[Mondrian] Problem with dynamic roles extending MDXConnection

Xavier Gumara xgumara at gmail.com
Mon Jun 10 05:38:10 EDT 2013


I am trying to implement dynamic roles in Mondrian (3.5) and Pentaho (4.8)
using a custom MDXConnection class but I can't get it to work.

Using Steel Wheels, my goal is to have a "Territory Manager" role and
dynamically assign Territory access (EMEA, Japan, NA,...) to each user.

1. First of all I added this role tag in the schema and assigned the role
to user Joe:

<Role name="Territory Manager">
<SchemaGrant access="all">
 <CubeGrant cube="SteelWheelsSales" access="all">
<HierarchyGrant hierarchy="[Markets].[Markets]" access="custom"
 <MemberGrant member="[Markets].[EMEA]" access="all" />

2. Secondly I implemented classes SteelWheelsMDXConnection
and SteelWheelsCustomRole as follows. The goal is to change the territory
Joe has access from EMEA to Japan. I modified the pentahoObjects.spring.xml
file accordingly.

public class SteelWheelsMDXConnection extends MDXConnection {

protected void init (Util.PropertyList properties) {
Connection thisConn = this.getConnection();
Role authRole = thisConn.getSchema().lookupRole("Territory Manager");
 SteelWheelsCustomRole customRole = new SteelWheelsCustomRole(authRole);


public class SteelWheelsCustomRole extends DelegatingRole {
 private String territory;
private static String HIERARCHY_NAME = "Markets";
 public SteelWheelsCustomRole(Role role) {
super(((RoleImpl) role).makeMutableClone());
this.territory = "Japan";
public HierarchyAccess getAccessDetails(Hierarchy hierarchy) {
 HierarchyAccess ha = super.getAccessDetails(hierarchy);
return (ha == null ? null : new CustomHierarchyAccess(ha));
 protected class CustomHierarchyAccess extends
RoleImpl.DelegatingHierarchyAccess {
 protected HierarchyAccess ha;
 public CustomHierarchyAccess(HierarchyAccess ha) {
this.ha = ha;
public Access getAccess(Member member) {
return SteelWheelsCustomRole.this.getAccess(member, ha.getAccess(member));
 public Access getAccess(Hierarchy hierarchy) {
return role.getAccess(hierarchy);
public Access getAccess(Member member) {
 return getAccess(member, role.getAccess(member));
 protected Access getAccess(Member member, Access access) {
String memberHierarchyName = member.getHierarchy().getName();
 if (memberHierarchyName.contains(HIERARCHY_NAME)) {
if (member.getName().equalsIgnoreCase(this.territory)) {
 return Access.ALL;
for (Member mem : member.getAncestorMembers()) {
 if (mem.getName().equalsIgnoreCase(this.territory)) {
return Access.ALL;
Access acc = (access == Access.CUSTOM) ? access : Access.NONE;
return acc;
return access;
public Access getAccess(Level level) {
return role.getAccess(level);
public boolean canAccess(OlapElement olapElement) {
 return true;

3. The code executes without errors but Joe still sees EMEA only when I
create a new analysis view.

If I debug the code, I can see the "getAccess(Member member)" method only
gets called for the "All markets" member. Is this supposed to be the way to
work with dynamic roles? How can I get children members for "All markets"?
Where does access to Territories get checked when creating a new MDX

Thank you for your answers.
Xavier Gumara
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.pentaho.org/pipermail/mondrian/attachments/20130610/23dedfbf/attachment.html 

More information about the Mondrian mailing list