Limiting the access to dimensions
Opening the access panel
If you want to restrict the access to dimensions for certain users or groups, you must open the access editor - which is not part of the dimension editor. To open the editor, click on the "Access" tab in the configuration editor.
The access editor is a simple panel, with a list of all dimensions at the left and a list of access-rules on the right side.
The table at the right side always display the access rules for the currently selected dimension in the left list.
Access rules
In instantOLAP, the access on dimension (or better: on keys )is controlled by a list of boolean expression. If any of these expression returns "true" for the current user and for the current key (the rules are performed on any single key the user wants to access), the user is able to use the key in his query.
Because the expression usually check the user and/or his roles and the current key, common functions used in access expressions are HASROLES and HASUSER. For example, a role "HASROLES( {Product::CATEGORY} )" would grant access to any product if the current user owns a role with the name of the product category.
If a dimension contains no single access rule, every user has access on any key, for reading and for writing.
Adding new rules to a dimension
Use the button "Add rule" from the toolbar to add a new and empty rule to the table.
After you created the row, you can change the type of the rule from "read" to "write". Write rules are checked whenever a user tries to write data into a cube, all read access is controlled by the "read" rows.
The second and last column of the rule is the "Expression" columns which contains the boolean expression for this rule. You can edit the expression inside the table or use the edit button "..." in the cell to open the more comfortable expression editor.
Changing the rule order
If you want to change the order of the expression, select one or more rows by clicking on the icon in the first column and use the "Move up" or "Move down" button to move them inside the table.
The order of the rules has no effect on the access-restrictions, because a user has access on a dimension whenever at least one rule returns "true" - independent on its position inside the table. However, the order of the rules can have a small performance impact because rules matching quite often should be placed at the top (then the system has not to check the following rules).
Deleting rules
To delete a single or multiple rules from the table, simply select them and click onto the "Delete selected rules" button in the toolbar.
This will delete the selected rules without any prior confirmation.
