Securing Data by Dimension Value Using XDS - AX2012
Securing Data by Dimension Value Using XDS - AX2012
http://www.microsoft.com/dynamics/ax
Scenario ...................................................................................................... 3
1. Relate a user to a worker ................................................................................................... 4
2. Assign a worker to a position .............................................................................................. 6
3. Assign a position to a department ....................................................................................... 7
4. Organize a department in a hierarchy .................................................................................. 8
Impact ...................................................................................................... 17
Scenario
This white paper describes filtering financial data by department, which is stored in the
OMOperatingUnit table with OMOperatingUnitType set to “Department”. The domain of values that
may be used to specify the department dimension field is also exposed by the view
OMDepartmentView. Departments are associated with users through the following relationships.
1. Users are related to zero or more workers through user relations.
2. Workers are assigned to zero or more positions.
3. Positions are assigned to zero or one departments.
4. Departments are organized in an organization hierarchy.
This white paper defines a user’s valid departments as all departments associated with a position the
user is assigned to through a worker, as well as all departments which are descendants of those
departments in a hierarchy. A more precise example is shown below for each of these steps.
10
However, no tables hold a foreign key directly to the DimAttributeOMDepartment view. Instead, they
hold foreign keys to DimensionAttributeValueCombination and DimensionAttributeValueSet, which are
related to the DimAttributeOMDepartment view through a number of joins.
You will also need to model similar queries for tables DimensionAttributeValueCombination and
DimensionAttributeValueSet.
The records in the DimensionAttributeValueCombination table are ledger accounts and default
accounts. Tables such as LedgerJournalTrans hold a foreign key to this table, and logic on forms
provides the interaction necessary to show the constituent dimension segments.
Note: The LedgerJournalTrans table should not be joined to the MyDepartments construct with an
“exists join”. Using an “exists join” would filter out combinations that do not have a department
segment, which is incorrect. Instead, it should be joined by using two “not exists” joins. The query
that contains the join structure returns all combinations that do not have a department segment that
the user does not have rights to view. Those combinations with no department segment are fine to
include, as are those that have a valid department segment.
11
The top data source in the query is the table that is being filtered – LedgerJournalTrans in this
example. Therefore, a different query will need to be created for each of the tables that must be
filtered. The reason for creating separate queries instead of using free-form expressions on query
policies is performance. In order to use free-form query policy expressions, an “OR” clause must be
used. This has been found in volume dataset testing to result in bad SQL query plans that cannot be
fixed through indexing alone. By creating separate queries and policies for each table, you avoid these
bad query plans and maintain acceptable performance.
Another important piece of this query is the range on
DimensionAttributeLevelValueView.DimensionAttribute. It is possible to set up multiple dimension
attributes backed by the same underlying entity that are used for different purposes. For example,
you can have one dimension attribute called “department” and another called “trading partner”, both
backed by the department entity. In this case, the combinations should filter by valid “department”
but allow the user to see other “trading partner” values that are not related to the user’s departments.
12
After this functional predicate has been created, it can be referenced as the value for a range on the
DimensionAttribute field.
13
14
15
16
Impact
While the general impact of applying these security policies is what would be expected, there are a
few side effects that should be considered.
First, journal records are not filtered by the lines that they contain. A more advanced XDS policy could
be constructed to perform this additional filtering, but the additional joins would be fairly costly from a
performance perspective. Determining which journals existed would require joining
LedgerJournalTable to LedgerJournalTrans, and then also joining all of the security information.
Assuming the journal records are not filtered, that means a user may see fewer lines in a given
journal than actually exist. In this case, the journal totals will not match the total amount for all lines
shown on the form, because some lines are hidden. The filtering of journal records is configurable
based on how the XDS policy is constructed.
Second, there is a performance cost to applying additional security. Instead of simply querying a table
such as LedgerJournalTrans directly, the system needs to join through a few other tables to determine
which records should be visible. The performance cost, measured in SQL Server processor and
memory load as well as in AOS processor and memory load, is minimized by pre-compiling the list of
valid departments using the MyDepartments construct, but there is still overhead to the join. The
added cost of this join should be weighed against the required performance characteristics of any
given scenario. This decision can be made on a table-by-table basis as well because constrained tables
are added individually to security policies.
17
AccountingDistribution.LedgerDimension
AssetBudget.LedgerDimension
AssetBudget.OffsetLedgerDimension
BankDocumentPosting.BankLGLiquidationLedgerDimension
BankDocumentPosting.MarginLedgerDimension
BankDocumentPosting.MiscChargesLedgerDimension
BankDocumentPosting.SettleLedgerDimension
BudgetCheckResultErrorWarningDetail.BudgetControlLedgerDimension
BudgetGroupLedgerDimension.BudgetControlLedgerDimension
BudgetSourceTrackingDetail.BudgetControlLedgerDimension
BudgetSourceTrackingSummary.BudgetControlLedgerDimension
BudgetTransactionLine.LedgerDimension
CustInvoiceDistributionTemplate.LedgerDimension
CustVendPaymJournalFee.LedgerDimension
CustVendPaymProposalLine.LedgerDimension
DimensionFocusBalance.FocusLedgerDimension
DimensionFocusBalanceCalculationView.FocusLedgerDimension
GeneralJournalAccountEntry.LedgerDimension
GeneralJournalAccountEntryHash.LedgerDimension
InventCostTransVariance.LedgerDimension
InventCostTransVariance.OffsetLedgerDimension
InventSettlement.BalanceSheetLedgerDimension
InventSettlement.OperationsLedgerDimension
InventTransPosting.LedgerDimension
InventTransPosting.OffsetLedgerDimension
InventValueReportFinancialAdjustment.LedgerDimension
InventValueReportFinancialAdjustment.LedgerDimensionOffset
18
19
Default dimensions
The following table fields hold a foreign key to the DimensionAttributeValueSet table and therefore can
be secured by using the pattern shown in the DimValidSetsPurchTable policy.
AccountingDistributionTemplateDetail.DefaultDimension
AssetBook.DefaultDimension
AssetBookMerge.DefaultDimension
AssetDepBookTrans.DefaultDimension
AssetLending.DefaultDimension
AssetTrans.DefaultDimension
AssetTransferHistory.FromDimension
AssetTransferHistory.ToDimension
AssetTransMerge.DefaultDimension
BankAccountTable.DefaultDimension
BankAccountTrans.DefaultDimension
BankCustPaymModeBankAccounts.DefaultDimension
BankDeposit.DefaultDimension
BankVendPaymModeBankAccounts.DefaultDimension
BOMParmReportFinish.DefaultDimension
BudgetAllocationTermDetail.DefaultDimension
BudgetMap.defaultDimension
CommissionTrans.DefaultDimension
CostControlTransCommittedCost.DefaultDimension
CostControlTransCommittedCostCube.DefaultDimension
CostSheetNodeTable.DefaultDimension
CustCollectionLetterJour.DefaultDimension
CustConfirmJour.DefaultDimension
CustConfirmTrans.DefaultDimension
CustInterestJour.DefaultDimension
CustInvoiceJour.DefaultDimension
CustInvoiceLine.DefaultDimension
CustInvoiceStandardLineTemplate.DefaultDimension
20
21
22
23
24
25
This document is provided “as-is.” Information and views expressed in this document, including URL and other Internet Web site
references, may change without notice. You bear the risk of using it.
Some examples depicted herein are provided for illustration only and are fictitious. No real association or connection is intended or
should be inferred.
This document does not provide you with any legal rights to any intellectual property in any Microsoft product. You may copy and
use this document for your internal, reference purposes. You may modify this document for your internal, reference purposes.
© 2012 Microsoft Corporation. All rights reserved.
26