locked
Permissions in Analysis Services and PerformancePoint RRS feed

  • Question

  •  Hi, all!

    I got a big problem on this days..

    I'm trying control data access on Analysis Services, not on PerformancePoint or WSS, it's better, I can control dimension data access, but after some tests, I  saw that was not working on performancepoint.

    I denied access to a test user, so i tried access dashboard with that user: test user saw all dimensions and measures perfectly..
    So, I tried access managment studio with the user: access denied.

    On SQL Profiler: the NTUsername field was showing "Network Services", so I changed the WSS web.config (Bpm.ServerConnectionPerUser = True).

    On profiler the user changed to logged in user, but the user continues to access the dataon performancepoint (not in analysis services).

    can anyone help me?

    sorry, my english is terrible!
    Tuesday, February 24, 2009 2:26 PM

Answers

  • Hi, all!


    Last tuesday, a DBA came here analyze the problem.

    we discovered the problem was in a role of Analysis Services 2008 (the use was not in it), which was granting access to the test user (and, maybe, anyuser).

    So, we deleted that role and problem solved!

    Thank You guys!
    Wednesday, March 18, 2009 4:58 PM

All replies

  •  Eduardo,

    Are you in a distributed enviornment?  Meaning is the Monitoring Server on a different server then Analysis Services? 
    If this is the case and you want to connect to your cube per user (Bpm.ServerConnectionPerUser = True) you will then need to implement Kerberos.

    http://technet.microsoft.com/en-us/library/bb794642.aspx


    Aseem Nayar - MSFT
    This posting is provided "AS IS" with no warranties, and confers no rights
    Tuesday, February 24, 2009 3:54 PM
  • Hi, Assem!

    No, my analysis services, performancepoint and BI Portal (WSS) are on same server.


    Does on your PPS it work fine?
    Wednesday, February 25, 2009 12:01 PM
  • Did you change the Web.config in all three places?  In the Preview and Webservices direcrory located C:\Program Files\Microsoft Office PerformancePoint Server\3.0\Monitoring\PPSMonitoring_1 as well as the web.config for your sharepoint web application?

    If you look at your application pools what account is running the application pools in IIS?

    Thanks

    Aseem Nayar - MSFT
    This posting is provided "AS IS" with no warranties, and confers no rights
    Wednesday, February 25, 2009 3:31 PM
  • Yes, I altered all the web.config files.

    PPS_Monitoring, preview and central, they are at they are at PPS installation folder, right? (on my case in: D:\Microsoft Office PerformancePoint Server\3.0\Monitoring).

    WSS too.,. Confgured.


    Maybe a problem with PPS?
    Wednesday, February 25, 2009 5:57 PM
  • About appPool account:


    all apps are with "network service" except on PPSMonitoringWebService and PPSMonitoringPreview, wich are with "LocalSystem" account.
    Wednesday, February 25, 2009 6:02 PM
  •  Hello Eduardo,

    By default the three virtual directories, WebService, Preview and Central are all located at C:\Program Files\Microsoft Office PerformancePoint Server\3.0\Monitoring\PPSMonitoring_1\. You will only need to change the Preview and WebService web.config files. Check those to see if they need to be changed.

    Thanks,
    Jon Thomas
    This posting is provided "AS IS" with no warranties, and confers no rights.
    Wednesday, February 25, 2009 6:34 PM
  • Also run an IISreset after changing the setting.  Also if you run a SQL Profiler trace on SSAS what user shows up as accessing the cube? 

     

     


    This posting is provided "AS IS" with no warranties, and confers no rights
    Wednesday, February 25, 2009 8:48 PM
  • IIS reset i haven't runned...

    i'm executing it now..

    About the ntusername field, on sql profiler, it shows me the current logged in user, normally..


    althought the user don't have access, it shows that user execute sucessfully the mdx query.
    Thursday, February 26, 2009 12:25 PM
  • Hello,

    I'm a little confused as to what you are trying to accomplish.  Do you want your users to connect and have access to the cube or not?

    Aseem Nayar - MSFT
    This posting is provided "AS IS" with no warranties, and confers no rights
    Thursday, February 26, 2009 6:19 PM
  • rsrsrs Sorry!

     

    I want my users have access to the cube, but not in some dimension itens.

     

    What I did was deny user access to entire cube, only to test the permissions.

    Unhapply, the user had access to all the cube data on performancepoint, after I deny access to the cube.

    The user have access on the cube in PPS.

    The user don't have access on the cube in Analysis Services.

    Analysis Services Permissions work in Analysis Services, but not in PPS.

    Friday, February 27, 2009 11:42 AM
  • Hello,

    What role permissions does the user have?  Do they have full control or read?  Also what rights does the user have to the machine?  They are not local administrator's on the machine right?

    Aseem Nayar - MSFT


    This posting is provided "AS IS" with no warranties, and confers no rights
    Friday, February 27, 2009 3:20 PM
  • it's a read only role and the user is not on Machine Administrator's Group.

     

    Could it be an error on cube deploy, or any configuration on data source?

    Friday, February 27, 2009 5:08 PM
  • Hello,

    Im not sure as it is difficult with out looking at it.  I suggest that you open a support ticket so that an Engineer can take a look at the problem with you.

    Thank you,

    Aseem Nayar - MSFT
    This posting is provided "AS IS" with no warranties, and confers no rights
    Monday, March 2, 2009 8:47 PM
  • Hi, all!


    Last tuesday, a DBA came here analyze the problem.

    we discovered the problem was in a role of Analysis Services 2008 (the use was not in it), which was granting access to the test user (and, maybe, anyuser).

    So, we deleted that role and problem solved!

    Thank You guys!
    Wednesday, March 18, 2009 4:58 PM