Use Custom Attributes to Filter Data by User
This applies to: Managed Dashboards, Managed Reports
A custom attribute is a custom value assigned to users, groups, or tenants by an administrator. These are similar to several attributes built into Symphony describing each user that you can select as tokens when filtering a data cube, such as Current Account Name and Current Culture Name.
Filtering by attributes and custom attributes allows you to accomplish user-dependent filtering or row-level security. For example, when a user is viewing a dashboard based on a particular data cube, the data can be automatically filtered so that the user only sees the data corresponding to the custom attribute value associated with their account.
This walkthrough shows you how to set up custom attributes and use them to filter a data cube transform parameter, which is one way to accomplish row-level security.
Note: Use custom attributes with security hierarchies instead of a transform parameter to take advantage of warehouse or in-memory storage and avoid other limitations with lower-level filtering.
Example Preparation
Create a data cube
Log in as a system admin or tenant admin.
Create a new data cube using the Blank option.
Drag table from a data connector in the Explore window to the canvas. Two transforms are added: SQL Select and Process Result.
Select the Process Result transform, then the Data Preview window.
Decide which column to use for filtering and make a note of the column name to use as a dimension later. in this example, we're using ShipCountry.
Create a new dashboard
Create a new dashboard using the Blank template.
Open the Export window, locate the new data cube, and drag a measure to the canvas, which appears as a table visualization. In this example, Freight.
-
Drag the column you selected earlier over as a dimension to the Row Header drop zone on the table.
-
In the ShipCountry column, verify that the same information is shown here as in the data preview for the data cube.
Add a Custom Attribute
In SymphonyAdministration, select Account Service to expand its items and choose Custom Attributes, then select Add New to add a new custom attribute.
In the Add Custom Attribute work area, make the Name your preferred name and check that the Currently Selected Data Type matches the type of values you will be filtering by. In this example, we use Country Name and String..
Note: Custom attributes are also applicable in a tenant environment.
Select Submit and the new custom attribute is listed on the page.
You can return here later and select it to edit it from the toolbar, or you can also check its references to find accounts or groups with values assigned to it or files that are using it.
Add a Custom Attribute
In SymphonyAdministration, select Account Service to expand its items and choose Custom Attributes, then select Add New to add a new custom attribute.
In the Add Custom Attribute dialog, set the Nameand check that the Currently Selected Data Type matches the type of values you will be filtering by. Country Name and String in our example.
Select Save. The new custom attribute will be listed on the page.
You can return here later and select it to edit it from the toolbar, or you can also check its references to find accounts or groups with values assigned to it or files that are using it.
Assign Custom Attribute Values
As an administrator, you can assign the custom attribute values for users, groups of users, and tenants. Assign a value for each user or group that needs to access the data from the data cube that will be filtered.
Assign a custom attribute to a user or group
Navigate to the Administration work area and select Accounts or Groups under Account Service.
Select a user or group, then Edit on the tool bar. A '<user name>' account details or '<group name>' group details work area opens.
-
Select Custom Attributes to open the View custom attributes dialog. Here you can view and update the custom attributes assigned to this user or group.
If applicable, select a Scope (Global, or a tenant name).
-
Select Add custom attribute to open the Select custom attributes dialog.
Select the attribute to apply to this user or group, then Save your selection. The Edit Custom Attribute dialog opens.
Enter the value for this custom attribute (or multiple, if mufti-select is applicable to this attribute. In our example, France.
-
Optionally, select an OLAP or data cube if security hierarchies are involved. See Using a Security Hierarchy to Filter Data by User.
Save all of your changes. The custom attribute will affect what the user or group member can see the next time they log in.
Filter a Data Cube Transform
When you edit a data cube, you can configure the SQL Select transform and a Filter to filter the cube's data by each user's custom attribute values. These values may be directly applicable to the user, or secondarily through group or tenant membership.
Add a filter transform to a data cube
Open a data cube that contains a filter or an SQL Select transform. Select the link between two transforms, for example, from a SQL Select transform to a Process Result transform.
Add a Filter from the Add / Edit menu.
Select the filter. Using the Contextual menu or the right-click menu, select Configure to open a Filter dialog.
Scroll through the list of columns (Input Elements) to find an element to filter and edit it to open the Transform Element dialog. For our example, this is ShipCountry.
-
Set the Element Operator to select your desired filter option, and a value or values the filter should use. For our example, Equals and France.
Save your changes. This filter value is now applied to the data as it is read from the source transform (SQL Select) through to the next transform (in this example, Process Result).
-
To verify your results, select the Process Result transform while logged in as the user or the member of a group this custom attribute is applied to. The Data Preview window shows only data that meets the custom attribute defined in the Filter.
Note: If you've defined this custom attribute for a specific user, group, or tenant, it will only show for that user, members of the specific group, or members of the tenant.
Verify the Data in a Dashboard
Open the dashboard you created earlier. The table visualization only shows records with a ShipCountry of France.
Multi-Value Custom Attributes
Custom attributes can hold a single value, or support multiple values.
Define a multi-value custom attribute
-
Create a new custom attribute by navigating to Administration > Account Service > Custom Attributes.
Note: You also edit an existing custom attribute to make it multi-value. -
Select to enable (check the check box) Multi-Value on the Add custom attribute or Edit custom attribute dialog.
Important: If you save a custom attribute as multi-value attribute, it can no longer be a single value attribute. Delete it and recreate it as a single-value attribute. Next, edit values for the custom attribute for the user, group, or tenant account. Navigate to the Administration work area and select Accounts or Groups under Account Service.
Select Custom attributes on the '<user name>' account details or '<group name>' group details work area. The View custom attribute dialog opens.
-
Select the attribute to edit. The Edit Custom Attribute dialog opens. Select Add value to add more values as needed. In this example, Germany and Spain.
Save all of your changes. The custom attribute will affect what the user or group members can see the next time they log in.
Add a parameter to the data cube to use the multi-value custom attribute
-
Open and edit a data cube that includes at least one SQL Select transform.
Note: If you use the same data cube created earlier, remove the filter transform. Select the SQL Select transform. Using the Contextual menu or the right-click menu, select Configure to open a SQL Select dialog.
Scroll to select and edit Parameters. The Transform Parameters dialog opens. Select Add parameter to open the Configure Transform Parameter dialog.
-
Set the Parameter Type you wish to use, and select the Connector Element that is used. In this example, Output Element Filter and ShipCountry (String(15)).
Select Save. The Configure Transform Parameter work area opens.
-
Define the Parameter Value and Type as Collection (for multi-value custom attributes), then select the parameter name from the overflow menu. In this example, Country Name.
Close all open dialog boxes.
Verify the Data in a Dashboard
Open the dashboard you created earlier. The table visualization only shows records with a ShipCountry of France, Germany, and Spain.
Filtering the raw data using a transform parameter in a data cube is too low-level to determine which values appear to different users in filters connected to a hierarchy, and whether notes attached to hierarchy values can be shared between users. Use custom attributes with a security hierarchy instead to affect the values shown in hierarchy filters and to allow notes to be shared between users when appropriate.
Select the Server Only option to prevent the custom attribute value from being sent to the user's web browser, in case it contains sensitive information or large amounts of data. These custom attribute values can only be read by system administrators, as well as tenant administrators if the custom attribute was associated with their tenant.
In the case of a single-value custom attribute or a multi-value value with an inheritance behavior of Override, the attribute value set for an account will override any values inherited from groups. If there is no value set on the account, differing values inherited from multiple groups may result in a conflict error.
For more information, see:
Comments
0 comments
Please sign in to leave a comment.