[Mondrian] base cube role restriction, impact on virtual cube

Matt Campbell mcampbell at pentaho.com
Thu Jul 25 11:25:14 EDT 2013


I'm looking at a defect right now involving a role with no access to two
base cubes, but unrestricted on the virtual cube in which the cubes
appear.  The role does not restrict access to the data in those two
cubes when accessed via the virtual cube.  This is arguably correct
behavior, in that the designer of the virtual cube may have specifically
thought about what should be accessible from the underlying base cubes
and intentionally left it accessible.  I'm curious to hear what others
think.

The actual error in the defect is a NPE when ValidMeasure() resolves the
base cube one of the measures is on.   getCubes() only returns the cubes
accessible to the role.  If the current virtual cube role behavior is
correct then I think we'll need to find some way of looking up the full
set of base cubes in the virtual cube, even if in a restricted role.

I haven't tried yet, but I'm betting this is a non-issue in 4.0 since
virtual cubes have gone away.


More information about the Mondrian mailing list