1. SSAS Security Model with Maintenance Plan
Secure
Enable
Maintain
Sustain
Work smart instead of hard. Enable the business through technology. Create a sustainable, maintainable technology solution; by careful planning and building the correct solution fit to solve the right problem.

2. About Me…
MCP: Microsoft SQL Server 2008, Business Intelligence Development and Maintenance
MCTS: Microsoft .NET Framework 3.5 ASP.NET, Applications
MSBI Consultant/Independent contractor
LewiCool Consulting
15+ yrs Industry Experience
Educator, Network Engineer, Technologist, Consultant Tour Guide (continental US),River Surfing Guide
10 yrs Experience in the MSBI Space
Government,Education,Telecom,Travel,Manufacturing
Corporate/Finance/Legal/Information Security/IT

3. Problems, Solutions and Data Oh MY!
End users need data
Presentation layer data needs to be secured/segregated
Valuable Technology Talent has limited time and excessive work load
MS has created coupled technologies that enable the end-to-end solution big win.

4. Cube Security 101 SSAS Roles are AD dependent
SSAS Security basically divided into 2 types:
Administrative
Role containing the administrators of the cube
Creating/modifying/processing
User Related
Permissions for viewing Cube data
Essentially the “Read” permission on the cube
Dimension based
Cell based
Define what data will be rendered to presentation layer.

5. Get ‘er DONE! Keep it Simple Stupid (yet Comprehensive).
Identify exactly who needs to see what
Make use of the Existing Security Processes. Stand on the Shoulders of Giants
Not your job (or problem)
AD Admins can be your best friend
Existing Business Process can enable the big win
Listen, Listen, Listen
Build the right solution
Listen to the reporting needs
ENABLE the Business with Technology
DO NOT create extra work that will not further the business

6. Who needs what?
If Possible use existing groups in Active Directory to define roles in the Cube
AD Admins can identify and enable this process
Existing groups
Naming conventions
Identify the partitions in reporting needs
VP, Directors, Managers, Business Units, Locations
Identify the patterns in the underlying data
Country,State,Division,Territory

7. Dissect the data to tell the story
Identify a pattern in the underlying data as it relates to the business and security.
The data will inherently be organized into patterns with relationships
The business reporting needs will be driven by the very essence of the data:
Who did what, where, when, how
Evaluate the underlying data for design patterns for security roles
Model the security design on business reporting model

8. Who’s job is it? Three fold security implementation
Secure & Enable: Integrated Security and Service Accounts enable the comprehensive framework
Drive report development to leverage the SharePoint Data Sources
Secure & Enable: SSAS roles determine the type of data available depending on the role passed through to the Cube
Maintain & Sustain: SSIS is the tool kit to create and maintain the cube roles

9. “Who see’s what....” Data Sources the gate keepers:

10. Data Sources are the root of the solution!
Service Accounts Solution
High level data access
Dashboards
Enterprise level totals
Integrated Security Solution
Pass through the credentials of the current user
Selective reports developed to harness the cube roles security
Note: Sharepoint Integrated Solutions may require full Kerberos buildout to handle “double hop” issues.

11. Identify the “Role” Security will play in the cube
What needs to be secured
Where can security design patterns be implemented
90-10
Make that 90% count
Put busy work in it’s place
Make that 10% fit
Ensure the VIP access

12. Roles in the cube restrict/allow access to data

13. Create Cube Roles
Define cube roles as they will relate to the business

14. Read Definition Required

15. Read Access to the Cube

16. The Who

17. The What

18. reuse ReUse reUse RE-USE
Create an initial Role to use as a template
SSMS enables duplication of a role
Script the duplication
Create the XMLA script to a new query window
XMLA script can be broken apart and implemented in a SSIS script task
Using SSIS enables C#, SQL, XMLA and connections to EVERYTHING

19. XMLA Scripts to create Role

20. XMLA Role Script

21. Use the Data!

22. SQL fills a DataSet Use the DataSet filled by the SQL task
A ForEach Loop breaks out each item in the dataset
The script task takes advantage of the variables set by the ForEach Loop
Parameters and variables and Strings
Create a custom XMLA script to execute for each country role

23. SSIS enables the Framework

24. SSIS Script Task is the Key

25. SSIS implementation C# Script Validate AD Group
Parameterize valuable data
Accommodate complex/elegant data
Build custom XMLA Script

26. SSIS XMLA task “do WORK”

27. Maintenance
Create Tool Set to maintain security in cube quickly and effciently.
The same framework can be used to quickly create and delete all the roles in the cube(s)
Nightly and/or weekly runs of this frameset can help maintain a comprehensive security model

28. SSIS maintenance framework.
Securing The Cube.
SSIS maintenance framework.
Questions?

29. Contact me…