Skip to main content

MSTR Defining sets of privileges: Security roles

https://www2.microstrategy.com/producthelp/10.6/SystemAdmin/WebHelp/Lang_1033/Content/Admin/Defining_sets_of_privileges__Security_roles.htm

Defining sets of privileges: Security roles

A security role is a collection of project-level privileges that are assigned to users and groups. For example, you might have two types of users with different functionality needs: the Executive Users who need to run, sort, and print reports, and the Business Analysts who need additional capabilities to drill and change subtotal definitions. In this case, you can create two security roles to suit these two different types of users.
Security roles exist at the project source level, and can be used in any project registered with Intelligence Server. A user can have different security roles in each project. For example, an administrator for the development project may have a Project Administrator security role in that project, but the Normal User security role in all other projects on that server.
A security role is fundamentally different from a user group in the following ways:

A group is a collection of users that can be assigned privileges (or security roles) all at once, for the project source and all projects in it.


A security role is a collection of privileges in a project. Those privileges are assigned as a set to various users or groups, on a project-by-project basis.
For information about how privileges are inherited from security roles and groups, see Controlling access to functionality: Privileges.

Managing security roles

The Security Role Manager lists all the security roles available in a project source. From this manager you can assign or revoke security roles for users in projects, or create or delete security roles. For additional methods of managing security roles, see Other ways of managing security roles.

To assign a security role to users or groups in a project


1In Developer, log in to the project source containing the security role. You must have the Grant/Revoke Privileges privilege.


2Expand Administration, then Configuration Managers, and then select Security Roles. A list of security roles in the project source opens in the main Developer pane.


3Double-click the security role you want to assign to the user or group. The Security Role Editor opens.


4Select the Members tab.


5From the Select a Project drop-down list, select the project for which to assign the security role.


6From the drop-down list of groups, select the group containing a user or group you want to assign the security role to. The users or groups that are members of that group are shown in the list box below the drop-down list.


By default, users are not shown in this list box. To view the users as well as the groups, select the Show users check box.


To assign a top-level group to a security role, from the drop-down list select All Groups.


7Select a desired user or group.


8Click the > icon. The user or group moves to the Selected members list. You can assign multiple users or groups to the security role by selecting them and clicking the > icon.


9When you are finished assigning the security role, click OK. The security role is assigned to the selected users and groups and the Security Role Editor closes.

To create a security role


1In Developer, log in to the project source you want to create the security role in.


2Expand Administration, then Configuration Managers, and then select Security Roles.


3From the File menu, point to New, and select Security Role. The Security Role Editor opens at the General tab.


4Enter a name and description for the new security role.


5Select the Privileges tab.


6Select the privileges to add to this security role. For an explanation of each privilege, see the List of Privileges chapter in the Supplemental Reference for System Administration.
To select all privileges in a privilege group, select the group.

7To assign the role to users, select the Members tab and follow the instructions in To assign a security role to users or groups in a project.


8Click OK to close the Security Role Editor and create the security role.

To delete a security role


1In Developer, log in the project source you want to remove the security role from.


2Expand Administration, then Configuration Managers, and then select Security Roles. A list of security roles in the project source opens in the main Developer pane.


3Click the security role that you want to remove.


4From the File menu select Delete.


5Click Yes to confirm that you want to delete the security role.

Other ways of managing security roles

You can also assign security roles to a user or group in the User Editor or Group Editor. From the Project Access category of the editor, you can specify what security roles that user or group has for each project.
You can assign roles to multiple users and groups in a project through the Project Configuration dialog box. The Project Access - Generalcategory displays which users and groups have which security roles in the project, and allows you to re-assign the security roles.
For detailed instructions on using these editors to manage security roles, see the MicroStrategy Developer Help.
You can also use Command Manager to manage security roles. Command Manager is a script-based administrative tool that helps you perform complex administrative actions quickly. For specific syntax for security role management statements in Command Manager, see Security Role Management in the Command Manager on-line help (from Command Manager, press F1, or select the Help menu). For general information about Command Manager, see Automating Administrative Tasks with Command Manager.
If you are using UNIX, you must use Command Manager to manage your system’s security roles.

Controlling access to a project

You can deny user or group access to a specific MicroStrategy project by using a security role.

To deny user or group access to a project


1In Developer, right-click on the project you want to deny access to. Select Project Configuration. The Project Configuration Editor opens.


2Expand the Project Access category. The Project Access - General dialog box opens.


3In the Select a security role drop-down list, select the security role that contains the user or group who you want to deny project access. For example, select the Normal Users security role.


4On the right-hand side of the Project access - General dialog, select the user or group who you want to deny project access. Then click the left arrow to remove that user or group from the security role. For example, remove the Everyone group.


5Using the right arrow, add any users to the security role for whom you want to grant project access. To see the users contained in each group, highlight the group and check the Show users check box.


6Make sure the user or group whose access you want deny does not appear in the Selected members pane on the right-hand side of the dialog. Then click OK.


7In Developer, under the project source that contains the project you are restricting access to, expand Administration, then expand User Manager.


8Click on the group to which the user belongs who you want to deny project access for. Then double-click on the user in the right-hand side of Developer. The User Editor opens.


9Expand User Definition, then select Project Access.


10In the Security Role Selection row, under the project you want to restrict access to, review the Security Role Selection drop-down list. Make sure that no security role is associated with this project for this user.


11Click OK.
When the user attempts to log in to the project, he receives the message “No projects were returned by this project source.”

The role-based administration model

Beginning with version 9.0, the MicroStrategy product suite comes with a number of predefined security roles for administrators. These roles makes it easy to delegate administrative tasks.
For example, your company security policy may require you to keep the user security administrator for your projects separate from the project resource administrator. Rather than specifying the privileges for each administrator individually, you can assign the Project Security Administrator role to one administrator, and the Project Resource Administrator to another. Because users can have different security roles for each project, you can use the same security role for different users in different projects to further delegate project administration duties.
The predefined project administration roles cover every project-level administrative privilege except for Bypass All Object Security Access Checks. None of the roles have any privileges in common. For a list of the privileges included with each predefined security role, see the List of Privileges chapter in the Supplemental Reference for System Administration.
The predefined administration security roles are:

Power Users, which have the largest subset of privileges of any security role.


Project Bulk Administrators, who can perform administrative functions on multiple objects with Object Manager (see Copying objects between projects: Object Manager), Command Manager (see Automating Administrative Tasks with Command Manager), and the Bulk Repository Translation Tool.


Project Operations Administrators, who can perform maintenance on various aspects of a project.


Project Operations Monitors, who can view the various Intelligence Server monitors but cannot make any changes to the monitored systems.


Project Resource Settings Administrators, who can configure project-level settings.


Project Security Administrators, who create users and manage user and object security.
For instructions on how to assign these security roles to users or groups, see Managing security roles.
Do not modify the privileges for an out-of-the-box security role. During upgrades to newer versions of MicroStrategy, the privileges for the out-of-the-box security roles are overwritten with the default privileges. Instead, you should copy the security role you need to modify and make changes to the copied version.

Comments

  1. Hey there, thanks for providing Solution for this Tableau data integration. I was looking for more information on Tableau Rest API Connection. If you know anything please share. Thanks in advance!

    Tableau Rest Api Connection

    ReplyDelete

Post a Comment

Popular posts from this blog

Transaction Services - Configure Transactions

Configure Transactions in MSTR Web Transaction Services-enabled document displayed on an iPhone, iPad, or Android device can allow users to insert/update/delete data in to the database, using the options in the Configure Transactions Editor. To do so, you must link a Transaction Services report to a grid or to text fields in a panel stack. If the document is being displayed on an iOS device, you can link the report to the cells of a transaction table. Data from the input objects defined in the Transaction Services report is displayed in the grid, text fields, or cells for users to edit. Prerequisites:        Ø   You must have the Web Configure Transaction privilege assigned by MSTR user admin. Ø   Create the Transaction Services report (usually a grid report) you want to link to the grid, text fields, or transaction table cells. Make sure that the Transaction Services report must contain the input object for each value you want to allow users to change.  Ø   Ma

Apply or Pass-through functions in Microstrategy

Ap ply (Pass-Through) functions MSTR Apply functions provide access to functions or syntactic constructs that are not standard in MicroStrategy but are provided by various RDBMS systems.. Syntax common to Apply functions Apply Function Name   ("expression with placeholders", Arg1, Arg2, Arg3, …ArgN) where: Apply Function Name  – is a generic name used for the predefined pass-through functions described above expression with placeholders  – is the string describing the actual expression or syntax that the engine uses while generating the SQL and which is sent to the RDBMS. The placeholders are represented by #0, #1, and so on. "#" is a reserved character for MicroStrategy. Arg  – is an argument that replaces the parameter markers in the pattern. Arg1 replaces #0, Arg2 replaces #1, and so on. There are   five  pre-defined Apply functions to replace regular, predefined functions of the same type. For more details, click the link co

Case functions Microstrategy

Ca se functions Microstrategy Case functions return specified data in a SQL query based on the evaluation of user-defined conditions. In general, a user specifies a list of conditions and corresponding return values. Case This function evaluates multiple expressions until a condition is determined to be true, then returns a corresponding value. If all conditions are false, a default value is returned.  Case  can be used for categorizing data based on multiple conditions. This is a single-value function. Syntax Case ( Condition1 ,  ReturnValue1 ,  Condition2 , ReturnValue2 ,...,  DefaultValue ) Example Case(([Total Revenue] < 300000), 0, ([Total Revenue] < 600000), 1, 2) sum(Case (Day@DESC in (“Sat”,”Sun”), Sales, 0) {~+} Sum(Case(Category@DESC In("Books","Electronics"),Revenue,0)){~+} CaseV (case vector) CaseV  evaluates a single metric and returns different values according to the results. It can be used to perform transf

Control the display of null and zero metric values

Show   Control the display of null and zero metric values in a grid report You can determine how to display or hide rows and columns in a grid report that consist only of null or zero metric values. You can have MicroStrategy hide the rows and columns in the following ways: Hide rows and columns that consist only of null metric values Hide rows and columns that consist only of zero metric values Hide rows and columns that consist only of null or zero metric values (default) Once you have defined how MicroStrategy hides null and zero metric values in the grid, you can quickly show or hide the grid using the Hide Nulls/Zeros option in the Data menu, as described below, or by clicking the  Hide Nulls/Zeros  icon  in the Data toolbar. To determine how null and zero metric values are displayed or hidden in a grid report Open the report in Edit mode. From the  Tools  menu, select  Report Options . The Report Options dialog box opens. To determine how

Microstrategy Report Services documents and dashboards

Microstrategy Report Services documents vs Dashboards A MicroStrategy Report Services document displays data coming from multiple reports, with the data laid out and designed in presentation-quality format. Most data on a document is from one or more underlying datasets. A dataset is a standard MicroStrategy report. Other document components that do not originate from the dataset, such as static text used for a title or heading, page numbers, and images, are added by the document's designer and are stored in the document's definition. A Report Services (RS) dashboard is a special type of document. An RS dashboard is commonly only one page long, is intended to be viewed online, and usually provides interactive features that let analysts change how they view the dashboard’s data, as well as what data they are viewing. A broad selection of widgets and a wide variety of formatting options allow you to design a customized, interactive dashboard. Both documents and RS dashb

Settings for Outer Join between metrics in MicroStrategy

Settings for Outer Join between metrics in MicroStrategy MicroStrategy adopts multi-pass logic to determine the execution plan for a report. This means that every metric is evaluated in separate SQL passes. Outer Joins come into play when MicroStrategy Engine merges the results from all SQL passes into one report. For a multi-pass report, different Outer Join behaviors can give the user completely different results. In addition, report metrics can be of different types which can, in some cases, influence the result of the outer join. In MicroStrategy, there are two settings that users can access to control Outer Join behavior : Formula Join Type and Metric Join Type . Metric Join Type: VLDB Setting at Database Instance Level Report and Template Levels Report Editor > Data > Report Data Options Metric Level   Metric editor > Tools > Metric Join Type Control Join between Metrics Formula Join Type: Only at Compound/Split Metrics

Microstrategy Document Autotext macros:

Autotext  code/macros in  Microstrategy Document/dashboard This is a list of the available auto text macros that the Report Services Document engine recognizes. The following auto text codes allow you to add  document variable information to your document. These auto text codes are automatically replaced by information about the document. Auto text codes for MSTR document/dashboard:  AUTOTEXT DESCRIPTION   {&PAGE}  Display the current page.  {&NPAGES}  Display the total number of pages.  {&DATETIME}  Display the current date and time.  {&USER}  Display the user name that is executing the Report Services Document.  {&DOCUMENT}  Display the document name.  {&DOCUMENTID}  Display the document ID.  {&DESCRIPTION}  Display the document description.  {&PROJECT}  Display the project name.  {&EXECUTIONTIME}  Display the execution time.  {&SERVERNAME}  Display the Intelligence Server name  {& REPORT :FILTERDETAILS}  Dis

Prompt-in-prompt(Nested Prompts) in Microstrategy

Prompt-in-prompt(Nested Prompts) in  Microstrategy Nested prompts allows you to create one prompt based on the other and other bases on another, nested prompts allows us to prompt the highest level(Like year) to middle level(like Quarter, then to the low level(like Month). Here you can see how to  create a 3-level deep nested prompt that will prompt the user to select a year, then a quarter within that year, then a month within that quarter. Prompt-in-prompt is a feature in which the answer to one prompt is used to define another prompt. This feature is only implemented for element list prompts . The following procedure describes how to achieve this: Create the highest level filter. This is a filter which contains a prompt on an attribute element list. Create a filter on the attribute "Year." Click "prompt on attribute element list" and click "Next" through the rest of the screens to accept the default values. Do not set any additio

Best Practices for using images in Microstrategy reports

Using images in Microstrategy reports On the I-Server we copy the images to the following folders: - Program Files (x86)\MicroStrategy\Developer\Images - Program Files (x86)\MicroStrategy\IntelligenceServer\Images - Program Files (x86)\Common Files\MicroStrategy\images To reference an image using relative path, the following locations are required to store the image in order to display in multiple MicroStrategy products.    Relative path sample: images/ logo.jpg To display images on: MicroStrategy Desktop, Web, Mobile, Distribution Services: * Additional Adobe Flash security rule applies when displaying images on Flash Dashboard For image to display on MicroStrategy Web Services:   Note: It is recommended that HTTP path should be used for reference image. User should consider using HTTP path to reference image and store image in an client accessible server for easier maintain and upgrading purpose  More info at:  https://www2.m

Allow a Visualization to Update the Data in Another Visualization in Dossier

Allow a Visualization to Update the Data in Another Visualization After adding multiple visualizations to a dossier, you can select values in one visualization (that is, the source) to automatically update data in another visualization (that is, the target). This is done by creating a filter on a visualization that targets other visualizations. To Add a Target Visualization to Your Dossier: Open the dossier with the visualization. Click  Insert Visualization   . A blank visualization appears in the dossier. From the Visualizations panel, select  Grid   . Drag an attribute from the Datasets panel to the  Rows  area of the Editor panel to add attributes to the rows. Drag an attribute from the Datasets panel to the  Columns  area of the Editor panel to add attributes to the columns. Drag a metric from the Datasets panel to the  Metrics  area of the Editor panel, to add a metric to the grid. The Metric Names attribute automatically appears in the Editor panel. Drag the Metric Names attribu