Pyramid connects to Analysis Services SSAS (both multidimensional / OLAP and tabular) using a special Pyramid service: "Windows Connector". This service makes use of the OLE DB drivers unique to MS SSAS. There is a slightly different use of the same drivers for Azure Tabular (which should be flagged as such in the data card).
Connecting to SSAS
When connecting to SSAS, Pyramid uses the "effective user" method - which offers the same security mechanisms as normal connections without the complexity of Kerberos configuration. This mechanism, supported by many of Microsoft's own technologies, requires a few elements:
- The SSAS instance and the server hosting the Pyramid Windows Connector must be on an Active Directory domain.
- A domain account needs to be added to the data card when setting up the data source, as described here. This account must have administrative rights on the SSAS service itself. The account does NOT need to be a domain admin in Active Directory or have general administrative rights on the host machine, hosting SSAS.
- Instead of setting up an account for each server, admins can configure the global account instead.
- For each user in the system, their user name credentials need to be given read access to the underlying cube and server. The setup here depends on the authentication provider chosen.
- If using Active Directory authentication, the user's inherent username (with domain) should be operable directly.
- If using SAML or internal database authentication, the user's PROXY account setting should be set with a domain account name that can be operable.
- In the event that embedded reporting is used, and the login to Pyramid is being done programmatically through APIs, the API authentication method can have the "Custom Data" property instead. This in turn can be used as the field to drive the authentication through to SSAS. Again, it should be populated with a domain account.
Ignoring Cube Security
A different option is to ignore user-level security on a cube altogether. Using this option still requires an admin account to connect to SSAS, but the details per user will be ignored.
Azure Tabular Services Connectors
Before connecting to an Azure SSAS Tabular server, you may need to manually install the latest client libraries on all "Windows Connector" machines.
You can download the latest libraries here.
Connection Type
Choose the connection type that's been configured for your SSAS server. The Azure connection type appears for tabular connections only.
Multi Pass Authentication
If authentication via impersonation (Windows Authentication/ Kerberos) fails, Multi Pass Authentication can be used to cascade through multiple authentication options, such as username/ password. The authentication options that Pyramid will try via Multi Pass Authentication will depend on the set up of your server.
The final authentication option that Pyramid will try is the account machine; Pyramid will only try to connect in this way if 'Account Machine Fallback' is enabled.