SYMPTOM:
An Intelligent Cube that a user does not have permissions to can still be accessed through Dynamic Sourcing in Strategy 9.4.1. Even if the user has "Denied All" permissions to the Intelligent Cube it can still be accessed via dynamic sourcing.
STEPS TO REPRODUCE:
1. Create an Intelligent Cube with the Region attribute and Profit metric
2. Publish the cube
3. Create a cube report named "Cube Report" using the cube created in step 1, add Region and Profit to the grid
4. Create a brand new normal report named "Normal Report" with Region and Profit that does not use the Intelligent Cube
5. Create a User named "Test User"
6. Edit the properties of the Intelligent Cube and Deny all permissions to the Intelligent Cube for Test User
7. Login as Test User and run the Cube Report, the error message below will appear
Sample Code/Error
Status: Initialization Failed
Error: You do not have Read access to the Report Definition object 'Region and Profit'.
8. Ensure that dynamic sourcing is enabled for the Intelligent Cube and Test User
9. Run the report Normal Report logged in as Test User
10. View the SQL and notice the Region and Profit Intelligent Cube that Test User should not have access to is used.
Sample Code/Error
Intelligent Cubes Accessed:
Intelligent Cube SQL Statements:
Pass0 - Duration: 0:00:00.00
select @,
@,
as
from Region and Profit
CAUSE:
This is a known issue in Strategy 9.4.1.
ACTION:
Strategy will continue to investigate and post updates as soon as they are available.
WORKAROUND:
Users that do not have permissions to the Intelligent Cube can only access it through Dynamic Sourcing
1. If there is an Intelligent Cube that has data that should not be accessed by everyone disable dynamic sourcing for the Intelligent Cube
2. If there is a specific user or group that should not have access to the Intelligent Cube remove the "Use dynamic sourcing" privilege
