Hello, Aneeket:
I think that there might be some confusion between permissions and roles.
Permissions control access to the data such as cubes.
Users need permission to access the cube data in order to view the report. At the following link, you will find a table that explains the metadata permissions that the users need. For maps and cubes, the users need ReadMetadata and Read, as well as ReadMetadata on the report, parent folder, and repository.
http://support.sas.com/documentation/cdl/en/bisecag/63082/HTML/default/viewer.htm#n0bxpw0fyk4srkn1xp0yhc2gvq4g.htm
Roles control access to application features.
Users do not need the ability to open a cube directly in Web Report Studio in order to access data in a cube. To stop them from opening the cubes directly, you put them in a role with Direct Access to Cubes disabled. For example, say that your users are members of the Web Report Studio: Report Viewing role, and this role does not have Direct Access to Cubes enabled. But, then, say that the SASUSERS group is a member of the Web Report Studio Advanced role and that role does have the Direct Access to Cubes enabled. Your users will be able to open cubes directly in Web Report Studio because they are members of the SASUSERS group. To resolve this, you must ensure that the users are not members of any group that is assigned to a role with the Direct Access to Cubes enabled.
To summarize:
To ensure that users have access to the data in the cube, grant them ReadMetadata and Read on the map and the cube, and also grant them ReadMetadata on the report, parent folder, and repository.
To prevent users from seeing the cube 'icons' in folders in Web Report Studio, make sure that they are not members of any role that has the Direct Access to Cubes enabled. This means checking their group memberships because they can inherit the capability from a group such as SASUSERS.
... View more
