Limiting report filter data using MDX

Answered
Darius Studdard asked on May 25, 2021

Hello,
We are having the exact problem that was described in this thread: https://www.flexmonster.com/question/report-filters-ignoring-mdx-filtering
In our case we have a number of data points that should be filtered based on Organization.  I've applied the following in the subquery of the datasource:
subquery: "select {[Organization].[Organization ID].&[@Ajax.ViewBag.OrganizationId]} on columns from [" + selectedItemNameNoSpaces + "]"
 
In this subquery OrganizationId is passed into our view and selectedItemNameNoSpaces is an argument containing the name of a selected data cube.  This seems to properly filter data in the grid on all levels but in the report filter there are selections being displayed that belong in other Organizations after we add other dimensions to the report.  You can see this in the screenshot attached where we are properly displaying only 2 Location Names in the grid but the report filter for Location Name contains all locations across all Organizations.
I'm going to attempt an approach where I intercept the query in the accelerator as suggested in the linked thread but I'm wondering if any other kind of workaround for this issue has been put in place since that thread was answered back in 2019.  I also noticed that the person in the thread who was attempting the accelerator approach wound up giving up and just disabling filtering in his application so I'm not feeling too optimistic but am giving it a try.  Any guidance you can give would be appreciated as this is a pretty big security issue within our application.

14 answers

Public
Mykhailo Halaida Mykhailo Halaida Flexmonster May 27, 2021

Hi Darius,
 
Thank you for posting your question!
 
Just letting you know we've received your inquiry and are already working on it. We'll return to you with a response as soon as possible.
 
Best regards,
Mykhailo

Public
Darius Studdard May 27, 2021

Ok Mykhailo thank you and I'll look out for the response!

Public
Mykhailo Halaida Mykhailo Halaida Flexmonster May 28, 2021

Darius,
 
Thank you for giving us time to prepare an answer.
 
The behavior you've described is expected since this is how the subquery property works in Flexmonster – the component has no way of knowing how the data in the cube is interconnected, therefore it retrieves all members in other hierarchies.
 
That being said, have you considered using SSAS roles to filter the data instead of using subqueries?
 
Please let us know your thoughts.
 
Regards,
Mykhailo

Public
Darius Studdard May 28, 2021

We haven't looked into SSAS roles as an option.  I'm assuming this approach would allow us to take care of the filtering of both the grid data and the filter window data? Would this require each user or org to have a separate login to our OLAP server?  If so, this is definitely different than the approach that we take now.  
Also, is there any documentation on related to using flexmonster with SSAS roles?

Public
Mykhailo Halaida Mykhailo Halaida Flexmonster May 31, 2021

Hi Darius,
 
Yes, the approach involving SSAS roles would allow you to control data filtering both on the cube side and then in the grid, with Flexmonster filters.
 
Here's a tutorial on setting up roles in Flexmonster, referencing a relevant Microsoft tutorial: https://www.flexmonster.com/doc/configuring-authentication-process-for-ssas-xmla/#roles.
 
Hope you find this helpful!
 
Regards,
Mykhailo

Public
Mykhailo Halaida Mykhailo Halaida Flexmonster June 7, 2021

Darius,
 
Hope you've had a great weekend!
 
I was wondering if you've had a chance to learn more about using roles in SSAS & Flexmonster – do you think this approach might work for you? 
 
We'd be happy to hear your feedback.
 
Best regards,
Mykhailo

Public
Darius Studdard June 9, 2021

Hi Mykhailo,
I did spend some time reading up on SSAS roles and while it seems like it could be viable, I do have a couple of questions/concerns.  

  1. I see that all roles defined on the cube are predicated on a valid Windows user identity.  So we assign windows ID's to whatever roles we define.  For us, we use one generic windows ID as  the credentials for access to our OLAP cubes.  We don't have access to any end user's Windows ID.  Because of that, what would be the right approach for us to implement this effectively?
  2. How does the roles argument that gets passed in from Flexmonster work exactly?  Will passing in the name of previously created role through this parameter bypass whatever Windows authentication is necessary and automatically apply the filtering defined in the role?  
  3. Also just thinking ahead that creating a separate role for each of our Organizations and then having to do so every time we add a new Org could potentially be a lot of manual work that needs to be done on a recurring basis.

I'm thinking that maybe using our 1 Windows ID and assigning it to all of the roles that we create to filter by Organization may be an approach...And then we pass the name of whatever role we want to apply through the Roles parameter in Flexmonster.  But I'm really not sure if this will work.
 
Thanks,
Darius

Public
Mykhailo Halaida Mykhailo Halaida Flexmonster June 11, 2021

Hi Darius,
 
Thank you for your response.
 
Addressing your first two questions, note that in order for Flexmonster to work with SSAS roles, you only need to set the role name in the dataSource object:
 

dataSource: { 
type: "microsoft analysis services",
proxyUrl: "https://olap.flexmonster.com/olap/msmdpump.dll",
catalog: "Adventure Works DW Standard Edition",
cube: "Adventure Works",
roles: "Sales Manager US"
}

 
This is enough for Flexmonster to retrieve the data accessible for the specified role – no additional authorization on the client-side is necessary. You can see how this works with our SSAS roles sample: https://jsfiddle.net/flexmonster/7g82cnn3/.
 
Speaking of your third point, yes, you might need to update your roles and permissions after particular cube changes – there's no simpler way around it since your business logic has to be defined on some layer.
 
Hope this helps!
 
Best regards,
Mykhailo

Public
Darius Studdard February 16, 2022

Hi.  I was wondering if this has been addressed in any way by you guys in the releases since our discussion about it last year.  We are currently running V 2.8.31.  We've tried the role-based approach and have had some success with it but the problem is that it doesn't fully work to limit data in the filter window for all dimensions unless we completely restructure our cubes to add connections to Organization/Location for all of the data.  So right now the filter window limits data properly when we select items that are from dimensions that explicitly have Organization/Location on them..but not for the others. This plus the fact that maintaining roles is a lot of maintenance for us in our use case makes the role-based approach unrealistic for us to use going forward.  I'm still not completely clear on why/how this filtering works perfectly in the grid without us having to make any cube changes, yet this filter window is so much of a different beast.  
I've also tried going back to using the subquery property and just making the MDX a bit more complex but run into similar issues with dimensions that don't have Organization/Location as properties.  At this point our license is up for renewal soon and whether we have a solution for this will determine if we use your product going forward.  We'd really love to avoid having to restructure our cubes if possible.  Please advise if you have any more guidance on this.

Public
Vera Didenko Vera Didenko Flexmonster February 17, 2022

Hello, Darius,
 
Thank you for reaching out to us and for explaining the case in detail.
 
As we understand, there are dimensions in your cube that are not connected to Organization/Location. Consequently, using roles or subquery limits the data to a specific Organization/Location on the grid. However, it doesn't filter out members in the filter pop-up for such dimensions (that are not connected to Organization/Location).
 
Flexmonster displays data that your cube provides. Hence, it can be expected that dimensions that are not connected to Organization/Location on your cube will display all members in the filter pop-ups because they were provided in your cube's response. At the same time, we understand that you would like to avoid restructuring your cubes to add connections to Organization/Location to all necessary dimensions. Therefore, our team is currently looking for possible workarounds that would help solve this issue from the client-side.
 
Currently, we are evaluating a solution that would allow hiding members in the filter pop-up for such dimensions. The general idea is to add a new property when selecting dimensions in Flexmonster's report configuration. This property will determine whether Flexmonster should hide or show unused members in the dimension's filter pop-up window. By unused members, we mean members that were not initially displayed on the grid (were not included in the data slice). Ideally, such an approach will hide unwanted members in the filters' pop-up window and, as a result, help solve the issue on your end without having to restructure your cubes.
 
Do you think such a solution would be suitable for your case?
 
We are looking forward to hearing your thoughts on this.
 
Kind regards,
Vera

Public
Darius Studdard February 17, 2022

Hi Vera,
Yes if you guys are able to add an additional property to the report configuration that could allow us to limit the data in the filter window appropriately based on the same filters that are on the grid I think that would work for us.  Please let me know when you guys make progress with this as I'd love to test it out.
 
Thanks, 
Darius

Public
Vera Didenko Vera Didenko Flexmonster February 21, 2022

Hello, Darius,
 
Thank you for your confirmation.
 
Our team will need some time to evaluate and research the best approaches for implementing this feature. We will share the results of our research with the ETA 22nd of March.
 
In the meantime, feel free to reach out to us should any questions arise.
 
Kind regards,
Vera

Public
Darius Studdard February 21, 2022

Alright Vera.  I'll look forward to hearing about the implementation of the fix by then.  In the meantime, I believe our licenses will be expiring soon.  This is our first time renewing so if someone from your team could contact me directly regarding renewal process that would be great.
 
Thank you!
Darius

Public
Vera Didenko Vera Didenko Flexmonster February 21, 2022

Hello, Darius,
 
Thank you for your reply.
 
We will keep you updated on the new property implementation process.
 
Regarding the renewal process, our team has contacted you via email.
 
We will keep in touch!
 
Kind regards,
Vera

Please login or Register to Submit Answer