I think you missed one more thing,
IDT -> Business Layer -> Parameters -> AUTO_UPDATE_QUERY to YES
Ref: xi4sp6_info_design_tool_en.pd Page: 225
A user who is denied an object by a Display Data setting might refresh a report containing the denied object. You can specify what the refresh should do in this case by setting the SQL generation parameter AUTO_UPDATE_QUERY in the business layer.
- If this parameter is set to No, then refreshing the report generates an error message.
- If this parameter is set to Yes, then the denied objects are removed from the query and from any filters defined in the business layer. Data for other granted objects is retrieved and displayed to the user in a partial report.