Abstract: Methods, systems, and computer-readable storage media for exposing relationships between universe objects. In some implementations, actions include identifying a universe, the universe including objects at an abstracted layer, automatically processing the objects of the abstracted layer to provide one or more link groups, each link group including a plurality of objects that have some relation to one another, and outputting the one or more link groups.

Abstract: Information defining a first business information document, including a report element having a data provider and a variable, is received from a first user's device. The first document is saved in a central management system repository as a shared element, the shared element in the repository including an indication of the data provider and an indication of the variable. A request to access the shared element in the repository is then received from a second user's device. The shared element in the repository, including the indication of the data provider and the indication of the variable, are then incorporated within a second document for the second user. The shared element in the second document may be linked to the shared element in the repository such that a change to the shared element in the repository propagates to the shared element in the second document.

Abstract: The disclosure generally describes computer-implemented methods, software, and systems for creating and using shared queries based on heterogeneous data sources. One example method includes receiving a request to execute a shared query, identifying at least one data source and a query specification associated with the shared query, generating a native query for each identified data source based on the identified query specification, executing the generated native queries at the respective data sources to collect a set of query results from the respective data sources, and formatting the set of query results from the respective data sources into a unified set of query results.

Abstract: Methods, systems, and computer-readable storage media for exposing relationships between universe objects. In some implementations, actions include identifying a universe, the universe including objects at an abstracted layer, automatically processing the objects of the abstracted layer to provide one or more link groups, each link group including a plurality of objects that have some relation to one another, and outputting the one or more link groups.

Abstract: Various embodiments of systems and methods for providing an expression of a resource for access control are described herein. One or more business security profiles associated with a user are received. The business security profile is defined including a resource expression. The resource expression can include a resource expression with a quantifier or the resource expression without a quantifier. Further, a net profile of the user is computed using symbolic calculus on the resource expression of the one or more business security profiles. The net profile of the user includes a set of granted resources and a set of denied resources. Based upon the computed net profile, access to a resource is authorized for the user.

Abstract: The disclosure generally describes computer-implemented methods, software, and systems for creating and using shared queries based on heterogeneous data sources. One example method includes receiving a request to execute a shared query, identifying at least one data source and a query specification associated with the shared query, generating a native query for each identified data source based on the identified query specification, executing the generated native queries at the respective data sources to collect a set of query results from the respective data sources, and formatting the set of query results from the respective data sources into a unified set of query results.

Abstract: Various embodiments of systems and methods for providing an expression of a resource for access control are described herein. One or more business security profiles associated with a user are received. The business security profile is defined including a resource expression. The resource expression can include a resource expression with a quantifier or the resource expression without a quantifier. Further, a net profile of the user is computed using symbolic calculus on the resource expression of the one or more business security profiles. The net profile of the user includes a set of granted resources and a set of denied resources. Based upon the computed net profile, access to a resource is authorized for the user.

Abstract: Aspects may include determination of a first security profile associated with a user and an information space, the information space comprising metadata indicating a plurality of objects mapped to logical entities of a hierarchical data structure, reception of a request from the user for an interface for creating queries to the hierarchical data structure, and determination, based on the first security profile, of a first subset of the plurality of objects based on which the user is allowed to create queries. A query is executed based on one or more of the first subset of objects, data of the hierarchical data structure is received in response to execution of the query, a second subset of the received data which the user is allowed to view is determined based on the first security profile, and the second subset of the received data is presented to the user.

Abstract: Aspects may include determination of a first security profile associated with a user and an information space, the information space comprising metadata indicating a plurality of objects mapped to logical entities of a hierarchical data structure, reception of a request from the user for an interface for creating queries to the hierarchical data structure, and determination, based on the first security profile, of a first subset of the plurality of objects based on which the user is allowed to create queries. A query is executed based on one or more of the first subset of objects, data of the hierarchical data structure is received in response to execution of the query, a second subset of the received data which the user is allowed to view is determined based on the first security profile, and the second subset of the received data is presented to the user.

Abstract: Disclosed is a method and system for computing data security settings in a multi-dimensional system. The method includes receiving a query from a user to access a dataset, retrieving a membership tree of the user and determining a set of minimal branches of the membership tree. A minimal data security setting for the user is determined by computing a sum of products in the set of minimal branches. A data security setting for the user to access the dataset is determined based on the minimal data security setting and finally, the data security setting is embedded in the query to access the dataset.