dimension security doesn't work when you use {}

I think this is a bug, but I want to check that I've understood the expected behavior before reporting it.

1. Build a Geography dimension where the key attribute is City. Also add a State attribute.

2. Define dimension security for the Geography.City attribute and make the allowed set {Geography.City.Dallas}

3. When I run an MDX query with Geography.City.Members it returns only Dallas as expected

4. When I run an MDX query with Geography.State.Members it returns only Texas as expected.

5. Change the allowed set for Geography.City to be {} (that is, empty set)

6. When I run an MDX query with Geography.City.Members is returns empty set as expected

7. When I run an MDX query with Geography.State.Members is returns ALL STATES!! Is this a bug?

The real scenario behind this is dynamic security. If the allowed set MDX expression returns empty set, then I get the behavior described in step 7 for all the non-key attributes in that dimension. The only way I've been able to workaround this is to change the expression to return some bogus member like [Geography].[City].&[DOES NOT EXIST] instead of empty set. (Or I can make the allowed set on all attributes {})

I beleive that what you observe is the designed behavior of the system. I don't beleive that you will be able to use [Geography].[City].&[DOES NOT EXIST] instead of empty set, since inside dimension security MdxMissingMemberMode is always set to Error, so you will get error instead. I beleive that your scenario with dynamic security will work fine though, as long as expressions for allowed set preserve hierarchility properly, even if they result in empty set.|||

I want to use empty set. However I do not get the desired results (allowing this user to see no members of a dimension) when I use empty set.

However, when I use [Geography].[City].&[DOES NOT EXIST] then I DO get the desired results. I can't explain why it works, but it does.