Dynamic roles in Schema Permissons

Question

use-case

All our roles in icCube give only access to one client schema. A user can only have one role. For some users though, I would like to give access to a DEMO domain as well, depending on their e-mail.

my attempt

Considering that the DEMO domain is called "Sales (Demo)", I try to add the following code to each user role:

-- Give access to the client domain
+ <specific client domain> 


+schema [Sales (Demo)]
:schema [Sales (Demo)]

create function isAbc(username_) as instr(username_,'@') > 0 and mid(username_,instr(username_,'@'),100)= '@abc.com'

#IF isAbc(username())

+cube R Sales

#ELSE

-all

#ENDIF

resulting error, why?

This code breaks with an error in the Loaded Schemas:

[ROLES_UNEXPECTED_ERROR] isAbc() : [OLAP_MDX_FUNCTION_UNRESOLVED] isAbc() : the function (isAbc) does not exist location: 

debugging in MDX IDE

When I test the function in the MDX IDE, it seems to work though:

with
   function isAbc(username_) as instr(username_,'@') > 0 and mid(username_,instr(username_,'@'),100)= '@abc.com'
   member measures.a as isAbc('[email protected]')
   member measures.b as isAbc('[email protected]')
   member measures.c as isAbc('admin')
select {a,b,c} on 0
from sales

Result:

	All-M
a	true
b	false
c	false

What am I missing?

Answer 1

It looks like the function isAbc() cannot be used in the preprocessing statements #IF. It's more likely these preprocessing statements are evaluated first to extract the actual list of statements to execute to define the permissions.

As a workaround, you'll need to write the function code inside the #IF statement:

#IF instr(username(),'@') > 0 and mid(username(),instr(username(),'@'),100)= '@abc.com'
...
#ENDIF