IBM Support

How do you restrict users based on their License Roles in Cognos Analytics (versions 11.0.0 to 11.0.6)

Question & Answer


Question

The matrix below describes how to specify capabilities and permissions in Cognos Analytics based on the license role entitlements. For Cognos Analytics Version 11.0.7 and above please see the following technote: http://www-01.ibm.com/support/docview.wss?uid=swg21684890 For a Video Tutorial please click on the following link: https://www.youtube.com/watch?v=jfAJYXqdfkI For Cognos Business Intelligence 10 please see the following technote: http://www-01.ibm.com/support/docview.wss?uid=swg21626203

Answer

How to set up capabilities and permissions per group or user based on their license role entitlements in Cognos Analytics 11

IBM Cognos Analytics License Roles are:

• Analytics Administrator
• Analytics Explorer
• Analytics User
• Information Distribution

Roles and Capabilities entitlements per each IBM Cognos Analytics License Roles:

 

License Cognos Role Capability
Analytics Administrator System Administrator,
or
any other Administrator Roles
(Directory Administrators
Library Administrators
Metrics Administrators
Mobile Administrators
Portal Administrators
Report Administrators
Server Administrators )		 All Analytics Explorer capabilities PLUS
Manage (note 5)
Administration Console
IBM Cognos Software Development Kit
Analytics Explorer Consumers + Authors + Mobile Users + Metrics Authors + Modelers All Analytics User Capabilities PLUS
IBM Planning Analytics for Microsoft Excel
IBM Cognos Framework Manager
IBM Cognos Cube Designer/Dynamic Query Analyzer
Transformer
Analytics User Consumers + Authors + Mobile Users + Modelers All Information Distribution capability PLUS
Create new Reports, Dashboards, Stories or Data Modules
Execute Reports and respond to prompts
IBM Cognos for Microsoft Office
IBM Cognos Workspace
IBM Cognos Insight
IBM Cognos Event Studio
IBM Cognos Query Studio
IBM Cognos Analysis Studio
Create Data Server Connections
Upload Files
Information Distribution Readers + Mobile Users (note 1) Receive Burst Report Outputs (inc Active Reports)
View Scheduled Reports
IBM Cognos Portal
IBM Cognos Mobile Applications


Note 1: No license for Cognos Workspace* or the new Dashboard, Upload Files or Data Modelling interface in Cognos Analytics. This capability needs to be removed.(see note 2)

Note 2: In order to comply with licensing regulations it may be required to remove the capability for a studio from a Cognos Role. See detailed steps below (Step G)

Note 3: Usage restrictions are in the Program-unique Terms section of the license. Please refer the license information:

http://www-03.ibm.com/software/sla/sladb.nsf/searchlis/?searchview&searchorder=4&searchmax=0&query=%28IBM+Cognos+Analytics+Administrator%29

Note 4: IBM does not recommend the mixing of charge metrics for end users. In the case where this is required, users accessing components of the system licensed under the PVU charge metric must be licensed. PVUs must be owned for each of the components inclusive of the Cognos Analytics server with DQ. Users accessing servers under the Authorized User charge metric are not limited to the number or size of servers which they can access.

Note 5: Analytics User and higher licenses have access to Manage > Data Server Connections. Also Jobs and datasources in the Administration Console.

Note 6: IBM Cognos Analysis For Microsoft Excel (CAFÉ) was changed to Planning Analytics for Excel to reflect the changes to TM1.

Detailed Steps to limit user access to areas of Cognos Analytics 11:

A. Restrict access to members of the built-in namespace

  1. Open Cognos Configuration and under the ‘Security’ tab, click on ‘Authentication’.
  2. Against ‘Restrict access to members of the built-in namespace?’ set the value to ‘True’. This excludes all others from third party authentication sources who are not explicitly part of a Cognos namespace group or role as defined in Cognos Analytics 11.
  3. Save the configuration and restart the Cognos service.
  4. Log into the Cognos Analytics 11 ‘Welcome’ dashboard as an administrator.

B. Steps to create the ‘Analytics Administrator’ licensed role:

  1. Log on as the Analytics Administrator and go to ‘Manage’ then ‘Accounts’ and select the Cognos Namespace.
  2. Select the ‘System Administrator’ Cognos Role and then select the ‘Members’ tab.
  3. Click the ‘Add Member’ button and select your group or user from your namespace.
  4. Click on the ‘minus’ button next to ‘Everyone’. Click on ‘OK’ to confirm deletion.


NOTE: Before removing the ‘Everyone’ group, make sure that one or more administrators are explicitly Added as a member of the ‘System Administrator’ role of the ‘Cognos’ namespace. Otherwise, once the ‘Everyone’ group is removed, that role will be locked out and no further changes can be made.

C. Steps to remove the ‘Everyone’ group from the built-in Cognos roles:

  1. Log on as the Analytics Administrator and go to ‘Manage’ then ‘Accounts’ and select the Cognos Namespace.
  2. Select the ‘Adaptive Analytics Users’ role and then select the ‘members’ tab.
  3. Click on the ‘minus’ button next to ‘Everyone’ and Click on ‘OK’ to confirm deletion.
  4. Repeat steps 1 -3 for the following roles: Analysis Users, Authors, Cognos Insight Users, Consumers, Controller users, Data Manager Authors, Express Authors, Mobile Users, Metrics Authors, Metric Users, Planning Contributor Users, Powerplay Users, Query Users and Readers.

D. Steps to create the Analytics Explorer licensed role

The ‘Analytics Explorer’ licensed role should be a member of the ‘Authors’, ‘Consumers’, ‘Metrics Authors’, ‘Mobile Users’ & 'Modelers' Cognos roles. (see matrix above)

  1. Log on as the ‘Analytics Administrator’ and go to ‘Manage’ then ‘Accounts’ and select the Cognos Namespace.
  2. Select the ‘Authors’ Cognos Role and then select the ‘Members’ tab.
  3. Click the ‘Add Member’ button and select your group or user from your namespace.
  4. Repeat steps 2-3 to add the user to the ‘Consumers’, ‘Metric Authors’, ‘Mobile users’ & ‘Modelers’ Cognos roles.

E. Steps to create the Analytics User licensed role

The ‘Analytics User’ licensed role should be a member of the ‘Authors’, ‘Consumers’, ‘Mobile Users’ & ‘Modelers’ Cognos roles. (see matrix above)

  1. Log on as the ‘Analytics Administrator’ and go to ‘Manage’ then ‘Accounts’ and select the Cognos Namespace.
  2. Select the ‘Authors’ Cognos Role and then select the ‘Members’ tab.
  3. Click the ‘Add Member’ button and select your group or user from your namespace.
  4. Repeat steps 2-3 to add the user to the ‘Consumers’, ‘Mobile users’ & ‘Modelers’ Cognos roles.

F. Steps to create the Information Distribution licensed role

The ‘Information Distribution’ licensed role should be a member of the ‘Readers’ and ‘Mobile Users’ Cognos roles. (see matrix above) In addition, there is a requirement that the ‘Executive Dashboard’, ‘Web Based Modeling’, ‘Upload Files’ and ‘Dashboard’ capabilities are removed from this role’

  1. Log on as the ‘Analytics Administrator’ and go to ‘Manage’ then ‘Accounts’ and select the Cognos Namespace.
  2. Select the ‘Readers’ Cognos Role and then select the ‘Members’ tab.
  3. Click the ‘Add Member’ button and select your group or user from your namespace.
  4. Repeat steps 2-3 to add the user to the ‘Mobile users’ Cognos role.

G. Steps to modify Capabilities for the Information Distribution role

  1. Log on as the ‘Analytics Administrator’ and go to ‘Manage’ then ‘Administration Console’ then ‘Security’ and choose ‘Capabilities’.
  2. Scroll to the ‘Executive Dashboard’ capability and select ‘set properties.
  3. Go to ‘Permissions’ and click ‘add’.
  4. Navigate to your group or user from your namespace and move it to the ‘selected entries’ Click ‘OK’.
  5. In the ‘permissions’ window place a check next to your group or user and select ‘Deny’ for ‘execute’ and ‘traverse’ and then ‘OK’.
  6. Repeat steps 2-5 for the ‘Web Based Modeling’, ‘Upload Files’ and ‘Dashboard’ capabilities.
  7. Scroll to the 'Generate CSV Output' capability and click Set properties.
  8. Go to 'Permissions' and click 'add.
  9. Navigate to your group or user from your namespace and move it to the ‘selected entries’.
  10. Navigate to 'Cognos namespace' and move the following roles to the 'selected entries' -> Analytics Users, Analytics Explorers, Authors, Modellers, Report Administrators and then click 'OK'.
  11. In the ‘permissions’ window place a check next to your group or user and Analytics Users, Analytics Explorers, Authors, Modellers, Report Administrators select ‘Grant’ for ‘execute’ and ‘traverse’ and then ‘OK’.
  12. In the ‘permissions’ window, place a check next to everyone and click 'remove.
  13. Repeat steps 7 -12 for 'Generate PDF Output ', Generate XLS Output', Generate XML Output', Data sets'.
  14. Scroll to the 'External Repositories ' capability and click set properties.
  15. Go to 'Permissions' window place a check next to everyone and click 'remove'.
  16. Repeat steps 14 -15 for 'Snapshots'.


Additional related information that should be read when considering security and licensing of your IBM Cognos environment:

The matrix above is based on the License Information Documents for IBM Cognos Analytics. They can be found by clicking on the License Role

http://www-03.ibm.com/software/sla/sladb.nsf/searchlis/?searchview&searchorder=4&searchmax=0&query=%28IBM+Cognos+Analytics+Administrator%29

[{"Product":{"code":"SSTSF6","label":"IBM Cognos Analytics"},"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Component":"Administration and Configuration v11x","Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"11.0.6;11.0.5;11.0.4;11.0.3;11.0.2;11.0.1;11.0","Edition":"","Line of Business":{"code":"LOB10","label":"Data and AI"}}]

Document Information

Modified date:
15 April 2019

UID

swg22007870

Page Feedback