You can use your favorite social network to register or link an existing account:
Or use your email address to register without a social network:
Sign in with these social networks:
Or enter your username and password
Forgot your password?
Yes, please link my existing account with for quick, secure access.
No, I would like to create a new account with my profile information.
Today's author: Steve Tullis, a program manager who works on the Excel Services team.
I've received a number of questions over the past months from customers wanting to deploy Excel Spreadsheets to SharePoint, such that when a user opens the page, s/he sees Excel Services content specific to either that individual or to a group to which s/he is a member. Our recommended solution is to put your data in a data store (e.g. Analysis Services), and implement the solution described in this MSDN article. This solution leverages both the data source's capabilities (including security) as well as the power of Excel Services to present and interact with that data.
There are customer situations where the recommended solution does not work – such as lack of access to a back end data source, lack of ability to configure data connections, inability to add accounts to the SharePoint SSO DB, etc. – or is viewed as 'overkill' – specifically, when the different views are created for user convenience vs. security reasons. The intent of this blog posting is to provide examples of 'personalizing' data via Excel Services when view security is NOT critical and our recommended best practice cannot be implemented. Two main approaches are described in this posting:
For all examples, the following is used:
The current user filter, which ships as a standard SharePoint web part, recognizes the user who requested the web page, and passes that user's name to one or more web parts on the same web page. I will describe two possible solutions using this filter:
This is the simplest solution; it consists of a SharePoint page with a Current User filter which passes the current user to the Excel Web Access (EWA) web part; which, in turn, displays a named object specific to the identified user.
This solution is a two step process:
Once you have completed these steps, your page is ready to be used, and will look like the following (remember to select the 'Exit Edit Mode' option in the top right corner of the page). The Displayed named object will be the object which exactly matches the name of the logged on user.
In this case, I am logged on as 'Steve Tullis' – thus have the manager view of sales data. Changing my user to 'Fiona', I see the Named Item == 'Fiona' which is a view of only Fiona's sales information.
There are obvious advantages and disadvantages to this approach:
The basic concept is to extend the above solution by leveraging list item-level security. When the user selects the page, the current user filter provides the user's name to a list item web part, which then displays the named objects to which the user has access. The user selects the desired named object, which is then displayed in the EWA. Visually, the flow looks like:
While this solution is more complex on the SharePoint side, it simplifies the Excel workbook, is more secure, and allows the flexibility for users to see one or more of the published named objects.
Steps to set this up:
Once you have completed these steps, your page is ready to be used, and will look like the following (remember to select the 'Exit Edit Mode' option in the top right corner of the page).
In this solution, the named objects available to the current user show up as selections in the List View web part. When the user selects the desired named object, it will appear in the EWA. The below screenshot shows that Redmond\stullis has two available named objects, and has selected to view the 'SalesByStore' object.
As with the previous solution, there are advantages and disadvantages to this solution:
The final solution addressed in this blog entry is leveraging SharePoint's Audience Targeting feature. The concept behind this solution is to create a page which contains a web part for each named object to group relationship; and display the web part based on the requesting user's group membership. The flow looks like:
As a pre-requisite to this section, I am assuming the reader is familiar with the MOSS 2007 audience targeting feature set. If not, I suggest reading the following articles:
Even if you are familiar with Audience Targeting, it is important to remember that Audience Targeting is a way to filter content by allowing a page or site author to scope viewable content based on who is visiting the page. If a user is not a member of an audience to which a web part is scoped, that web part is not displayed on the page.
Steps to set this up this solution:
Once you have completed these steps, your page is ready to be used. When a user requests the page s/he will see only the web part for which s/he is a member of the targeted audience.
As with the previous solutions, there are associated advantages and disadvantages:
As I stated in the introduction, our recommended solution is described in this MSDN article, and should be used whenever possible. This post provides two alternate approaches for providing personalization in cases where the user(s) have the right to see everything in the Excel workbook. In other words, the above solutions provide a UI optimization, each of which has advantages and disadvantages which should be evaluated carefully prior to implementation in an organization.
As always, we in the product group are very interested in customer commentary about their use of Excel Services. Any feedback you have on the above solutions would be welcome; or, if you've solved this need in another way, I would be very interested in hearing about your solution.
Comments: (5) Collapse
A pingback and this response. Does that count as feedback?
How about this: add features to Excel (note the lack of the word Services following Excel).
Thanks for the post. I've found that the CurrentUser filter is a great way to control who has access to what parts of a shared workbook that I've published.
One question, how might one avoid having to add to the list every single user who has access to the page? With the solution proposed, if someone is not specifically added to the list of current users, then an error will appear when they load the page. Is there any entry to the list that would appear for all authenticated users that could be used as a default view?
I am setting up a site for a public page, where everyone should see a summary of the data, but only certain people should see more detailed views of it. How can I make the summary named range be available to all users who visit the page?
thanks,
Andy
Andy -
First, I'd like to better understand your scenario - it sounds like you are looking for a 2-level solution: (1) hide / display content based on audience; (2) change displayed content based on individual user.
If this is correct, you could use a combination of the examples above. Create three web parts:
Web part #1 = summary data
Web part #2 & 3 = list view & user specific content
Use audience targeting to have web part #1 appear for people who should only see summary data. Have web parts 2 & 3 appear for people who are in the list (you will have to create an audience containing these people).
If I understand your scenario, this should provide the flexibility you are looking for.
The "refresh data when opening the file" connection property does not work in Excel Service as I understand it. First time i open the workbook, it warns me about potential security issue. i click on Yes button. It gives me the Data Refresh Failed error since i don't have access to the AS2005 cube. then i click on the OK button, it proceeds to show the default view of worksheet.
I would like to prevent showing the default view of the pivotal table report if the users do not have access to the data. Do you have suggestion how to implement this?
thanks
Hank
Hank - Great question!
Yes, it is possible, depending on what you want. There are three ways to do it:
1. (most secure, recommended approach) – give the user view only permissions. Make sure the trusted location (TL) setting is set to "Abort Workbook Open on Refresh Failure". If the refresh on open fails, the workbook open fails then. But again, this is only respected and secure if the user has view only rights.
2. (not secure, but maybe enough for people who are just trying to ‘guide’ users to the right part of the workbook). Only applies in named item view mode. Create another named object, just a blank named range. Specify, in your web part that this is what is shown as the named item by default (i.e. default value for filter or web part, or both). Note a clever implementation here will be a named range with some big letter, bold, text saying something like, “select an item to see from the drop down.” So it almost seems like it is part of the experience. Now, when a user visits the page, they aren’t seeing data (cached or otherwise) first.
3. Collapse pivottable down, filter results down, so almost nothing is shown. Then, if the refresh fails, when the user tries to expand the filter, they won’t be able to.
Steve Tullis
Comments: (loading) Collapse