Problem solve Get help with specific problems with your technologies, process and projects.

Security implications of using multicubes vs. basic cubes

This tip is a discussion thread from SearchSAP's new SAP FAQ lists. This thread discusses the security implications of using multicubes vs. basic cubes in SAP BW.


Does anyone have any experience with reporting authorization checks and multicubes? I'd like to know if the reporting authorization checks on basic cubes are checked when the user accesses them via a multicube. What happens when different checks are on the multicube and the basic cube?

Are there any other security considerations for using multicubes vs. basic cubes?

We have been advised by SAP that the consistent use of multicubes regardless of whether we need them technically or not (so an additional layer of abstraction from the data) will benefit us in terms of flexibility in data modeling going forward. We are assessing the cost/benefit.

The rule as stated by the BW team would be: Queries should only ever be created on a multiprovider, never on a basic cube. Even if that means creating a multicube with only one cube attached. This would limited via security.

Reply 1

The info-providers that are applicable to a reporting authorization object are selected in transaction RSSM. The multi-providers are selected in the same manner as basic info-cubes and ODS. For example, if you have the info-object 0Plant flagged as authorization relevant and have created a reporting authorization object, you can select the info-providers to apply the check.

Reply 2

If you have authorization on the basic cube they will be checked if accessing via multicube. Putting the authorization on the basic cube is better as it is more manageable.

Using a multicube in circumstances where there is only one cube can be advantageous as you can do maintenance to the basic cube underneath the m/cube with out impacting the users (i.e. build a shadow cube)

SAP now recommends now using m/cubes wherever possible.

This tip presents an SAP FAQ discussion thread. The SAP FAQ is the latest addition to's portfolio of collaborative, interactive and independent support resources for the SAP community. By registering as a member of the SAP FAQ network, you'll have the opportunity to trade lessons learned and practical advice with other SAP users on a range of SAP-specific topics. Sign up for free SAP FAQ membership here.

Dig Deeper on SAP Business Warehouse

Start the conversation

Send me notifications when other members comment.

Please create a username to comment.