Object security rules based on external entitlement systems

The sample includes security rules for metrics, dimensions, measures, and key performance indicators (KPIs).

The sample uses LDAP as the external entitlement system for metrics and KPIs.

Object security rule for metrics

The sample includes the following security rule for the Mortgage_Lending_BAM_MC:

"MCID": "Mortgage_Lending_BAM_MC",
"MCMetricRules":  [ {
                    "MetricIDs": [ "LDAP.$account.title.mappedValue"],
                    "VisibleTo":  {
			"Users": ["SampleUser3","SampleUser4"],
			}
                  } ]

The LDAP.$account.title.mappedValue means that the current user's title LDAP attribute must be retrieved from the LDAP server and then must be mapped to the name of the metric in the rule.

The external entitlement LDAP system provides the external field title for each user, as shown in Table 1:

Table 1. Values from the LDAP server
User	External field (title)
SampleUser3	Employee
SampleUser4	Manager

The mapping table provides the visible objects associated with the external field (title), as shown in Table 2:

Table 2. Mapping of title LDAP attribute to metric ID
External field	Visible object ID (metric)
Manager	Application_Loan_Amount and Completed_Loan_Amount
Employee	None

After this security rule is implemented, only SampleUser4, whose title attribute in the external entitlement system is Manager, has access to see the Application_Loan_Amount and Completed_Loan_Amount metric IDs.

Object security rule for KPIs

The sample includes the following security rule for the Mortgage_Lending_BAM_MC:

"KPIRules":  [ {
                     "KPIIDs":  [ "LDAP.$account.title.mappedValue" ],
                     "VisibleTo": {
                       "Users": ["SampleUser3","SampleUser4"]
                   	  }
                } ]

The LDAP.$account.title.mappedValue means that the current user's title LDAP attribute must be retrieved from the LDAP server and then must be mapped to the name of the KPI in the rule.

The external entitlement LDAP system provides the external field title for each user, as shown in Table 3:

Table 3. Values from the LDAP server
User	External field
SampleUser3	Employee
SampleUser4	Manager

The mapping table provides the visible objects associated with the external field, as shown in Table 4:

Table 4. Mapping of title LDAP attribute to KPI ID
External field	Visible object IDs (KPI)
Manager	Yearly_Maximum_Completed_Loan_Amount, Monthly_Maximum_Completed_Loan_Amount, and Total_Completed_Loans
Employee	None

After this security rule is implemented, only SampleUser4 has access to the following KPIs:

Yearly_Maximum_Completed_Loan_Amount
Monthly_Maximum_Completed_Loan_Amount
Total_Completed_Loans