DefaultRights N

    DefaultRights N

    Hi there,

    I am thinking about changing the DefaultRight from D to N, the reason being if new elements are created we do not want them to be automatically open for R/W/D.

    Also, since many users are going to be able to see their respective department values we want to prohibit easy access to unrelated numbers for these accounts without having to
    set every element to N. We do know that going through Numbers is the whole idea behind a BI tool, but not all numbers are meant to be seen and interpreted by everyone.

    If i go ahead and just change it, what things do I have to think about?

    The problem I see right now is the "_internal_worker" and also the "admin" are both part of the admin group
    Will they be unable to write/read/delete in unspecified areas, effectively crippling the ETL?

    Or maybe my aproach to the rights system is entirely wrong and this requirement should be handled differently?
    Hi DataPhi,

    DataPhi wrote:

    I am thinking about changing the DefaultRight from D to N, the reason being if new elements are created we do not want them to be automatically open for R/W/D.


    imho the change in DefaultRight depends from the structure of your database. For instance if you have only one dimension that is rather stable then you can use D and limit it using N/D on the groups accordingly.

    DataPhi wrote:

    without having to
    set every element to N.


    rules in #_GROUP_CUBE_DATA_<cubename> cubes are your friends. There you can open or close slices or cells very easily

    DataPhi wrote:

    The problem I see right now is the "_internal_worker" and also the "admin" are both part of the admin group
    Will they be unable to write/read/delete in unspecified areas, effectively crippling the ETL?


    I would not use the admin account at all, especially for ETL works. create an etl user and and an etl group then limit the rights of the etl group to the minimum
    laloune

    Post hoc, non est propter hoc
    Hi again ;)

    imho the change in DefaultRight depends from the structure of your database. For instance if you have only one dimension that is rather
    stable then you can use D and limit it using N/D on the groups accordingly.

    We have 2 Dimensions that get filled and updated with data out of our erp system.
    The problem I have is, if by accident or whatever the reason, one element looses its consolidation, this element also looses its heredited rights.
    If there is a way to just set the default right of one dimension I'd highly prefer it over setting everything do N.

    I would not use the admin account at all, especially for ETL works. create an etl user and and an etl group then limit the rights of the etl group to the minimum

    This is something I actually didn't think about at all, thank you!
    Not smart of me, since we make sure in every other environment to keep the admin interaction at minimum!