SSAS Tabular Cube - Data Security

Question

Hi There,

We are using a SSAS Tabular cube in our project and we implemented the role based security as mentioned below.

Role A - implemented object level security
Role B - implemented object level security
Role C - implemented object and row level(using DAX expression) security

they were 2 users who were added to above roles like mentioned below
User 1 - was part of Role A and Role B
User 2 - was part of Role A and Role C

post the cube security implementation, User 1 was able to access all the objects available as part of Role A and Role B
while it was throwing the below error while User 2 was trying to access the cube. Can any one help me ,what was the issue.

FYI: i implemented the similar functionality in my previous project and it was working fine.

Thanks
Santosh

Answer 1

Hi @Santosh Kumar ,

i implemented the similar functionality in my previous project and it was working fine

It is currently not possible to have a user in multiple roles for row and object level security with dynamic filters. You need to be aware of with the way security works when users are part of multiple roles.

The exposure is very different with multiple roles. The security filters within a single role are combined with a logical AND. Where as the security filters for multiple roles are always unioned together, effectively combined with a logical OR. This is not a problem if the roles are filtering the same table eg. Customer[Country] = "USA" and Customer[Country] = "France" - in that case you get the expected result.

But it is very different if you have filters on different tables. For example if you have 2 filters on different tables like:

1. Customer[Marital Status] = "M"
2. Product[Color] = "Red"

If these are specified in one role then you will only see data where Customer[Marital Status] = "M" AND Product[Color] = "Red"

If these are specified in two roles you will see data where Customer[Marital Status] = "M" OR Product[Color] = "Red" so you will see other colors for married customers and you will see other marital statuses for red products.

Best Regards,
Joy

---

If the answer is the right solution, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.