.

  21. #21
    Join Date
    Feb 2013
    Posts
    530

    Default

    HI...I'm newbie to Mondrian. I need the same functionality in Mondrian ?
    Can anybody help me how to achieve this ?
    Requirement is :
    I need to create a cube and have to restrict some columns(measures) for specific users for eg: joe or suzy ?
    i.e, for one user I wanna show for eg: 5 measures and for another user I wanna show 7 measures ....

    Your help would be great
    Thanks in Advance
    Last edited by sadakar; 04-05-2013 at 09:22 AM.

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •  
Privacy Policy | Legal Notices | Safe Harbor Privacy Policy

Copyright © 2005 - 2019 Hitachi Vantara Corporation. All Rights Reserved.