PK90305: NAMES WITH SPECIAL CHARACTERS IN AD NOT ABLE TO ASSIGN PERMISSIONS IN USER GROUP

APAR status

• Closed as unreproducible.

Error description

• Issue Description:-
  ------------------------
  User has configured our Cognos Production Environment (AIX
  server) with Active Directory (LDAP on Windows Server). They
  have created User Groups in Cognos Connection --> Security and
  added users to these groups. Further, they have created an
  IndexPage (Report with list of Reports) and attached it to
  default   profile, so that whenever a new user logs in, he/she
  will get   the Index Page rather than Public Folders. Also, they
  have set  the security at report level as well.
  
   Initially when they didn't have user groups, at that
  time,    couple of profiles for the users got created in
  Cognos  Connection. Hence after creating User groups,
  they deleted thoseprofiles, and then added the users to User
  Group. Total around  170 users we added across 3 groups. Out of
  which 169 users has  got no issue, but one user is not able to
  see the Index Page andgets the message that "You may not have
  sufficient privileges tosee the page".
  
  
         Troubleshooting:-
        -----------------------
       We checked everything, deleted the profile
  for that user and    recreated it. We also tried giving System
  Admin level access to this user. But still it is showing the
  same error.
     PFA the screenshot for Permission on
  User who is facing the    issue for Login.
  
      In Shubha's permission properties (user
  having issue), we found no user or group are having any
  permission, where as normal useris having his name and Directory
  Administrator group have full  permissions. Further we could not
  find the way to overwrite     those permission in Shubha's
  login.       Customer checked with Active
  Directory Team, and understood thatthe difference between these
  two user's properties is just the  groups to which they are
  having permissions.
            They are not using any
  groups from Active directory, rather theyhave created groups in
  Cognos, and given the permission to thosegroups at Index Page
  level
  
        Permissions:-
       ---------------
             As shown in the screen
  shot, they have a Main Index Page  (Multidashboard) which
  shows the another folder, where they havedifferent reports and
  index pages.
        They have Four Major
  Groups (CEO, Strategic, Tactical and    Operational). CEO,
  Strategic & Tactical Users can have access toStandard Report and
  Analysis Views. Operational Users can have  access only to
  Standard Reports. Cognos_Audit group and  Reconciliation
  Group are having access to Audit Page and Data  Extraction Page
  Respectively. IBM User group is a test user group that we
  created.
         RootCause:-
        ----------------
              The issue was
  Active Directory, where the user login was listed under nested
  folders and folder names were having special    characters (
  like ', & etc.). When we removed those characters, everything
  started working fine.
            In Active
  Directory the users are listed under nested folders   and the
  folder names are having special characters (like
  apostophy (') or ampersand (&) etc.). Apart from that, couple
  ofusers are also having special characters in their display
  name, like D'souza. For such users, Cognos is not able to
  identify thepermission and in the permission tab (see
  screenshot) nothing islisted (directory administrator group and
  individual user).
         When we found out the solution (renaming of
  folders in AD),     after recreating the profiles of the users,
  we found that by    default it adds Directory administrator and
  that particular userwith full permission.
  
      In this case changing the display names of
  users may not be     possible. For such users customers have got
  some issues.
       Testing:-
      ----------
  
    Checked with a ldap browser and did ldap search
  using the name with special char as the filter. LDAP search can
  handle it but  not IBM Cognos 8.
  
        Request you to check this issue and fix this ASAP
  

Local fix

Problem summary

• ****************************************************************
  * USERS AFFECTED:                                              *
  * All users                                                    *
  ****************************************************************
  * PROBLEM DESCRIPTION:                                         *
  * 2LS unable to replicate the issue                            *
  ****************************************************************
  * RECOMMENDATION:                                              *
  ****************************************************************
  

Problem conclusion

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

Applicable component levels

• R840 PSY

     UP