0

How to hide Hierarchy/Measures for specific Role Types (CLS)

This use case is around column level security and hiding certain columns based off of user role.

 

I am trying to hide certain dimensions and measures depending on the role of the user that is looking at a discovery. For example, say we have 2 user types:

1. Admin

2. User

 

Say we have a data model that had 4 dimension tables and 4 measure folders. When "admin" logs in we want them to be able to see all fields in both the 4 dimension tables and 4 measure folders. But when "user" logs in, we only want them to be able to see a subset of fields within the 4 dimension tables and 4 measure folders.

 

I have figured out two solutions so far but I'm not entirely satisfied with either.

 

Solution 1: In Admin Console->Data->Source Manager->...->Model->Hierarchy Security and Measure Security - For each role I can apply hierarchical/measure security so that the user cant query from the specific field. If they log in and create a new discovery and pull in a chip that they don't have access to, it gives them an error saying they cant access this data. That's good they cant access the data but I don't want them to see the field at all.

 

Solution 2: In a Model File>Data Model->Tables - I can look at each table and mark certain fields as "Masked Columns". Picking full encryption and enabling it for the user role in In Admin Console->Data->Source Manager->...->Model->Hierarchy Security->Masked means that when a user tries to pull this chip in, it gives them an encrypted string. Again Im happy they cant see the data, but I don't want them to see the field at all.

 

Is there someway I can hide certain fields in my data model by user role? Maybe some way to do it with a PQL script. Any help is appreciated.

2 replies

null
    • samuel_alma
    • 12 days ago
    • Reported - view

    Option #1 already works as you would like. You need to ensure you login as that user, cleanly, and you'll see hierarchies and measures are not visible at all.

      • Glenn_Trace
      • 12 days ago
      • Reported - view

       Ohhh you are certainly correct! I'm not sure why it wasn't working before. Thanks!

Content aside

  • Status Answered
  • 12 days agoLast active
  • 2Replies
  • 12Views
  • 2 Following