Dimension Security 5.3.0

  • The Security discussed below applies primarily to Power Users (PU's) because:
    • Admins have no restrictions as to Dimension functionality
    • Regular Users must have access to at least one Dimension Value of a Dimension in order to View a dimensioned element or Dataset

Overview

Power Users have the implicit Privilege to Create Dimensions.  When they create a Dimension, they automatically receive Edit Access to that Dimension.

In Release 5.3.0, Expanded Security functionality is applied Dimension Edit Access for PU's.  In order for a PU to open a Dimension Editor, he must have either:

  • Use Access to the Dimension's Configurable Data Source  
  • The Privileges to Create Content using its Non-Configurable Data Source with:
    • At least View Access Permission to any associated source element or Dataset

Dimension Security Permissions can be applied via:

  1. User Editor > Dimensions tab
  2. Group Editor > Dimensions tab
  3. Dimension Editor > Access tab

For Power Users, Security is designed to have both an expanded Security Privileges for Dimensions and Permissions to a specific Dimension.

Dimension security applies to:

  1. Dimension Editor
  2. Element Editors
  3. Dataset Viewer
  4. PU Content > Dimensions List Page that only shows Dimensions to which the PU has Edit Access

Privileges are granted via Info Tab > Privileges section on the Group Editor or the User Editor.

Permissions are granted via the Permission button on the Dimension Editor, or on the User or Group Editor > Dimensions tab > Dimensions and Dimension Values sections

Granting Privileges - from Group or User Editor

Every Power User has the implicit Privilege to Create Dimensions, and the Privilege cannot be manually added or deleted.

There is one Dimension Privilege and one Dataset Privilege that can only be assigned to Power Users or inherited from the Group(s) to which a Power User belongs.  

  1. "Allow Power Users to grant Dimension access to any User or Group"  (Extended Security Privilege) allows PU to grant View or Edit Access to any Group or User (for RU's, limited to View Access)
  2. "Create content using Datasets": Required for the PU to create a Dimension from a Dataset
Granting Permissions - (Content > Dimensions > select a Dimension > Dimension Editor > Access tab)

There are three types of Dimension Security Permissions that may be granted to a Group, RU (View Access Only) and PU:

  1. View Access:  
    1. May be granted to any PU or RU regardless of Privileges
    2. Requires at least View access to a Dimensioned element's Category
  2. Access to one or more specific Dimension Values when View Access does not include access to All Dimension Values
  3. Edit Access:  
    1. PU can:
      1. See the Dimension when creating or editing an Element
      2. Open the Dimension Editor
        1. Make changes to Dimension
        2. Delete the Dimension
        3. Assign Access to Groups of which the PU is a member and to other Members of those Group
          1. With Extended Security Privilege, grant access to any Group or Regular/Power User

Permissions may be granted via the Dimension Editor, Group Editor or individual User Editor (Admin only).

1. Dimension Editor (Content > Dimensions)

1.1. Dimensions List

  1. The grid only shows Dimensions to which the PU has Edit Access
    • Dimension Name has active link that opens the Dimensioned Editor
  2. The PU can [+ New Dimension] from the Dimension List page

1.2. Dimension Editor

PU's with Edit Access can access a specific Dimension's Editor from both of the following paths:

  • Content menu > Dimensions > click on a Dimension Name link in the list box
  • Object Editor > Edit icon to right of Dimension text box

From the Editor, a PU can:

  • Make changes to the settings
  • Use the Access tab > Manual Permissions button to grant Dimension and Dimension Value Access
  • Delete the Dimension
  • Add another Dimension

PU's are restricted as described below.

1.2.1. Dimension Permissions

  1. On the Dimension Editor > Access tab, click the Manual Permissions button to open the Dimensions Permissions pop-up
  2. On the Permissions pop-up, PU with Edit Access can grant View or Edit Access to:
    1. Groups and PU members of Groups to which PU belongs and Groups that the PU can edit
    2. With the Extended Security Privilege, any Group or other user

1.2.2. Dimension Values

  1. PU can add or edit Dimension Values, one by one, when the User or Group to which Edit Access or View Access has been granted without access to All Dimension Values
  2. User appears in the grid with Scope of Access = Selected Dimension Values
  3. Click + New User Access to Dimension Value Button
  4. Select a Dimension Value
  5. Save and repeat if additional Values required

1.2.3. Parent/Child Dimensions

Security can be granted to a Child Dimension in the same manner as any other Dimension OR may be inherited based on permissions granted at the Parent level. If you grant a User access to a Dimension that has children, grandchildren or other generations, the user receives cascading access to all of the Dimension's descendants in the Family tree

To obtain more information about how a Dimension may be a Parent or a Child within a set of nested Dimensions, see Understanding Parent/Child Dimensions

Impact on Other Editors:

2. Group Editor (Admin menu > Groups)

PU's with the Privilege to Create Groups and the Permission to edit a specific Group may grant access to Dimensions on the Group Editor > Dimensions tab:

  1. Select  the [+Dimension access to Group] to open the Give Dimension Access to Group pop-up
  2. Grant View or Edit Access to be inherited by the Group's Power Users
  3. Determine if Group receives All or Selected Dimension Values
  4. If the Dimension is a child, grant All or Selected Dimension Values
  5. Select a one or more Dimensions from grid in which the PU will only see Dimensions to which he has Edit Access
  6. Save

NOTE:  If Selected Dimension Values option was selected, continue to add Dimension Values via the popup.

3. Metric, Report and External Report Editors

If a PU is able to open a new or existing element's editor, the PU can assign Dimensions to which the PU has Edit Access.

On the Info tab, PU can add or change the Dimension setting:

  1. Dimension drop-down list contains:
    • Dimensions for which the PU has Edit Access, if any
    • Option to create a new Dimension
4. Generate Dimension from Dataset Viewer

4.1. Dataset Viewer (Content > Datasets > Views > Action)

PU can create a Dimension from a Dataset Viewer if they have the following Privileges and Permissions.

  • Permission for att least View Access to the Dataset
  • Privilege "Create Content from Dataset"

 

 

 

On the Dataset Viewer:

  1. Select a Dataset View
  2. Open the Action menu > New Dimension to generate a Dimension from the selected View's data
  3. Define the new Dimension
  4. Save to open the new Dimension's Editor