Planning security: the wrong way and right way – which way is yours?

Introduction

Yes, again, not an Essbase subject, or more precisely, not strictly an Essbase subject.

Perhaps I ought to rename this blog to, “Cameron’s Blog For Planning Hackers,” as I seem to spend a lot of time talking about Planning. So, yes, this is a big hint that Planning is on the menu.

The subject of how to best define security in a Shared Services/Planning/Essbase world keeps on coming up with clients and was suggested to me by my much missed, ex-colleague (sob) Josie Manzano. If Ms. Josie suggests something, who am I to argue? It seems like the plurality of opinion is for it, and besides, I can tell my clients to, “Read my blog,” instead of having a conversation about security and hence drive traffic to this site. :)

How not to assign security

I can think of a few ways, all bad...

Assign security directly to a user name

Pro

• It works.

Cons

• Maintenance intensive – what happens when the user gets promoted (surely all who use Oracle EMP get promotions), quits, gets hit by a SEPTA (Southeastern Pennsylvania Torture Transit Authority) bus, etc.?

Assign security to groups without inheritance

Pro

• At least you’re not assigning to usernames.

Con

• Still maintenance-intensive, and you’ll have just as much many manual assignments. What were you thinking? Oh wait, you’re a Victim of Planning 4.x and before, so it isn’t your fault. Remember, all you have to lose are your chains.

Assign security to groups with inheritance

Pro

• Ah, you’ve reached Oracle EPM security nirvana.

• Low maintenance through inherited security.

• Inheritance design allows atomic security assignments.

Cons

• More than four levels of inheritance can bring poor performance, so don’t.

• You’ve had to read my drivel (346 words, thus far) to get to this point.

How does it all work?

1. Assign an upper level group in Shared Services to your Planning application and provision the group to access the application. In Planning; this typically means the Planners role.
   
2. Create one or more subgroups that are members of the overall group you just created. Typically, this is used to assign access to the Planning Plan Type. Note that the subgroups are provisioned to the application through security inheritance – there is no need to provision access to the application at this level.
3. Create yet a third (and in this example, the final) level of groups. There could potentially be many groups here (you may define many, it could be 20, it could be 50, dependent on how focused you define security). This third level is a member of the second group. Again, no need to assign provisioning to these groups.
4. Assign Planners to the third generation groups.
   

Three layers of groups seems a bit much just to provision access to an application. Surely there must be another reason to create this many layers, yes?

Indeed there is – now these multiple security groups are going to be applied to different slices of a Planning (or Essbase) application.

A mythical Planning application

The Planning application TotPlan has two Plan Types (Planning uses strange names for concepts that have been around since the year dot in Essbase) that correspond to databases in Essbase: Consol and Workforce.

The planners in these two Plan Types are mostly mutually exclusive; there are some users active in both, just to be difficult.

In this mythical application there are seven dimensions (note the modified hourglass order with the non-aggregating sparse dimensions at the bottom -- even examples should be optimized):

1. Account
2. Period
3. Entity
4. Employee
5. Year
6. Scenario
7. Version

Please ignore this message

Some dimensions don’t have security, so we can ignore them: Year and Period (Period has access to open and closed months, but this isn't done through security, so the tile of King Pedant remains safely on my brow).

But start paying attention here

Let’s look at the two simplest required dimensions: Scenario and Version.

Within Scenario, Actual will be read-only, Budget will be read/write.

Scenario

To give all of your provisioned planners (remember the first group and and inheritance) access to Actual and Budget, assign the topmost group to Actual, and give it read access. Do the same with Budget but make the access write.

Version

In Version, there are two members: Final and Working. Final gets the read-only setting and Working is set to write.  Again, use the topmost, first generation group to assign access.

That’s it, you’ll never have to worry about base dimensions again.  Note that security was done at a high level group (the highest, really) as access is the same for all Planners.

The big guns

Two required dimensions remain: Account and Entity

Chop the Accounts

When I build a Planning application with more than one Plan Type, I like to create upper level Account parents that segregate by Plan Type. This makes security and dimension builds as straightforward as possible. Yes, this does require extra dynamic calcs in the target (really, it’s the master) Plan Type to pull the XREF’d data from the source Plan Type(s), but I think it’s a small performance penalty to pay for clarity.  I reserve the right to bin the above approach if it doesn’t work for a particular application, dear client(s), so please don’t consider the above set in stone.

Mythical application example -- Account

To do this, name and order the Accounts like the below to split security by Plan Type:

Accounts

|--Wrkforce Accounts

|--Consol Accounts

NB -- Wrkforce, the source of employee expenses, is ordered before target Income Plan Type so that there are no forward dynamic calcs.

I can assign second generation groups to both Plan-Type-by-Account-parent assuming that all Workforce planners can see all Workfoce accounts and the same holds true for the Consol Plan Type.  Do you see the matchup between the upper level Accounts and the groups?
 

How do exceptions get handled?

More restrictive 
If a Workforce Planner did not have access to a single WorkForce Account, or range of accounts, apply his third generation group and assign None access.  This assignment on top of the second generation group Write access works because lower level, more restrictive, security will take precedence.

Access to both Plan Types 

If a Planner spanned Workforce Accounts and Consol Accounts, make his third generation group a member of both the Consol and the WorkForce second level groups. No need to create a special group just for that purpose – they grow like Topsy and quickly veer out of control.

Mythical application example -- Entity

Entity is the last of the required dimensions and it too must have security. Remembering that the default access is None, this is where the third level groups come into play as there (likely) is no general access to cost centers/projects/accounting units/etc.  Assign read or write access to Entity parents or, less optimally, to individual Entity members by third generation group.

Mythical application example -- Employee
This leaves Employee, a custom dimension in Planning-speak. Is this dimension to have security?  Probably. Can you get away with the same groups as used in Entity?  Almost certainly, as Employee dimensions have a habit of mimicking Entity dimension hierarchies.

The other alternative is to not turn on security in Employee, and let the Entity dimension access drive security. This is simpler and my recommendation.

Suggested naming conventions

Mnemonic names
Name the groups something that make a little sense.  You don't have to use my naming convention, but I've not found anything that makes more sense.

Names by generation

• Top level group that provisions access to the application and is used in the Scenario and Version dimensions: appname.
• Second level group for Plan Type access via the Account dimension: appname.PTname.
• Third level group for Entity access: appname.PTname.Entityname.
• BTW, the Entity in question would (could, but ain’t necessarily so) likely not be a level 0 Entity but some upper level parent. Take it easy on yourself and just tell your business owner it can’t be done. You’ll be thanked later when security management doesn’t take over the administrator’s life.

Real (as real as a sample in a blog) world example

Let us examine planner John Q. Public. A friendly sort of chap, with few vices (chiefly an excessive predilection for coffee), and several good points (he likes this brand), John is a planner in Entity 12345 in the Income Plan Type. 12345 is (yes, I said it was a bad idea, but it’s my example, so I do as I please) a level zero Entity.

How, oh how, does this mythical man of government forms get his security? (For non-North Americans – Canada, please note your inclusion by this Yankee because of the awesomeness of Tim Hortons, but actually I have no idea if John Q. Public means anything in the land of Timbits – John Q. Public is sort of the name of the man in the street.)

Steps in Shared Services

1. Create a Shared Services group (native, because my laptop doesn’t have MSAD) named PlnLCM.
2. Create two Shared Services groups: PlnLCM.Consol and PlnLCM.Workforce. Make both groups members of PlnLCM.Consol. NB – In the absence of any security overrides at this level, these groups inherit PlnLCM’s security.
3. Create a Shared Services group named PlnLCM.Consol.12345. Make this group a member of PlnLCM.Consol.
4. Make John Q. Public a user member of PlnLCM.Consol.12345.

Steps in Planning

As application administrator:

1. Migrate identities to ensure that the new groups are pulled from Shared Services if that hasn’t automatically happened already.
2. Perform dimension security as described above (PlnLCM.Consol is assigned to the parent Account "Consol Accounts", etc.).
3. Log out of Planning, and log in as John. Remember, this is a test id you created to prove that it works; real world users will be authenticated through LDAP or MSAD, and you are unlikely to know their password.
4. Note his restricted access – this is the payoff.

It gets better
When Jane Doe is to be added to Planning, you need only create an additional third level Shared Services group, make it a member of PlnLCM.Consol (if she is a Finance Planner), and assign her user name to PlnLCM.Consol.Entityname. As Jane (and John) are inexorably climbing the ladder of corproate success because of their Planning prowess (it could happen, ya just gotta believe), you, humble Planning administrator, need only move their usernames out of the third generation groups and move in new, soon-to-be-similarly-lucky Planners who are kicking down the door to ride the Planning elevator of professional success.

Wrapping it up 
As with most things in life, a little (and really, in the Planning world, the above has to fall into the e category of little) pain and planning deliver big results.

All of the above techniques would true for Essbase (had to bring it ‘round to the name of this blog sooner or later) and filters, except that instead of the Plan Types you will deal with databases.

So, not exactly a hack, and unfortunately, not exactly brief, but definitely a technique worth pursuing.  So maybe that kind of, sort of is a hack.

See you next time.

New Rail Cars Delayed, Fare Hike Promise Broken

I have bad news and worse news. The bad news is our new M8 rail cars are late in delivery. The worse news is that we’ll still be hit with a fare increase to pay for them despite promises to the contrary.

Back in February of 2005, Governor Rell told the legislature she wanted to invest in 300 new rail cars for Metro-North. To help pay for the cars she proposed a $1 per ticket fare surcharge -- to take effect after the cars were in service. Her promise was that (commuters) “should not be asked to pay for improvements until they actually see them, sit in them or park in them.” Those are her actual words. Remember that.

While the surcharge seemed fair, it wasn’t. A $1 surcharge on a $2 ticket would cost much more than on an $18.50 ticket. So the surcharge proposed was replaced with a series of fare hikes to take effect starting January 1st 2010… 1.25% that date and an additional 1% each January first until 2015.

The fare hike schedule assumed that the new cars would be in service by January 2010. But they won’t be.

While CDOT turned over the design and engineering of the new M8 cars to Metro-North, builder Kawasaki continued on its time-line. The first six “pilot cars” were supposed to be delivered August 2009. And a few M8’s were to be in service carrying passengers by December.

Now we hear that those prototype cars won’t arrive until November. Testing for the new cars will take four to six months, with the cars being put through their paces (mostly at night so anxious commuters won’t see them and wonder why they’re not on board).

Assuming the testing goes well (and that’s a big assumption with a new design such as this) it will not be until March, April or May of 2010 that the cars will be officially accepted by CDOT and Metro-North.

Then and only then will production cars be put into service. That’s three to five months after the fare hike has gone into effect. And while the new cars will arrive at the rate of 10 per month, it won’t be until August 2012 that the last of them arrive… again, assuming no production or engineering problems.

But what about the Governor’s promise that fares would not go up until commuters could “see or sit” in the new cars? There’s the rub.

Does seeing the test train running on our tracks fulfill the promise? Not to commuters who are riding in old unreliable cars often older than they are.

It may have seemed reasonable for the Governor to make such a promise in 2005 when the new cars were thought to be achievable by 2008. But that was an impossible dream given that Metro-North’s M7 cars for Westchester service took five and a half years to place in service. (In February 2005 I predicted this is exactly what would happen.)

Governor Rell didn’t break her promise. The legislature did. When they replaced her $1 per ticket surcharge with a fare increase, it became a matter of law, written into the 2007 budget. But now they seem unwilling to bear any responsibility for the Governor or CDOT’s over-optimism.

I asked one lawmaker who worked on the fare compromise if he could rescind the fare hike and keep the Governor’s promise. He laughed and said “no way”, blaming an over-zealous CDOT for being unable to deliver the project on time. “We have a $9 billion deficit to deal with,” he said. “This is the least of our problems!”

There will be public hearings this fall on the January fare hike, moot as they may be given the hikes are already written into law. And I’d expect that more than a few commuters will turn out to vent about politicians long on transportation promises but short on keeping them.

It should be good political drama and fodder for a few editorials, but nothing will change. The fares will go up and if we’re very lucky we might be riding in the new M8 cars by next summer. Maybe.

Woodstock on The Tappan Zee

This summer marks the 40th anniversary of the grand-daddy of all rock festivals… Woodstock. I was in my teens the summer of 1969, but couldn’t get off from my job to join the swarms of rock fans. But I did see most of them.

My job that summer was as a “temp seasonal” toll collector on the Tappan Zee Bridge, joining Westchester and Rockland counties across the mighty Hudson River.

There were two things I learned in that job: how to roll quarters and how to listen to the radio. The tiny booths lacked air conditioning, but I could bring a fan or a radio. My portable FM entertained me eight hours a day as I listened to both the music and the FM DJ’s… a job I eventually earned at WLIR after college graduation.

The FM stations were buzzing about Woodstock for weeks, and that Friday and much of Saturday, every kid in the tri-state area was heading for Yasgur’s Farm. Most weekends were pretty crazy in that job, because in those days tolls were collected in both directions… fifty cents north-bound and fifty cents coming home. (Today the toll is $5 roundtrip).

Busy as it was on summer weekends on that bridge, nobody expected a half-million kids would show up heading to Woodstock, especially not the folks at the Thruway. But after the rock fest was well underway, the Thruway brass realized the mobs would eventually be heading home, clogging the bridge. Because the music was expected to end late on Sunday, many of us temp-collectors worked overtime into the wee hours of Monday morning.

Late into the night we had five lanes open southbound, most of us enjoying some handsome overtime. But traffic was so light, they sent us home by about 1 am. I was due back in the booth five hours later.

Of course, the music didn’t end until early Monday, meaning that the usual morning rush hour carried as many burned-out hippies as it did business commuters. I remember one station wagon that pulled in to my lane, caked in mud up to the windows and stuffed with a dozen zonked-out kids. “Hey man,” said the driver with eyes that struggled to focus. “We don’t have any money” (to pay the 50 cent toll). “How about these instead?” That day, the Tappan Zee toll was an orange and a warm Coke.

Most days life as a toll collector on the Tappan Zee was a delight, as I was usually assigned the outside lane, also known as “the country club” because of its green vistas and views of the mighty Hudson River.

That far outside lane was also the site of experiments pre-dating the EZPass system, and I was a witness to many failed attempts at automating toll collection.

One such experiment involved fastening special permit plates to the underside of trucks, then running them through my toll lane at 30+ mph while an automatic camera mounted in the road snapped pictures of their permits. The system didn’t work.

After being transferred to the New Rochelle toll barrier on the New England Thruway, I learned about the “exact change” lanes. As folks threw their change into the basket, the coins went into a machine with rotating discs and holes the size of nickels, dimes and quarters. As the coins fell though the holes, their value was totaled and the driver could pull away.

What I didn’t know was the people threw more than coins into those baskets.

One day, while inside the booth removing change buckets, I heard a car stop in the lane outside followed by an ominous thump. Not the clinking of change, but a thump.

Imagine my horror as I watched an entire orange work its way down the change chute, hitting the rotating discs like a food processor, spewing orange juice and peel everywhere over the machinery, the buckets of coins and me.

Oh, for those days in “the country club lane” back on the Tappan Zee!

ParaTransit for more than just the disabled

Quick. What’s the most expensive ride in public transit? No, not rush-hour peak service on Metro-North. It’s ParaTransit… the door-to-door service for the disabled.

Transit districts are legally obliged to offer ParaTransit even though it’s extremely expensive and often draws complaints about poor service. Here’s the story.

In the 1980’s when planners from the American Public Transportation Assoc. would gather for meetings, there would be a swarm of demonstrators. Wheelchair activists would block their way, demanding access to mass transit. And why not?

In 1990 the Americans with Disabilities Act law gave them what they wanted… sort of. Buses would have to be equipped with wheelchair lifts. Key Metro-North stations were made “ADA compliant”. Even some subway stations in New York City saw elevators installed.

But some transit systems didn’t want to retrofit to carry the disabled. And even if they did, what about the blind or those who can’t easily get to the bus stop? That’s where ParaTransit came in. The ADA law mandates that door-to-door service must be available anywhere within three-quarters of a mile of a fixed route transit line.

The cost to the transit providers? Upwards of $25 - $30 per ride, with fares covering less than 10% of those expenses. But riders must book a day in advance and often share their ride on the “short bus” with others, hence the complaints. The disabled may be blind or unable to walk, but they’re far from silent.

While many felt they’d become second class citizens in the transit arena, Mayor Ed Koch complained that it would be cheaper to pay for cab fare for the disabled than pay for ParaTransit. And, in fact, that’s what one Connecticut town is doing.

Affluent Darien is already served by “Gallivant”, a door-to-door mini-van for both the disabled and the elderly. Passengers pay a suggested $5 per ride and must book a day in advance.

But in the town of almost 20,000 with 3,200 residents aged 60 or more, the Gallivant service is vastly under-utilized, carrying just 407 one-way riders in the last quarter. That’s only about seven rides a day because of limited hours and just one van.

Administered by the town’s Social Services Department, “Gallivant” is popular with many for rides to the doctors, for shopping or the Senior Center. But for others in town the pre-booking and stigma of riding the “short bus” keeps them house-bound.

So, using a new $15,000 state grant, the town is experimenting with offering half-price taxi vouchers for anyone aged 60 or older. Following a similar program in neighboring Stamford, the Darien plan is simple: just show up at Darien Town Hall, prove you’re a resident over age 60 and buy your half-price taxi vouchers. A book of five $5 vouchers (worth $25) costs $12.50.

When you’re ready to go, call Eveready Taxi (hopes are that other cab companies will join the program) and they’ll pick you up and take you where you want to go. Pay with vouchers and tip with cash.

The initial response to the program has been slow, but those who’ve tried it swear by it, not at it. The cab company gets more business, residents who can’t or shouldn’t drive get mobility. What’s not to like? Well, it seems some folks may be trying to scam the system.

The taxi voucher program is designed to give seniors and the disabled independence and spontaneity. Trips to the doctor, shopping maybe even the movies seem fine… and help local merchants.

But now the program is getting requests for half-price taxi rides to the airports… a $120 one-way trip! It’s one thing to give a senior mobility around town, but it’s a whole different matter to subsidize their summer vacation.

The Social Services Department is considering the request. But I hope people in need don’t get left at the curb when the funds run out because others gamed the system.