How to restrict user access to some data - reporting-services

have one question regarding report builder services and BI platforms.
We have multytenant database mongoDB, where we store all our users data, user's orders, user's transactions.
I want each user be able to build their own report (thinking about to use one of these: CrystalReports, JasperSoft, ReportServer).
But the issue is- when user will have access to database (via CrystalReports for ex.), he can easily generate report with other users Orders or transaction data.
What is best practices to provide data (from one database) for users which will use report building tool?

Users should use some UI that operates with intermediate semantic model (dimensions, measures, filtering parameters). They should not have direct access to database and write an SQL - only exception is possible if you have separate DB for each customer.
Right solution highly depends on the purpose why users create their own reports. If primary goal is business intelligence you may offer your users some kind of pivot tables / pivot charts builder.

Related

How to architect an API first multi app platform?

I am trying to build an API first web app that has two parts:
Part A: The Project Management App. This would be built using php/mysql. One of the table in the mysql DB will be the users table where all users information will be stored viz username, password, email etc.
Part B: The online chat App. The users of the project management system will be able to chat among themselves. This will be built using nodejs/mongo. The mongodb DB would store the chat transcripts of each users and so would have a users collection containing the user details. The users collection would contain the same user information that the mysql users table has viz username, password, email etc.
Now, i have a couple of questions in terms of the architecture of this app.
Question 1: Is it at all a wise idea to maintain two different sources to store the user's information? The reason why I wanted to have a replica of the users table in the MongoDB as well is because since there will be too many reads and writes happening in the chat app so its best we use a nosql DB. (Lets assume here that my app will be used heavily going forward)
Question 2: If the answer to Question 1 is "Yes", how do we make sure of data consistency? I have thought of two approaches to achieve this:
Option A: Since we are using the API first approach, so during the registration of a user when the CREATE user api call is made, it will add the user in both mysql and mongodb databases.
Option B: I setup a cron that will sync the data between the mysql users table and the mongodb users collection periodically.
Can someone please throw some light on this and tell me if my approaches are right and that if I am going towards the right direction.
Many thanks

Multi-tenant Reporting Solution

We have a multitenant site where each clients data is partitioned by the equivalent of a customer_id. We currently have a basic (custom) reporting system where we maintain a set of SQL queries with parameters that get replaced (based on the logged in user) to enforce the data separation. While its not ideal it works for our current needs.
However, we are now having more and more sophisticated reporting requests including the ability for ad-hoc reporting. Most off the shelf reporting tools assume you have the ability to expose the entire dataset. We need the ability to restrict the data available to the tool to a specific customer.
For background our app is a Symfony2 application backed by MySQL and it would be nice to (relatively) easily embed the tool within the app.
Specific solutions/software are appreciated along with general approaches to multitenant reporting.

SSRS - different permissions for the same reports

I have 3 brands, and each brand has it's own mysql database.
In general each database has the same schema, unless they're out of sync due to different release dates.
I have a Microsoft database with each mysql db as a linked database.
Also, I have different schema in the Microsoft database for each product, with views using openquery to get the data from the linked mysql databases.
Lastly, there is a 4th schema which is a union of the views from the different product schemas. All reports are based off this 4th schema, so they include data from all 3 brands.
Now, we need to segment by brand. Reports should be the same, but some people should only have permission to see specific brands, some should see all brands, etc.
What is the best way to do this, so I still only have to maintain one version of each report?
I thought of linked reports in different folders, but how do I build in the permission by brand?
You could try leveraging the built-in "UserId" variable (=User!UserID) to either integrate with an existing security schema, or build your own, and perform data filtering accordingly.

Same report, different databases

I created reports on Web Intelligence accessing an Oracle database. But now, other people want the same reports. Each one of them has a different database (but all are Oracle) with the same structure but with his own data.
What do I have to do to make the same reports available for all? The reports are the same, but the connection or universe changes depending on the user that is running it.
I don't want to make a copy of them to each person, because any change on one report has to be available for everybody.
Regards,
Antonio
If this product sits on a server, you might be able to exclude the database login and password, so the user has to enter in a separate login and password for the database they have to log into. Perhaps this is something your DBA sets up for each database user to have read-only access to certain tables.
If your documents are built on top a "classic" UNV universe, this can be done at the universe level by defining connection restrictions. If you are using a new BI4 UNX universe, you will need to create Data Security Profile Connections. Both of these mechanisms allow you to map alternate database connections for different users within the same universe (and therefore share the same documents based on that universe).
This functionality is fairly well described in the Universe Designer documentation (for UNV) and the Information Design Tool User Guide (for BI4).

How can I provide public access to a subset of a database?

Background
My research group and I are developing a database to store our data and we are building an software tool that simplifies access to these data. The database will holds data that has been published and that we would like to make available, alongside data that has not been published and that belongs to other researchers.
Objective
We would like for our work to be easily reproducible, and to this extent, we need to allow the public to run SELECT statements on the data. Three possible solutions include:
for each publication, create a subset of the database that can be freely downloaded (possibly in a virtual machine so that the dependencies of the software tool are met)
for each publication, create a many-to-many lookup table that links data records to publications, and then provide public SELECT permissions to access these records. We could easily replicate the database for public use
Parameterization modules
Automation of prior generation
However, I have been told that even allowing wildcard statements compromises security, which is why I consider option 1 more plausible. Option 1 would also enable us to archive the database as it was used with a particular publication.
update: to clarify, I want the users to be able to reproduce the entire computational workflow, which requires using SELECT statements that can join data tables with auxillary data (like covariates, experimental details) in lookup tables.
Question
What is the best way to provide public access to a subset of the database?
You can distribute subsets of data as a SQLite database, that is, create a standalone datafile that people can download to their own computers. Many scholars, economists, etc use SQLite to share datasets because it is self-contained and installation is painless (and I should add, cross-platform).
Create views with appropriate access privileges, and users that can only access these views, but no underlying tables.