Setting Up an MDX Service Account and OLAP Connection - Teradata Schema Workbench

Teradata Schema Workbench User Guide

Product
Teradata Schema Workbench
Release Number
16.20
16.10
15.10
Published
June 2015
Language
English (United States)
Last Update
2018-05-25
dita:mapPath
gvf1512702977003.ditamap
dita:ditavalPath
Audience_PDF_include.ditaval
dita:id
B035-4106
Product Category
Teradata Tools and Utilities
The MDX Service Account is an account that is needed to implement security. It is an account that is created within the Teradata Database server and must have the TBI_SERVICE role. For information on roles, see Mandatory Security Roles. Every Teradata BI Model Repository-enabled Teradata Database must have an MDX Service Account with the TBI_SERVICE role assigned.
  • This account is set up in the database by the Workbench Toolbox or the repository installation scripts.
  • The username and password are additionally specified in the Service Account Settings of Teradata Schema Workbench as described below, which securely stores them in the Teradata BI Model Repository.
  • Teradata OLAP Connector accesses this information to satisfy OLAP queries emitted by BI client applications.

A user connection from the BI client application to the repository takes place in phases. The following explains the connection process:

  1. Initially, when the BI client user connects to Teradata OLAP Connector using their Teradata user ID and password, the connection temporarily uses the user’s TBI_USER role to obtain the encrypted MDX Service Account credentials from the Teradata BI Model Repository.
  2. The initial connection is discarded. However, the user’s initial credentials are saved throughout the lifetime of the session for role mapping purposes.
  3. Teradata OLAP Connector creates a new connection using the MDX Service Account with the TBI_SERVICE role assigned.
  4. Teradata OLAP Connector invokes stored procedures which build restricted dimensional views for the session based on the user’s other roles.
  5. Any queries sent by the BI client application are executed against these views.

Teradata OLAP Connector restricts access to cube schemas and their elements by using cube security and existing roles defined by the cube administrator using Teradata Schema Workbench. For information on how roles are used to implement cube security, see Security Settings