I have quite an interesting request from our customer. We have a dashboard around physicians data with dimensions like physician, practice name, office name etc. They ask to implement security model as:
1) all physicians and her/his staff will see ALL data, even for other physicians
2) BUT they would not see real names of other physicians / practices / offices so they will be obfuscated.
3) corporate management will have access to all data and they will see all real names
That way a physician (or her staff) can compare data with peers but won't see their real names.
E.g.
I am physician Dr. Smith. When I open dashboard, I see data in listboxes and charts like that:
Physician Collections
Dr. Smith $10,000
Provider 1 $8,000
Provider 2 $12,000
I am an office manager working for both Dr. Smith and Dr. Moore. When I open a dashboard, I see data in listboxes and charts like that:
Physician Collections
Dr. Smith $10,000
Dr. Moore $8,000
Provider 2 $12,000
I don't believe Section access can be used here so I was thinking about mapping windows IDs to physician dimension (and this mapping can be stored in Excel file) and then they open a document, kick off a trigger to select and lock specific physicians - I tried this and it works pretty well.
The part I am still trying to figure out is what is the best way to mask data like that - my plan is to
1) have fields with real names and obfuscated names (e.g. Physician Name and Physician Name Masked). The masked one will be created using Autonumber function like 'Physician ' & Autonumber ([Physician Name])
2) use calculated dimensions everywhere in listboxes, charts etc. and put a condition to check if user is allowed to see data for a physician and then show real name or show masked one.
Is there a better way of doing this? I really hate to use calculated dims everywhere
so i accepted Sinan's answer. And he has a cooler avatar as well