Session parameters and security in TM1

[bfmooz]

My company currently has a Cognos 8 environment and we are preparing to now implement TM1.

In Cognos 8, we utilize two layers of security.  First, we use group security to grant access to packages.  Additionally, because we also have user level security restrictions, we also have implemented parameter maps that feed session variables that essentially list the user login names and valid values to apply to data elements.

In the TM1 training classes, they discussed leveraging group security but did not reference any additional layers of security like we have implemented in Cognos 8.  I asked the instructor if there is any similar functionality, but he was not too familiar with the Cognos 8 side to draw comparisons.  Has anybody come across this scenario before and if so, what can be done to utilize this type of security?

[mikewalker]

In TM1 you can assign Cognos users/groups permission to access elements of a cube, thereby providing object-level security.

However this is not as simple as it sounds.

For example, in the BI world of security it makes sense that if a user/group is granted access to a child element then they should also be able to see the parent element. Not true for TM1 security. Sometimes a TM1 admin will only want a user/group to see child elements and not the parents.

For our implementation this is proving difficult to test, and we are exploring different methods of applying hierarchical security eg building a new flat TM1 cube, or "publishing" the TM1 out to a datastore and building a FM model from there...

Does anybody know if there are any best-practice guides for combining TM1/BI security together to provide object-level security in reports?

Update: Found this thread which might be of some help: http://www.cognoise.com/community/index.php/topic,8672.0.html