C# amo get roles complete

Question

I'm working on a SSAS project in which I, amongst other things, need to get a complete list of users for a tabular cube, in C#. Currently I have it working in such a way that I can get the roles, but the data is incomplete. When I call the Server.Database.Roles (simplified for readability) property and enumerate through it I only get ID, Name and CreatedTimeStamp. What I am missing, which is crucial, is Members, CellPermissions (DAX Filters) and the permissions for those members. The permissions (read/write/administrator) I am currently looking for in Server.Database.Cube but the CubePermissions are empty...

In SSMS when I script one of my testroles the role contains:

<ID>Role</ID>
        <Name>TestRole</Name>
        <Description>role for testing</Description>
        <Members>
            <Member>
                <Name>THORVALDDATA\rj</Name>
                <Sid>OMITTED</Sid>
            </Member>
            <Member>
                <Name>THORVALDDATA\dp</Name>
                <Sid>OMITTED</Sid>
            </Member>
            <Member>
                <Name>THORVALDDATA\jtl</Name>
                <Sid>OMITTED</Sid>
            </Member>
        </Members>

But as said earlier, when I enumerate it in code, I don't get members and description.

Can any of you clever people help me figure out what is going wrong here?

All my code:

        RoleCollection roleCollection = _analysisServer.Databases[dbID].Roles;

        Database database = _analysisServer.Databases[dbID];

        Dictionary<string, CubeRole> roles = new Dictionary<string, CubeRole>();
        foreach (Role role in roleCollection)
        {
            CubeRole cRole = new CubeRole();
            cRole.ID = role.ID;
            cRole.Name = role.Name;

            cRole.Members = role.Members;
            CubeCollection cubeCollection = _analysisServer.Databases[dbID].Cubes;

            foreach (Cube cube in cubeCollection)
            {
                foreach (CubePermission cubePermission in cube.CubePermissions)
                {
                    cRole.Filters = cubePermission.CellPermissions;
                    cRole.Permission.Add(cubePermission);
                }
            }
            roles.Add(cRole.Name, cRole);
        }
        return roles;

Answer 1

With tabular you can have administrators at the server level. And at the database level you have just 3 built-in permissions: 1) Full Control 2) Process Database & 3) Read. Each role you create in a database can have a selection of these permissions. There are no cubes in tabular so you just have the 2 levels, server & database. MSDN is a good starting point for understanding permissions & roles in tabular https://msdn.microsoft.com/en-us/library/hh213165.aspx

You can loop through the roles of a database to pull out the role member in each and the permissions associated with each role:

   //loop through database permissions
   foreach (AMO.DatabasePermission dbp in Analysisdb.DatabasePermissions)
          {
           Console.Write(dbp.Role.Name); //role name
           Console.Write(dbp.Read); // Is read role?
           Console.Write(dbp.Process); // Is process role?
           Console.Write(dbp.Administer); // Is Full control role?
          //loop through database permissions role members
          foreach (AMO.RoleMember rolemember in dbp.Role.Members)
              { 
              Console.Write(rolemember.Name); 
               }
          }

The DAX expressions for each dimension can be pulled out by looping through every dimension for every role. This example below will get the DAX expression for the Currency dimension for the Users role in the codeplex AdventureWorks sample model:

     using (AMO.DimensionPermission dimensionPermission = AnalysisDb.Dimensions.GetByName("Currency").DimensionPermissions[0]);
Console.Write(dimensionPermission.AllowedRowsExpression);

See http://tabularamo2012.codeplex.com/SourceControl/latest#AMO2TabularV2/AMO2Tabular.RlsFunctions.cs for more on tabular AMO.