KB44797: Users that do not have access to obects within an MDX cube are still able to update the cube structure, causing object information to change

SUMMARY:
This issue has been classified as a defect by Strategy. The impact is local to the MDX Cube Editor in Strategy Developer 9.x and has the potential to affect numerous reports and documents in the environment. There is no workaround currently available, but this document provides directions for manually fixing the object affected by this issue. A solution/code fix for this issue is not available in current releases but is being reviewed for a future Strategy release.
 
SYMPTOM:
A user that does not have full Administrator privileges to the project goes to access the MDX catalog in Strategy Developer. After making some mild changes, the user selects the button to "Update Cube". The cube updates successfully with no issues. Later on, the users notices errors while executing reports in Developer and Web:
 

 
Upon returning to the MDX Cube catalog,  some default prompt answers as well as some attributes within attribute element prompts have been changed. The user did not make any of these changes intentionally when they updated the cube and there seems to be no record of these cubes changing outside of references to the previous cube configuration. Even Change Journaling only shows the known cube update and nothing else.
 
 
STEPS TO REPRODUCE

1. Access the MDX cube catalog in Strategy Developer as a non-administrator user.
   
2. Select any cube, then select "Cube Mapping".
   
3. Right-click a prompt in the logical view and click "Properties".
   
4. Confirm that the user ID that is being used does not have full control of the prompt object selected.
   
5. Update cube structure.
   
6. Go back to that same cube. Notice that the information on the prompt (default prompt answer, attribute, etc) has changed, even though the user that accessed the prompt did not have permission to make any changes and, in fact, did not make any changes.
   

 
CAUSE:
When a user that is not on the Access Control List for some of the objects in a cube attempts to refresh that cube, the cube will refresh, but the objects that they don't have access to will change, causing errors. Since the cube they're updating includes objects that they can access and also objects that they can't, the objects that the user can access will remain unchanged. However, the objects that the user can't access will blank out or change to objects that they can access.
 
Ideally, the user should not be able to use the Update Structure function if they don't have full control of all the objects in the cube.
 
This is a known issue in Strategy 9.x
 
ACTION:
Strategy will continue to investigate and post updates as soon as they are available.
 
WORKAROUND:
The only workaround for this issue is to manually change all of the affected objects back to their original forms. Unfortunately, there is no way to identify all of them automatically. The user will have to search the Cube Catalog to find the objects that have been altered incorrectly.
 
ADDITIONAL TROUBLESHOOTING:
Since the issue is based on the fact that the users making changes do not have access to all of the MDX Cube Catalog, a way to prevent the problem entirely is to grant the users full control of the objects. This method of changing access control in bulk should work for metrics, hierarchies and prompts.

1. Within the project in Developer (the root project folder) create a new search.
   
2. Within Tools -> Options select to "Display Managed Objects"
   
3. On the Contained By tab select "Add" next to "Contained by the following objects". (This will let you browse for an object).
   
4. Browse to the Data Explorer, select the cube to be used, move it to the right side and hit OK.
   
5. It should now appear in the list box for the search criteria.
   
6. When the search is run all of the metrics, hierarchies and prompts will be listed.
   
7. The prompts can be multi-selected so select all of the prompts, right click and select Properties.
   
8. Within Properties go to the Security tab and add the ACLs as needed.
   

NOTE: There will be a warning and the ACLs will be cleared when doing this as the ACLs may be different between them to begin with.
 
TO LEARN MORE:
The following links refer to other Knowledge Base articles concerning misplaced MDX Cube objects and display issues within the Cube Catalog:
 
KB36823 "MDX cube which is not imported is displayed as imported after displaying the structure of the cube and refreshing the MDX Cube Catalog in Strategy Desktop 9.x"
KB36175 "Duplicated hierarchy names appear in Data Explorer when renaming a MDX data source flat hierarchy from MDX Cube Catalog in Strategy Desktop 9.0.x - 9.2.x."
 
KB36455"In Strategy Desktop 8.1.x - 9.3.0, the physical view on MDX cube catalog is displayed incorrectly for some variable (prompt) objects from SAP BW datasource."