none
OLAP Cube 2013: No members in the reader role (Project Server 2013 / SQL Server 2012 SP1) RRS feed

  • Question

  • Hello everyone,

    in my environment with Project Server 2013 / SQL Server 2012 SP1, I am experiencing a strage behaviour with OLAP cubes.

    The cubes build correctly, the data is correct, but the sole cube role ProjectServerViewOlapDataRole is empty. That means nobody has access to the cubes except SSAS administrator who access to everything.

    The setup is Project Server 2013 / SQL Server 2012 SP1, ASAMO/ASADOM/ASOLEDB from the 2008R2 SP2 feature pack are installed (see http://blogs.msdn.com/b/brismith/archive/2012/11/12/project-server-2013-requirements-to-build-an-olap-cube.aspx). The issue occurs on single box SP/PS/SQL, on single box with domain controller and on 1SP/PS+1SQL-system. It occurs with PWA-instances in SharePoint mode and Project Server mode. There is a PWA Admin, a Portfolio Reader/Manager, an unattended reader account with only the View OLAP permission, none of them have access to the data.

    The web application the new default (claims based, underlying Windows Kerberos authentication). In the pub.MSP_Resources table of the PWA database, both WRES_ACCOUNT and WRES_CLAIMS_ACCOUNT are in the  "i:0#.w|domain\user" format. WRES_AD_GUID is set for most users. Is that the reason that PWA might not find the users to add to the cube?

    So, basically my question is: Does anyone else have this issue, or is your OLAP role filled correctly? In case it works for you, what are your specifications? Are you doing something different to my actions? How does the table look in your scenario?

    Kind regards,
    Adrian

    Saturday, November 24, 2012 7:27 PM

Answers

All replies

  • Experiencing the same, getting the following message, doing research

    Adding Project Server default OLAP role ProjectServerViewOlapDataRole to database permission list, LogLevelManager Warning-ulsID:0x3873776F has no entities explicitly specified. 0af0e49b-55b1-50dd-0000-066687055c59

    Status message: Adding Project Server default OLAP role ProjectServerViewOlapDataRole to cube MSP_Project_SharePoint , LogLevelManager Warning-ulsID:0x3873776F has no entities explicitly specified. 0af0e49b-55b1-50dd-0000-066687055c59

    As of now, suggesting the following workaround to add the user accounts into the cube.

    1. Manually add the user accounts into the OLAP cube using script and schedule job.

    2. Adding project managers into security group of Analysis server to access the cube.


    Cheers. Happy troubleshooting !!! Sriram E - MSFT Enterprise Project Management

    Monday, November 26, 2012 2:18 PM
    Moderator
  • Hi Sriram,

    thank you for your answer. For the time being, I can manage with granting report authors and unattended datareader accounts (in Secure Store) SSAS admin permissions. Hopefully, this is not too difficult to correct.

    Kind regards,
    Adrian

    Monday, November 26, 2012 9:16 PM
  • Hi Sriram,

    the TechNet article has been update to reflect the paradigm shift. The intention is now to manually add the users/groups to the OLAP database, and in return, Project Server will not remove the users from the DB. http://technet.microsoft.com/en-us/library/jj943761.aspx

    However, this is currently broken. When a cube is processed, the ProjectServerViewOlapDataRole correctly retains all it's users. However, something is wrong with the users in this role, they are not able to read the data. Replicate as follows:

    1. Create an OLAP report (e.g. PerformancePoint Service) using a data reader account with no permissions.
    2. Load the report - data load error. Of course.
    3. Add the data reader account to the OLAP DB ProjectServerViewOlapDataRole .
    4. The report loads correctly.
    5. In Central Admin / PWA / OLAP Database Management, rebuild the cube.
    6. Load the report - data load error exactly like in 2.
      Note: With the March 2013 PU, the reports continues to load correctly.
    7. Open the OLAP DB ProjectServerViewOlapDataRole. The data reader account is listed there. Click cancel.
    8. Load the report - data load error exactly like in 2.
    9. Open the OLAP DB ProjectServerViewOlapDataRolea again, the data reader account is listed there. Click OK.
    10. Now the report loads correctly.

    So rebuilding the cube does something that keeps the users in the role, but prevents them from functioning in their role. Opening and saving the role fixes this issue. This is not feasible in a production environment, so the onyl way around is to give the data reader and report authors full SSAS admin permissions. Which is not entirely desirable either.

    Kind regards,
    Adrian

    • Edited by Adrian Sauerbrey Monday, April 29, 2013 8:59 PM Fix in PU March 2103
    Wednesday, March 6, 2013 7:46 PM
  • The bug has been fixed with PU March 2013, the OLAP reader role retains its permissions through a cube rebuild.
    Monday, April 29, 2013 9:00 PM