Current User Roles List seems Incorrect

Our app uses the ROLES column of the CATALOGS rowset from the schema, and I seem to be seeing what I think are incorrect results.

The documenation says "Username is appended to ROLES if one of the roles uses dynamic security". OK.

But I often get the username even when there are no MDX expressions used for dimension or cell access. For example, every Foodmart 2000 cube I have migrated shows the username in the role list.

What is the definition of dynamic security for the purposes of the CATALOGS rowset?

I should have noted, this is SSAS 2005.

This is generally how I am retrieving the roles list, if any one wishes to replicate.

OleDbConnection conn = new OleDbConnection( "provider=msolap;SSPI=Negotiate;Prompt=1" ); conn.Open(); DataTable schema = conn.GetSchema("Catalogs"); foreach(DataRow row in schema.Rows) { if (row["ROLES"].ToString().Length > 0) // only available for the current catalog txtRoles.Text = row["ROLES"].ToString(); } conn.Close();

Cube Roles - How to restrict access to certain members

I have a dimension called Account that has five levels. I'm trying to define a cube role to deny access to accounts in the lowest level that starts with the letters GL. I tried applying a filter in the dimension data tab in the role designer, however, this only seems to create a static rule. The account structure gets updated all the time and I want to restrict access to all accounts that start with the letters GL now and in the future.

When I created a rule in another dimension using a top-level static member, a denied member set was created in the advanced tab. I think I need to create something similar for the Account dimension, but I just can't get the syntax of MDX. I tried the BOL samples but can't find anything since I want to filter only part of the member name.

Try typing something like the following expression for DeniedSet:

Filter(Account.Levels(4), Account.Name >= 'GL' AND Account.Name < 'GM')

|||

Thanks, but that didn't work. In addition, I tried Filter([Account].Members, Left([Account].CurrentMember.Name, 2) = "GL") but that didn't work either. I'm wondering if there are too many members to filter at the bottom level.

Oddly, I was able to solve part of the problem by Enabling Visual Total in my other dimensions. I can filter GL type accounts in my other dimensions because there is only one fixed GL member in those dimensions. Since GL accounts only match up to the GL members in the other dimensions and since those GL members have been filtered, GL Accounts are not displayed in the cube result.

I will still try to find a solution, although I can restrict GL data from being displayed in the cube, the GL accounts still show up in the drop down. It's a good thing that when the user selects GL accounts, nothing is displayed.