Property DAP does not aggregate correctly on nodes- BPC 10 SP11

[Former Member]

Hi

We are on BPC 10, SP11 and we are using property based security for Company code hierarchy, we are securing users such that when they run a report they can see only the company codes from the hierarchy they are autorised to via property, everything works as expected and shows only the nodes user has access to but it still shows the total of the missing nodes too  not the authorized values, until user clicks on  "Calculate

Parents in Hierarchies" option. Thats when it sums just the members that are being displayed.

we reached SAP and they came back that this is the only option currently, But this is a problem since users should not be seeing the totals of all companies

1.Reaching out to see if anyone can suggest a better option for such scenario

if not

2. Is there an option that the check box  "Calculate  Parents in Hierarchies"  is turned on by default for all reports

Thanks

Srikanth

[former_member186338 · Accepted solution]

Hi Srikanth,

What do you mean by property based security?

Anyway, aggregation is done by hierarchy, not by property! And if the user has rights to see Company parent - then it will show total of all children.

Each user can select Options->Sheet Options->Refresh->Calculate  Parents in Hierarchies->Set as Default. Then all new reports will have this option enabled.

But it's not the right way of doing things. If you require for some users to see total for a number of companies you can create additional parents and provide appropriate access rights.

B.R. Vadim

[Former Member]

Thanks for your detailed explanation. That clarifies

[Former Member]

Thanks, one question, when we give a user Europe alone(C3+C4), does he see COMPANY_GROUP_WORLD total or not? if he sees it does the total showup as (C1+C2+C3+C4) even though C1 and C2 are not being showed as individual entites..

thanks

Srikanth

[former_member186338]

No, we provide this user access to EUROPE, COMPANY3 and COMPANY4. That's all!

If we provide him read access to COMPANY_GROUP_WORLD - then this user will see C1+C2+C3+C4, but not individual C1 and C2

Vadim

[Former Member]

Hi Vadim,

I understood that aggregation happens on nodes based on your first explanation but how do we justify business team that , you cannot see the nodes you are restrcited to but you can see the total and also on the initial load the companies being shown and the totals doesnt match , how do we use it ? thats the question i have, please let me know your thoughts

thanks

Srikanth

[former_member186338]

Let me provide some example:

You have the following hierarchy

COMPANY_GROUP_WORLD

   COMPANY1

   COMPANY2

   COMPANY3

   COMPANY4

COMPANY_GROUP_WORLD - means that it's the result of all companies in the world

If you have to provide access to subgroups of companies for some users then you create:

COMPANY_GROUP_WORLD

   USA

       COMPANY1

       COMPANY2

   EUROPE

       COMPANY3

       COMPANY4

All subgroups within one hierarchy!

In the rare case when for some reason subgroups are overlapping you have to add new hierarchy.

Vadim

[Former Member]

Agree Vadim, but the new feature of property as per SP12 would have been lot easier to maintain and clean by just setting a property we could eliminate building extra hierarchies everytime a group of users needs to be restricted.(had it worked as expected  ).Thanks again

Srikanth

[former_member186338]

Hi Srikanth,

I do not understand the relation between property based DAP and aggregation on nodes. Nodes always aggregate all children and if the user have read access for a node then the total of all children will be shown. There is no aggregation based on access rights.

Property based DAP allows simplified security maintenance (note 1863171) but nothing to do with aggregation.

Vadim

[Former Member]

Thanks Vadim and Raj for your time and inputs, i will present it to the client today and see if they are ok with the options we have, Raj by any chance do you know if the change on EPMXLClientPreference.XML can be done for all users by system admins as a universal push or individual users need to do ?

Thanks again

Srikanth

[former_member186338]

Hi Srikanth,

Using some script for workstation administration during login it's possible to find the line in EPMXLClientPreference.XML (in the user profile):

    <CalculateParentsInHierarchy>false</CalculateParentsInHierarchy>

and change it to

    <CalculateParentsInHierarchy>true</CalculateParentsInHierarchy>

But the user can change this setting back to false...

Vadim

[rajkumar_kandula]

Hi Srikanth,

We can do it by running a script file(.bat) in all the cusr machines. You can check with your IT team/System administrators to get this done.

All you need to do is to replace the existing EPMXLClientPreference.XML file with the new file with the required changes. For more details on how we can centrally do this you can go thourhg this blog. It will provide you some idea.

Regards,
Raj

[former_member186338]

Hi Raj,

Not the best idea to replace the whole file - all user settings will be reset according to the template EPMXLClientPreference.XML. Simple vbscript code is able to replace a single line!

But the issue is that the user will be able to change this setting using EPM interface and see figures that he has no authorization to see!

Vadim

[Former Member]

Thanks for your Valuable inputs, but the end of the meeting we had to drop off the idea of setting up security by property and use alternative hierarchies for now due to the problem with aggregation

thanks
Srikanth

[former_member186338]

Yes, that was my original proposal:

"But it's not the right way of doing things. If you require for some users to see total for a number of companies you can create additional parents and provide appropriate access rights"

And in this case you will be able to define security exactly the way you want.

Vadim

[rajkumar_kandula]

. Is there an option that the check box  "Calculate  Parents in Hierarchies"  is turned on by default for all reports

You can acheive this by setting the value of "CalculateParentsInHierarchy" to true in the file EPMXLClientPreference.XML on your frontend PC.

[rajkumar_kandula]

Hi Srikanth,

This feature of providing security based on member properties is pretty new which came with SP12. As this is a new feature its still have some issues and at this point of time you cannot expect much support from SAP.

Coming to the second option, you can check the box Calculate  Parents in Hierarchies and save it as default options using the button "Save as Default". So that you can enable this option by default for this sheet.

If you want to enable this at individual report level you can enable this property in Report Editor as well.

Hope this helps you. Let me know in case of any further information. Thanks.

Regards,

Raj