Introduction
The Permission section in the Administrator module controls the application data that users, groups, and roles can access.
You can configure access at two levels:
- Model — Control which models a user, group, or role can read or write.
- Dimension — Control which members within a security-enabled dimension a user, group, or role can read or write.
You can assign permissions directly to a user. A user can also inherit permissions from a group or role.
Note: A user must have access to a model before they can access data in that model. If no dimension member permissions are defined for a dimension, the user can access all members of that dimension.
Navigate to Permission
In the Administrator module, go to Security > Permission.
In Configure, select the user, group, or role whose permissions you want to manage.
The page lists the current permissions for the selected user, group, or role, including permissions inherited from group or role membership. Inherited permissions are labeled - Inherited. The Inherit From column identifies the source.
Note: Application Modeler and Application Admin have read access to all members. You cannot edit permissions for those system roles.
Set model permissions
Model permissions determine which models a user, group, or role can access.
- Read — The user can view data in the model.
- Write — The user can change data in the model. Write access also includes read access.
To assign model access, select the user, group, or role, then select Model.
In the Model Security window, select Read, Write, or both for each model. To display only models that already have permissions assigned, select Only show models with permission. Select OK to confirm.
You can review permissions for additional users, groups, or roles before you save. When you are ready, select Save All. See Save your changes.
To remove model access, use the same Model Security window: clear Read and Write for the model, then select OK and Save All.
Set dimension member permissions
Permissions for dimension members give you more granular control. They determine which members a user, group, or role can access within a model.
These permissions are available only for dimensions that were enabled for member security in Modeler. If no dimensions are enabled for member security, Dimension is unavailable.
- Read — The user can view data for the selected members.
- Write — The user can change data for the selected members. Write access also includes read access.
Select the user, group, or role, then select Dimension.
In the Member Access Security window, select the dimension and member list. The list is shown as Dimension.MemberList.
Select the Read or Write tab.
In the member list on the left, select one or more members. Add the selected members using the applicable scope:
Single: The selected member only
All (A): The selected member and its descendants
Children (C): The children of the selected member
Leaves (L): The leaf members under the selected member
Select OK to confirm.
You can review permissions for additional users, groups, or roles before you save. When you are ready, select Save All. See Save your changes.
To remove access to dimension members, select Dimension again. In the Member Access Security window, select the members on the right, select Remove, then select OK and Save All.
Set write restrictions
Write restrictions control where users can enter data in a specific dashboard app. They do not replace model or dimension member permissions. A user must still have write access to the model and to the applicable members.
Write restrictions are configured on the dashboard app. They apply to all users of that app.
- If no write restrictions are defined, users can enter data for any members they already have write access to.
- If write restrictions are defined, users can enter data in that app only for the members in the list.
In the Administrator module, go to Apps and select the dashboard app. The app editor opens. Select the Write Restriction tab.
Select Add. The Add Write Restriction window opens.
In the Add Write Restriction window, select the dimension and the member list, then select the members that users can enter data for. Select Add.
In the app editor, select Save to save only this app. If you also have other unsaved changes — such as updates to users, groups, or roles, or edits to other apps — select Save All to save those changes together.
To remove a write restriction, select the members in the list, select Remove, then save with Save or Save All.
Save and deploy permissions
Changes to data access for models and for dimension members take effect in two steps:
- Save the configuration
- Deploy the permissions to the solution
After you save settings for models and for dimension members, deploy starts automatically after a short delay. A notification appears while deploy is pending. To apply the changes sooner, select Deploy now.
When deployment is complete, a confirmation appears in the notification bar.
Understand effective data access
A user’s access can come from either of these sources:
- Permissions assigned directly to the user
- Permissions inherited from a group or role
Inherited permissions are combined.
When member permissions are defined on more than one dimension, the user can access only data that matches all of those permissions. For example, if a user has access to Entity A and Account 100, they can access data only where both apply.
When reviewing access:
- Confirm that the user has access to the model
- Review permissions for dimension members, including inherited rows
- Review the groups and roles the user belongs to
To change inherited access, do one of the following:
- Update the group or role that grants the permission
- Change the user’s membership
For information about managing memberships, see Membership. For information about creating users and groups, see Users & Groups.