PI71085: SECURITY ON USER DEFINED SQL DOES NOT BEHAVE THE SAME IN CA11 ASIN COGNOS 10.2.1

APAR status

• Closed as fixed if next.

Error description

• DEFECT DETAILS:
  
  The "Run as"  function in CA11 does not behave the same as
  Cognos 10.2.1. In Cognos 10.2.1, A user with denied permission
  on User Defined SQL query can still run the report if the report
  is "Run as" the capability of the Owner, namely a system admin.
  In Cognos CA11, the user with the same security setup will be
  denied with error:  RQP-DEF-0326 User defined SQL is not
  permitted for user...
  
  Please make a verdict on whether this is as designed or a
  defect. Please provide a Cognos facing statement and a work
  around if it is the prior.
  
  TESTCASE DETAILS:
  In CA11, use an system Admin user for the following:
  Create a new report with the sample package gosales.
  In "Queries", drag in a SQL module. Define the SQL with a simple
  query such as "SELECT * from GOSALES.PRODUCT". Remember to
  manually set the data source again in the properties.
  Drag in a list module to Page 1. Insert some data from the query
  you created to the list. Save the report.
  Go to "My reference" of the user (from Cognos Administration) >
  Personal > Renew the credentials, add another user who is a
  member of Author and Directory Admin to the list.
  In Cognos Administration > Security > capability > Report Studio
  > User defined SQL, deny the user mentioned previously on
  execute.
  
  use the user who is a member of Author and Directory Admin:
  navigate to the saved report. Check the properties > report tab
  > advanced > Run > with owner capability
  Run report. It fails with  RQP-DEF-0326 User defined SQL is not
  permitted for user...
  
  Repeat the same process in Cognos 10.2.1 would allow the user to
  execute report successfully.
  The following was also found:
  in CA11, the only valid permission setting on UDS is execution.
  Allowing would allow the user to edit, run update and save the
  report. Denying would deny everything as mentioned.
  In Cognos 10.2.1, the user can still execute report with owner's
  credentials despite being explicitly denied on "execute".
  

Local fix

Problem summary

• ****************************************************************
  * USERS AFFECTED:                                              *
  * All Users                                                    *
  ****************************************************************
  * PROBLEM DESCRIPTION:                                         *
  * See Error Description                                        *
  ****************************************************************
  * RECOMMENDATION:                                              *
  * Upgrade to IBM Cognos Analytic 11.0.5.0                      *
  ****************************************************************
  

Problem conclusion

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

Applicable component levels

• RA21 PSN

     UP