• Skip to main content
  • Skip to footer
Revelwood Logo

Revelwood

Your SUPER-powered WP Engine Site

  • Who We Are
    • About Us
      • Our Company
      • Our Team
      • Partners
    • Careers
      • Join Our Team
  • What We Do
    • Solutions
      • Workday Adaptive Planning
      • IBM Planning Analytics
      • BlackLine
    • Services
      • Implementation Services
      • Customer Care
        • Help Desk
        • System Administration as a Service
      • Training
        • Adaptive Planning Training
        • IBM Planning Analytics / TM1 Training
    • Products
      • DataMaestro
      • LightSpeed
      • IBM Planning Analytics Utilities
  • How We Help
    • Workday Adaptive Planning Use Cases
    • IBM Planning Analytics Use Cases
    • BlackLine Use Cases
    • Client Success Stories
  • How We Think
    • Knowledge Center
    • Events
    • News
  • Contact Us

MDX

Technical Bulletin: Security Change Impacts MDX

June 11, 2020 by Lee Lazarow Leave a Comment

Tech Bulletins

IBM has decided to revert the change in behavior that is described in this tech bulletin.  The change will be made in version 2.0.9.2 and it is expected to be released by the end of July.  For more information, please reference IBM’s tech note at https://www.ibm.com/support/pages/node/6226890 

We have an important technical bulletin regarding IBM Planning Analytics and MDX.

Version 2.0.9.1 of Planning Analytics changes the way MDX expressions are generated for dimensions that have security defined. This change may have a significant impact on your existing models.

Details

Prior to 2.0.9.1, when generating a subset list based on an MDX expression, Planning Analytics would execute the dynamic subset and then introduce security. Elements in the subset would be determined at runtime even if the user using the subset did not have READ access to a member that is named in the MDX statement. The list of elements in the subset was determined and then filtered by security. This resulted in the user only seeing the elements that were allowed.

As of 2.0.9.1, the system introduces security and then executes the dynamic subset. Users will need to have (at least) READ access to members that are named in the MDX statement. Just as a user could not determine the descendants of a consolidated element in any other user interface (e.g., the hierarchy or set editor) they will not be able to determine descendants of the member by using MDX.  This may result in users not seeing any elements in the resulting expression.

For example:

  • A model contains a dimension named “Company”. The dimension has a consolidated element named “Total Company” with child elements “A”, “B”, and “C”.
  • There is a dynamic subset which returns the base level descendants of “Total Company” via the following expression:
{ TM1FILTERBYLEVEL ( { TM1DRILLDOWNMEMBER( { [Company].[Total Company] }, ALL, RECURSIVE ) } , 0)}
  • A user only has security access to company A via element security.
    • Prior to 2.0.9.1, the result would be that the user sees company A.
      • This is because Planning Analytics created the dynamic subset which included all the elements and then applied security to only allow the user to see company A.
    • As of 2.0.9.1 the result does not include any elements in the subset.
      • This is because Planning Analytics tried to create the subset by starting with Total Company, realized that the user has no access to Total Company, and therefore did not have anything to expand.

Recommended next steps:

Revelwood recommends a review of your system to determine where MDX expressions are used. This includes all dynamic subsets and all dynamic reports/templates (i.e., Active Forms / Dynamic Reports).

Revelwood has created a Turbo Integrator script that will help you assess potential conflicts by analyzing combinations of element security and dynamic subsets. You can download the script for free.

Reviewing your system now will reduce the potential for your end users having problems seeing elements. By being proactive, you have the opportunity to stave off headaches for yourself.

Please contact John Pra Sisto at jprasisto@revelwood.com if you have any questions regarding this bulletin or the Turbo Integrator script.

Home » MDX

Filed Under: Tech Bulletins Tagged With: Financial Performance Management, IBM Cognos TM1, IBM Planning Analytics, MDX, TM1

Footer

Revelwood Overview

Revelwood helps finance organizations close, consolidate, plan, monitor and analyze business performance. As experts in solutions for the Office of Finance, we partner with best-in-breed software companies by applying best practices guidance and our pre-configured applications to help businesses achieve their full potential.

EXPERTISE

  • Workday Adaptive Planning
  • IBM Planning Analytics
  • BlackLine

ABOUT

  • Who We Are
  • What We Do
  • How We Help
  • How We Think
  • Privacy

CONNECT

Contact:

25B Vreeland Road, Suite 111 Florham Park, NJ 07932
201.984.3030
info@revelwood.com

Copyright © 2023 · Revelwood Inc. All rights reserved. Revelwood® and the Revelwood logo are registered marks of Revelwood Inc.