Using DataSources in PerformancePoint 2010 you have multiple options for the Authentication:
- Unattended Service Account (does not use application pool identify)
- Unattended Service Account and Add Authenticated User Name in Connection String
- Per-user identity
The difference between first two items is quite significant for OLAP data source, regardless these items looks similar.
"Unattended Service Account and Add Authenticated User Name in Connecting String setting" allows to retrieve the name of the connected user using the CustomData() MDX function. This allows you to do a look up against a value in the cube and dynamically return a cell set. This is often called dynamic OLAP security, which can be useful if it is difficult to align security roles with Active Directory groups.