Skip to Content
author's profile photo Former Member
Former Member

SSM KPI Security:Restricting the measures to Users

Hi

I want to restrict only few KPIS(measures) to be accessed by a particular user. I was able to restrict only 22 measures(4 KPIs), beyond which i get an error.But this user should be able to access 20 KPIs(20*5 measures). The syntax that i used:

INDEX USER

CASE USER1

SELECT VARIABLES KPI59_ACT,KPI59_TAR,KPI59_TRD,KPI59_TARDEV,KPI59_TRDDEV,KPI20_ACT,KPI20_TAR,KPI20_TRD,KPI20_TARDEV,KPI20_TRDDEV,KPI58_ACT,KPI58_TAR,KPI58_TRD,KPI58_TARDEV,KPI58_TRDDEV,KPI57_ACT,KPI57_TAR,KPI57_TRD,KPI57_TARDEV,KPI57_TRDDEV,KPI2_ACT,KPI2_TAR,KPI2_TRD,KPI2_TARDEV,KPI2_TRDDEV

ENDINDEX

1. Is there any way that i can restrict the access to 20 KPIs (20*5 measures)?

I also tried the following syntax but of no avail:

For example here i tried restricting access to 3 KPIs(each of which has 5 measures:Tar,Act,Trend,Gap Performance,score)

SELECT VARIABLES KPI1_* , KPI21_* , KPI33_*

2. Is there a limit on the number of characters used in the select statement because of which only few measures were included in my case?

Add a comment
10|10000 characters needed characters exceeded

Assigned Tags

Related questions

6 Answers

  • Best Answer
    author's profile photo Former Member
    Former Member
    Posted on Nov 07, 2008 at 01:34 PM

    Hello!

    I would suggest in these cases to use the folowing syntax:

    INDEX USER

    CASE USER1

    SELECT VAR KPI59*

    SELECT VAR PLUS KPI20*

    SELECT VAR PLUS KPI58*

    SELECT VAR PLUS KPI57*

    ....

    ENDINDEX

    When you are trying to just exclude one (or even just a few) measure(s), it will be more effective to type it like this:

    INDEX USER

    CASE USER1

    SELECT VAR *

    SELECT VAR MINUS KPI20*

    SELECT VAR MINUS KPI58*

    ...

    ENDINDEX

    After creating the SECURITY procedure, run it with

    job SECURITY

    command in IDQL command line. You will then be able to see right away if and where any syntax error occurs.

    Hope this helps!

    BR,

    Ricardo Vieira

    Add a comment
    10|10000 characters needed characters exceeded

  • Posted on Nov 03, 2008 at 02:16 PM

    Praveen,

    You would do this by creating a PAS User, on the PAS side, and define which measures or variables that user would have access to. Then you match that in your Model Connection with the application groups.

    As an example, you create a PAS User of AMERICAS or EUROPE that has a subset of the model available to them, Then when setting up you Model Connection, in the Administrator's Interface of SSM, instead of the default GUEST for PAS User, you would use AMERICAS and then match the groups and users to that connection.

    Regards,

    Bob

    Add a comment
    10|10000 characters needed characters exceeded

  • author's profile photo Former Member
    Former Member
    Posted on Nov 04, 2008 at 05:29 AM

    Hi Bob,

    I have done all those setups and was able to restrict upto 4 KPIs to a particular user. My question is not about how to restrict a measure to a user. My problem statement is : what is the limit of number of measures that can be restricted to a user?.

    After creating PAS user, say AMERICAS, and doing required settings in Adminstrator Interface, i created a procedure to restrict measures to this user AMERICAS.

    Going with example:

    The follwoing statement allows user AMERICAS to access only KPI2, which iam able to achieve.

    INDEX USER

    CASE AMERICAS

    SELECT KPI2_ACT,KPI2_TAR,KPI2_TRD,KPI2_TARDEV,KPI2_TRDDEV

    ENDINDEX

    But if i want to restrict access to more KPIS, say 20 KPIs to this user, it shows me error. Is that because of the length of the characters in the SELECT statement? If yes, what is the limit of number of characters that is allowed in SELECT statement. And how do i do restrict access to 20KPIS?

    Hope iam clear.

    Add a comment
    10|10000 characters needed characters exceeded

  • author's profile photo Former Member
    Former Member
    Posted on Nov 04, 2008 at 09:12 AM

    Hi Praveen:

    I think you use the wrong syntax for selecting all 5 measure of one KPI.

    try to use KPI1* instead of KPI_*

    INDEX USER

    CASE USER1

    SELECT VARIABLES KPI59*

    ENDINDEX

    And another suggestion for you, at first I also use kpi1, kpi2, kpi3, ...,

    but at last I found I should name KPI to meanful name, such like cost, reveune.

    Because all these kpi should be used in four perspective and in most case will cross different context, which has different kpi.

    So use 1,2,3 to name is not a good way ^ - ^

    Wish to keep touch with you, I am also a consultant focus on SSM and CPM.

    Have a nice day ^ - ^

    Add a comment
    10|10000 characters needed characters exceeded

  • author's profile photo Former Member
    Former Member
    Posted on Nov 04, 2008 at 10:15 AM

    Hi Louis

    1. The syntax you suggested wont do in all cases. For example: take two KPIs KPI12 and KPI121. In this case if i want only KPI12 to be accessed and if the folllowing syntax is used:

    INDEX USER

    CASE USER1

    SELECT KPI12*

    ENDINDEX

    Then both KPI12 and KPI121 will be accessed and that is why i used KPI12_*( because measures of KPI12 would be like KPI12_ACT,KPI12_TAR,KPI12_TRD).

    2. The KPI name KPI1,KPI2 etc is automatically created when i create the measures from cube builder. For example, if i name the measure as 'Revenue' and select this measure as KPI, then KPI name in the PAS is created as KPI2.

    Add a comment
    10|10000 characters needed characters exceeded

    • Praveen,

      There are not restrictions on the length of the line, I think you can have a thousand characters on a line. Also, there shouldn't be a limit in the number of KPIs you want to restrict. The problem would be that if you made an error in entering, like a typo or included anything incorrect, that would get you an error message.

      Check to make sure that you have correctly entered everything.

      If you continue to get an error message, best to open a CSS ticket.

      Regards,

      Bob

  • author's profile photo Former Member
    Former Member
    Posted on Nov 05, 2008 at 03:12 AM

    Hi Praveen:

    I see what you said about kpi1* will find kpi1, kpi12, kpi13

    So you suggest you use meanful kpi name.

    And also i think you use the design tool in excel-based (ssm 2007) or web-based (ssm 7.0).

    I suggest that just use these tools as the initial of ssm project, and in actual project using numberic naming kpi will cause some problem and uneasy.

    As to your current suitation, I suggest your change your KPI name, which will not cost you lots time. Because for front-end, scorecard design and entry&approval is just read the description of KPI. So there is no need to change in front-end. But if you have average or summary consolidation KPI, you need to manully change the "CONSOLIDATION" file in document folder in PAS.

    Keep in touch.

    Regards,

    Louis Lu

    Add a comment
    10|10000 characters needed characters exceeded

Before answering

You should only submit an answer when you are proposing a solution to the poster's problem. If you want the poster to clarify the question or provide more information, please leave a comment instead, requesting additional details. When answering, please include specifics, such as step-by-step instructions, context for the solution, and links to useful resources. Also, please make sure that you answer complies with our Rules of Engagement.
You must be Logged in to submit an answer.

Up to 10 attachments (including images) can be used with a maximum of 1.0 MB each and 10.5 MB total.