Cognos Users Classes and Access Manager

[tnayfeh]

Hi,

I'm just trying to get an idea of how to best setup and use User Classes...ie. best practices.
Is it a good idea to setup user classes based on department?
The reason I ask this is because certain "power users" or managers will have broader access than others.

One example I have is based on a Sales Cube. I have a user class setup for "Sales Managers" and another for "Sales Users". Within the cube "Standard Cost $" is restricted so that only Sales Managers can view the measure, that's not a problem. However there are also some, but not all, finance people that need access to the measure. And it doesn't make sense for them to be part of the Sales Manager user class, so I created Finance Managers and Finance Users classes. Is this how user classes should be setup? Seems like it may get messy this way.

Thanks!

 

[CognosPro]

tnayfeh,

The best way to setup your security in Access Manager is to look at the exclusions you will need to make and set them up hierarchically. Remember, you want to keep it as simple as possible for the least amount of maintenance. However, you want to build something that will include all of the areas you will be reporting on i.e. Sales and Finance.

In your case, you have stated that you have certain users that are allowed "Cost" access. So you should have two user classes - "Cost" and "No Cost". Under these two user classes you will then setup other user classes perhaps depending upon their Sales Region or Department. It should look something like the following:

Root User Class
Users
Cost
Finance Managers
Sales Managers
Sales Managers West Coast
No Cost
Sales Managers NC
Sales Manager NC West Coast

*NC stands for No Cost

If you set up your security this way, the children automatically inherit the rights/exclusions of the parents. Depending upon the security rights, you would deny certain access to fields/data within the catalog/query item and measurements within the cubes.

I hope this helps.
CognosPro