Overview

Many SAS administrators use groups to make authorization maintenance easier. Beginning with SAS 9.2, you have access to a new dynamic metadata association called IdentityGroups. You can use this new metadata association to define member-level permissions for groups on SAS OLAP cubes.

About the sample cube

This sample demonstrates how to use the IdentityGroups association to define member-level permissions on SAS OLAP cubes. This sample uses a cube that is built on the PRDSALE table available in the SASHELP library. The structure of the cube is shown in the following display:

To create the sample cube, you can submit the code from the Full Code tab.

When using sasdemo to view the cube without any member-level permissions, sasdemo can see CANADA, GERMANY, and U.S.A.

For this sample, you will restrict the cube so that sasdemo can view data only for CANADA and GERMANY.

Prepare the groups

1. With the User Manager plug-in to SAS^® Management Console, create groups for CANADA and GERMANY in the metadata, as shown in the following display.



Note: The values entered for the group names must match values that already exist in your data.

2. Add sasdemo as a member of these groups.

Create the member-level permission condition

Follow the instructions in How to Assign an OLAP Permission Condition to add a member-level permission condition that uses IdentityGroups associated with sasdemo. Your expression should leverage the IdentityGroups association. For example, the following expression allows sasdemo to see CANADA and GERMANY and their descendants.

generate(Filter({[GeoDim].members as [T]},IN([T].Current.name,"SUB::SAS.IdentityGroups")),
union(ascendants([T].current),descendants([T].current)))

Your expression window should look similar to the following:

Note: When you save this expression, you might se an error or message because IdentityGroups cannot validate properly when the expression is created. However, the expression should be valid and enforced when viewing the cube.

Test the condition

With this member-level permission condition applied, sasdemo can see data only for CANADA and GERMANY, as shown in the following display.

This association is dynamic, based on the groups that sasdemo is a member of. For example, if you remove sasdemo from the CANADA group, then sasdemo would be able to see data only for Germany.

Additional Documentation

For more information about member-level permissions, see OLAP Member-Level Permissions.

For more information about cubes, see the SAS OLAP Server and SAS OLAP Cube Studio documentation pages.

---

These sample files and code examples are provided by SAS Institute Inc. "as is" without warranty of any kind, either express or implied, including but not limited to the implied warranties of merchantability and fitness for a particular purpose. Recipients acknowledge and agree that SAS Institute shall not be liable for any damages whatsoever arising out of their use of this material. In addition, SAS Institute will provide no support for the materials contained herein.

Before submitting this code, these tasks must be done:

• The PRDSALE table and its library (in this sample, SAMPLE) must be registered in metadata.

Note: For information about registering libraries and tables, see Establishing Connectivity to a Library of SAS Data Sets.

• The LIBNAME, CUBE, PATH, HOST, PORT, and OLAP_SCHEMA options must be modified to use the correct values for your environment.

OPTIONS VALIDVARNAME=ANY;


LIBNAME sample BASE "C:\Program Files\SAS\SASFoundation\9.2\core\sashelp";

PROC OLAP
   CUBE                   = "/Shared Data/Cubes/PRDSALE"
   DATA                   = sample.PRDSALE
   DRILLTHROUGH_TABLE     = sample.PRDSALE
   PATH                   = 'C:\Cubes'
   DESCRIPTION            = 'PRDSALE'
;


   METASVR
      HOST        = "servername"
      PORT        = 8561
      OLAP_SCHEMA = "SASApp - OLAP Schema";

   DIMENSION ProdDim
      CAPTION          = 'Product'
      SORT_ORDER       = ASCENDING
      HIERARCHIES      = (
         ProdDim 
         ) /* HIERARCHIES */;

      HIERARCHY ProdDim 
         ALL_MEMBER = 'All ProdDim'
         CAPTION    = 'ProdDim'
         LEVELS     = (
            PRODUCT 
            ) /* LEVELS */
         DEFAULT;

      LEVEL PRODUCT
         FORMAT         =  $CHAR10.
         CAPTION        =  'Product'
         SORT_ORDER     =  ASCENDING;

  DIMENSION GeoDim
      CAPTION          = 'Geography'
      SORT_ORDER       = ASCENDING
      HIERARCHIES      = (
         GeoDim 
         ) /* HIERARCHIES */;

      HIERARCHY GeoDim 
         ALL_MEMBER = 'All GeoDim'
         CAPTION    = 'GeoDim'
         LEVELS     = (
            COUNTRY REGION 
            ) /* LEVELS */
         DEFAULT;

      LEVEL COUNTRY
         FORMAT         =  $CHAR10.
         CAPTION        =  'Country'
         SORT_ORDER     =  ASCENDING;

      LEVEL REGION
         FORMAT         =  $CHAR10.
         CAPTION        =  'Region'
         SORT_ORDER     =  ASCENDING;

   DIMENSION TimeDim
      CAPTION          = 'Time'
      TYPE             = TIME
      SORT_ORDER       = ASCENDING
      HIERARCHIES      = (
         TimeDim 
         ) /* HIERARCHIES */;

      HIERARCHY TimeDim 
         ALL_MEMBER = 'All TimeDim'
         CAPTION    = 'TimeDim'
         LEVELS     = (
            YEAR QUARTER MONTH 
            ) /* LEVELS */
         DEFAULT;

      LEVEL YEAR
         FORMAT         =  4.
         TYPE           =  YEAR
         CAPTION        =  'Year'
         SORT_ORDER     =  ASCENDING;

      LEVEL QUARTER
         FORMAT         =  8.
         TYPE           =  QUARTERS
         CAPTION        =  'Quarter'
         SORT_ORDER     =  ASCENDING;

      LEVEL MONTH
         FORMAT         =  MONNAME3.
         TYPE           =  MONTHS
         CAPTION        =  'Month'
         SORT_ORDER     =  ASCENDING;

   PROPERTY Country
      LEVEL          = COUNTRY
     COLUMN         = COUNTRY
      CAPTION        = 'Country'
      HIERARCHY      = (
         GeoDim 
         ) /* HIERARCHIES */;

   MEASURE ACTUALSUM
      STAT        = SUM
      COLUMN      = ACTUAL
      CAPTION     = 'Sum of ACTUAL'
      FORMAT      = DOLLAR12.2
      DEFAULT;

   AGGREGATION /* DEFAULT */
      /* levels */
      COUNTRY MONTH PRODUCT 
      QUARTER REGION YEAR 
      / /* options */
      NAME      = 'DEFAULT';



   FORMAT COUNTRY $CHAR10.;

   RUN;

---

These sample files and code examples are provided by SAS Institute Inc. "as is" without warranty of any kind, either express or implied, including but not limited to the implied warranties of merchantability and fitness for a particular purpose. Recipients acknowledge and agree that SAS Institute shall not be liable for any damages whatsoever arising out of their use of this material. In addition, SAS Institute will provide no support for the materials contained herein.

Operating System and Release Information