BPC Security architecture

Hello, Experts

Does somebody know where BPC check users rights ? Is the checking performed in IIS Server or ABAP Server in SAP BPC 7.5?

It seems that .Net Server (IIS) only checks is user in Active Directory or not but the checking of ability to read&write data to cube is performed inside Netweaver. This question is important for me because I am designing some additional functonality in SAP Netweaver which will be called from SAP BPC Office. I can't call RFC functionality directly from Microsoft Excel because BPC uses AD security and SAP NW uses SAP security. So, It seems that I have to create .Net layer.

--

Pavel