Special Scenarios for Row and Column Permissions

Version

Description

Admins can allow different users viewing different data by setting row and column permissions. But if row and column permissions are set for Dept., Role, and users at the same time, or complex settings such as associations are used, the expected results may not be achieved.

Solution

This article will explain some special scenarios of row and column permissions.

OR Relationship After Setting Row Permission for Dept., Role, and Users at the Same Time

Setting Permissions

For example, Alice is the Minister of Technical support and also a Common role. Set the Row Permission of the table Brand Dimension on these three aspects (Minister, Role, and User final authority).

1. Set Dept. permission for Alice. Select Technical support > Minister.

Set the field Brand Description in Brand Dimension to In NEW BALANCE.

2. Set Role permission for Alice. Select Common role.

Set the field Brand Description in Brand Dimension to In HANG TEN.

3. Set Row Permission for Alice. Select User final authority > Alice.

Set Brand Description in Brand Dimension to In ZIPPO.

Alice logs into FineBI. The table she can see finally is displayed after the calculation of OR relationship of three Row Permission conditions.

Note: If a user has been individually set with Use/Manage/Authorize permissions, a yellow portrait icon will appear after setting Row Permission. If you need to restore the inheritance of Dept./Role permissions at this time, click Restore Inherited Permissions. A prompt box will pop up: Are you sure to clear the user's individual permission settings for Directory and restore inheritance from department/role permissions? Click OK to confirm.

OR relationship After Partly Setting Row Permission for Dept., Role, and Users

Setting Permissions

For example, Alice is the Minister of Technical support and also a Common role. Set the Row Permission of the table Brand Dimension on these three aspects (Minister, Common role, and User final authority).

Note: Set Row Permission partly.

1. Set Dept. permission for Alice. Select Technical support > Minister.

Set the field Brand Description in Brand Dimension to In NEW BALANCE.

2. Set Role permission for Alice. Select Common role.

Set the field Brand Description in Brand Dimension to In HANG TEN.

3. Set User final authority for Alice. Select User final authority > Alice.

Set Use permission for Brand Dimension without setting Row Permission.

The table Alice can see finally is displayed after the calculation of OR relationship, which does not include roles and users without Row Permission.

AND Relationship for Row Permission Within Dept. and OR Relationship for Row Permission Between Different Depts.

For example, the hierarchical department relationship is Test Department (including Product Line 1 and Product Line 2) and Development Dpartment (including Product Line 1 and Product Line 2).

Sample data: 

Employee Information.xlsx

Setting Permissions

1. Upload the table Employee Information.

2. Alice is both a member of the Test Department and a member of the Development Department in Product Line 1.

Assign the permission of the table Employee Information to the entire Test Department, select the field Department, and set the Row Permission to In Test Department.

3. Assign the permission of the table Employee Information to Product Line 1 of the Testing Department, select the field Group, and set Row Permission for the table Employee Information to In Product Line 1.

4. Assign the permission of the table Employee Information to the entire Development Department, select the field Department, and set the Row Permission to In Development Department.

5. Assign the permission of the table Employee Information to the Product Line 1 of the Development Department, select the field Group, and set Row Permission to In Product Line 1.

Alice logs into FineBI to view the table Employee Information. She can see data from Product Line 1 of Test Department and Development Department.

Available for Main Table to Filter Child Table During the Settings of Row Permission for Tables with Associations (Effective in Cross-Folder)

For example, there are three tables: Product Name Dimension Table, Contract Fact Table, and Contract Receipt Fact Table. Their associations are shown in the following figure:

Note: Product Name Dimension Table is the main table of Contract Fact Table, and the latter one is the main table of Contract Receipt Fact Table.

Setting Permissions

1. Add the Product Name Dimension and the Contract Fact Table to the folder Package A and the table Contract Receipt Fact Table to the folder Package B. Assign Use permission of the Product Name Dimension Table and Contract Receipt Fact Table to Alice.

2. The admin sets Row Permission of Contract Fact Table in Package A for Alice. Select the field Purchased Products and set the condition to In 1.

1. Alice logs into FineBI and can see all data from Product Name Dimension Table without being affected by Row Permission.

2. Alice can only see data whose Purchased Product is equals to 1 in the Contract Fact Table and Contract Receipt Fact Table. The result is affected by Row Permission.

AND Relationship for the Settings of Row Permission for Multiple Main Tables

Setting Permissions

For example, there are three tables: Product Name Dimension Table, Contract Fact Table, and Customer Dimension Table. Their associations are shown in the following figure:

Note: The Product Name Dimension Table and Customer Dimension Table are both main tables of the Contract Fact Table.

1. Set Row Permission for Product Name Dimension Table. Select the field Product ID and set the condition to In 5,6,7.

2. Set Row Permission for the Customer Dimension Table. Select the field Province and set the condition to In Shanghai.

3. Assign Use permissions for the Contract Fact Table without setting Row Permission.

Alice logs into FineBI and can only see the data whose Product ID is greater than or equal to 5 and Province is Shanghai.

Reconfiguring Column Permission When Switching from Use Permission of Folder to Manage Permission

For example, if you set Row Permission and Column Permission while only enabling Use permission of a folder, when you later enable Manage permission, the previously set Row Permission will still be effective, but the Column Permission will need to be reconfigured.

OR Relationship for Column Permission Between Dept. and Role with the Principle of User First

For example, Alice belongs to both Technical support and Common role.

1. Set Column Permission of Contract Fact Table in Package A for the department Technical support. Select fields Contract amount, Contract Payment Type, and type of contract.

2. Set Column Permission of the Contract Fact Table in Package A for Common role. Select the fields type of contract, Has it been delivered, and Contract signing time.

3. At this point, set Column Permission for Alice again. Select the field purchased products in the Contract Fact Table.

Alice logs into FineBI and can only see the field purchased product. Alice's Column Permission is decided by the settings on her. The settings for Dept. and Role do not affect her.