Synchronizing Roles in Panorama

September 15, 2007

Panorama Nova View Analytics is a viewer on a cube which enables you to drag and drop attributes and measures onto a grid, so as to study the influences different slicers and dicers have on a measure. Each combination of slicers and dicers with a certain measure, can be saved as a presentation (the name in Panorama for a dynamic report). The presentation is dynamic, as you can change not only the filters on the existing attributes (as in Reporting Services), but also add new attributes and remove the old ones, creating a new presentation altogether from the one you started with. A collection of presentations is saved into a book. Usually, a book will have presentations on a single cube, though that’s not obligatory. The application in itself is based on a Java Applet, and the presentations are based on MDX queries that run in the background each time you change an attribute.


In the Panorama Nova View Administrator, you coordinate all the user security definitions there are against a book. After connecting your user groups to the role definitions you gave them in your OLAP cube, you need to synchronize the roles.


Panorama has it’s own user with which it connects to the cube. The Panorama user has full access to the cube. When Panorama makes a query, (whether to build a new presentation or just show the user an existing one), it uses the Panorama user and plants the actual user (or the relevant user group – depending on how you defined it in the cube) as a parameter in the filter of the MDX query. An MDX query using just the Panorama User, would have access to all the data in the cube. The MDX query with the user name in it’s filter, on the other hand, will only show the user what it has been granted to see in the cube. The query with the Panorama user is the one running when you define a presentation in the Panorama Nova View Desktop. The query with the actual user, is the one running when the user looks at the presentation through the Panorama Web Access. So, if I defined a presentation with salary measures in it, but you are in a user group that is not allowed to see salary measures, then you will see the presentation as having no data in the Web Access.


To enforce the security definitions, you need to tick a square saying you should do so in the Administrator tool, and also synchronize the roles. Synchronizing roles does two things:


 



  1. Update the list of people which belong to the user group.
  2. Update the restrictions you gave to that user group in your SSAS project.

Until you synchronize roles Panorama will allow users to look at presentations according to the old definitions it had – both for the people belonging to the user group and to what they can see.


So, if you add a user group or change definitions to your roles in the cube – don’t forget, Panorama needs to know about it as well!

Add comment
facebook linkedin twitter email

Leave a Reply

Your email address will not be published.

You may use these HTML tags and attributes: <a href="" title=""> <abbr title=""> <acronym title=""> <b> <blockquote cite=""> <cite> <code> <del datetime=""> <em> <i> <q cite=""> <s> <strike> <strong>

*