Blog

What's happening? What's new? What can I do? Find answers to these questions in the blog.

Archive Results

Blog

Administration – SSO with LTPA - WebSphere Liberty and #Cognos Analytics

Lightweight Third-Party Authentication (LTPA) with Cognos Analytics embedded Liberty profile With Cognos Analytics Release 7+, you can configure single sign-on with Cognos Analytics using its built-in WebSphere Liberty Profile. WebSphere Liberty Profile supports many different authentication configurations and can be configured to integrate into existing WebSphere environments using Lightweight Third-Party Authentication (LTPA). By doing this the Cognos Analytics environments can have single sign-on with other applications deployed into WebSphere Application Server. For example, you can configure WebSphere Liberty to use an LDAP or Active Directory server for authentication, then configure Cognos Analytics to use the same LDAP or Active Directory and set the identity mapping to use REMOTE_USER. Our documentation is here: https://www.ibm.com/support/knowledgecenter/SSEP7J_11.0.0/com.ibm.swg.ba.cognos.inst_cr_winux.doc/t_configure_ltpa.html#configltpa Cognos Analytics can be configured with, or without, a Cognos gateway.  To help understand the setup more, an brief architectural diagram is available here: Architectural examples of using LTPA to get SSO between Cognos Analytics and applications deployed in WebSphere Application Server

Blog

User Session Logging in Cognos Analytics 11.0.7

Easier administration: New user-specific logging in Cognos Analytics 11.0.7 Logging has always been problematic for administrators because files must be edited and renamed, and then services must be restarted. In Cognos Analytics 11.0.7 we have introduced a new logging framework that requires no application restarts. This framework is administered in the Cognos Analytics 11.0.7 Manage UI. The new “User Session” logging functionality is specific to a user or a session. It is useful when diagnosing a user-specific issue. Please note: User Session logging does not affect any other user on the system. User Session logging must be enabled by a Server Administrator or System Administrator.   To enable User Session logging Go to Manage -> Configuration -> System and then select the “Diagnostic logging” tab. From there you can enable or disable user session logging. This setting applies system wide. Once disabled, User Session logging is not available for any user on the system. When enabled system-wide, the user trying to reproduce the issue can begin a log via their profile in the portal. When the user selects Log my session they are presented with the “User session logging” screen. On this screen, they are given a unique log identifier. This identifier must be given to an administrator with access to the ../logs directory. The log file or files that result from the user’s logging session will have this unique session identifier appended to them. This will happen in the logs directory on each server that has a component that the user’s action uses. For example, if the user is creating logs for an issue that occurs when running a report, then the following logs are created: cognosserver-session-3cdbb1c9-b8b2-471b-b7b1-0fd7163ee458.log dataset-service-session-3cdbb1c9-b8b2-471b-b7b1-0fd7163ee458.log The administrator can use these files to determine specific issues associated with a set of user actions. Once logging is enabled, there are three ways to disable it for a user: 1- Disable logging in the browser session. 2- Close the browser. 3- Wait one hour until the session times out.

Blog

Administration – Changing the behaviour of Object Copying in Cognos Analytics

Retaining target object ID’s when copying objects By default, when you copy objects to a new location, the copied object completely overwrites the existing object, including any links for the object. This behavior ensures that reports reference packages properly. However, you can change the default copying behavior. For example, you can change the copy behavior if you are overwriting reports that do not reference packages, and you want to maintain a job schedule to run the reports.  You can update a configuration so that when you copy objects, the content of the target object is overwritten, but the ID of the target object is retained.  You can then refresh a report by copying a newly authored or modified report and overwriting the target report; the job continues to run the report successfully. To enable 'update' behavior when copying objects overwrites existing objects launch a browser and update the sample URL shown below to the name of any dispatcher in your environment or gateway in your environment: http://dispatchernameOrip:9300/bi/utils/ConfigSetter.html The configuration setting that needs to be updated is: Portal.updateTargetObjectWhenOverwrite Value: true or false Default: false In the Name property enter: Portal.updateTargetObjectWhenOverwrite In the Value property enter: true There is no restart of the system required but they system needs approximately 10 seconds to make the change. Once completed you will be able to copy a report overtop of an existing report, choosing overwrite but the objects Object ID will not be updated. The setting can be changed back to the default setting by setting the value back to “false”.

Blog

Administration – OpenID Connect is available in #Cognos Analytics 11.0.7

OpenID Connect (OIDC) is a simple identity layer on top of the OAuth 2.0 protocol for federated identity and authentication with other applications in your organization that are also configured to use the same OIDC identity provider (IDP).   OIDC support is built into our product and available for both on premise and our Cognos Analytics on Cloud customers.  OIDC is our direction for web-based authentication providers for customers wishing to federate Cognos Analytics 11 with other applications.  OpenID Connect is a modern standard and takes all the best things from SAML, OpenID and Oath2 using lessons learned from these older standards. Most of the tradition SAML 2.0 IDP’s are already releasing new versions with OIDC support in their product.   Check the administrator of your companies IDP or with the IDP sales or support organization. OpenID Connect in Cognos Analytics 11.07 Release 7 introduces support for: Active Directory Federation Service Azure AD Google IBMiD Okta Ping SalesForce We will continue to monitor requests for other OIDC IDP vendors using our Request For Enhancement (RFE) process which can be found at the URL below.  Make sure you search for existing RFE’s before logging a new one and if you are logging a new one, log it against Cognos Analytics. https://www.ibm.com/developerworks/rfe/ Configuration of OpenID Connect Configuration of OIDC is simple and easy to do and requires very little information and configuration. On the content manager node, select the correct OIDC namespace for your vendor.  In the configuration examples below I will be using ADFS but all OIDC IDP’s are very similar in their setup. Once the OIDC provider you are using has been selected you will need to get information from the IDP to complete the configuration. Namespace ID is used in the CAMID Discovery Endpoint, Client Identifier and OpenID Connect client secret can all be obtained from your OpenID Connect administrator Return URL needs to be updated with your gateway or dispatcher URL The last step is to import the OIDC root Certificate Authority certificate from the OIDC’s SSL certificate into the Cognos Analytics keystore using the Third Party Certificate Tool.  To get information on this see our documentation, there is a link to the OIDC documentation at the end of this blog.  Once you have completed all these steps you must do the same configuration on your backup content manager and then restart both content managers. NOTE: if you use a Load Balancer in your environment, then you will update the Return URL with the DNS entry from the Load Balancer so that all requests are handled correctly.  This is regardless of whether the load balancer is in front of many gateway or dispatcher nodes. Example if you are using a webserver with the Cognos Analytics gateway installed on it:  https://MyLoadbalancerDNS.mycompany.com:443/ibmcognos/bi/completeAuth.jsp Example if you are using a set of dispatcher nodes behind the load balancer with no webserver and Cognos Analytics gateway installed: https://MyLoadbalancerDNS.mycompany.com:9300/bi/completeAuth.jsp   Single Signon If your OIDC IDP support Single Signon and two factor authentication, then Cognos Analytics will take advantage of that as this is enforced at that IDP when Cognos Analytics sends the request for authentication.  Cognos Analytics redirects to the OIDC IDP logon page.  Once your user has provided the information required they will be redirected back to Cognos with an authorization code that Cognos Analytics redeems for an ID Token which contains the identity of the user.  If Single Signon is available from your IDP then that happens when the user makes the request and the ID Token is made available to Cognos Analytics and the users is logged in.   What about SAML? If your IDP doesn’t support OIDC but does support SAML 2.0 then you do have the option of using IBMiD.  IBMiD supports OIDC and allows customers to configure Cognos Analytics to IBMiD using OpenID Connect.  Once that configuration is completed then the IBMiD team can help you federate your Cognos Analytics to most SAML 2.0 IDP’s.  When your users log on, they are redirected to the IBMiD page and prompted to type in their email address.  Once the user does this, IBMiD will recognize them and redirect the user to your companies SAML 2.0 IDP logon page where the user can complete the authentication request by providing the required credentials.   Diagnostic Logging If you are having issues after you have the configuration correct, you can use diagnostic logging to help narrow them down.   In this case, you would want to create a new logging topic.  Download the AAA tracing and update it with this: { "loggerDefinitions": [ { "loggerName": "com.ibm.cognos.camaaa.internal.OIDC", "level": "DEBUG", "additivity": true } ], "topicName": "OIDC" } To get information on diagnostic logging see the blog below which is an overview and has a link to diagnostics logging documentation Blog on Diagnostic Logging OpenID Connect Documentation    

Blog

New OLAP samples for IBM #Cognos Analytics 11.0.7

To demonstrate typical OLAP features in IBM Cognos Analytics 11.0.7, we have created a sample dashboard, report, and the underlying OLAP cube. Here are the instructions for installing and viewing these new samples. Related posts: New Base Samples for IBM #Cognos Analytics 11.0.7 Supplementary (Legacy) IBM Cognos Analytics 11 Samples Please visit our IBM Business Analytics Support channel on YouTube.

Blog

New sample Extensions for IBM #Cognos Analytics 11.0.7

There are two new sample Extensions for IBM Cognos Analytics 11.0.7. These sample files are installed with the product in an Easy Installation, and are an option in a Custom Installation. After product installation, you can find them here: <cognos_analytics_installation_location>/samples/extensions/ SampleLoginMultiple.zip A custom Sign In page where the user can choose between two or more authentication types via a dropdown. Please visit this Blog Post for more information. SampleExtensionCustomMedia.zip An extension that adds seven custom images to the Image Library tab in the Widgets panel in Dashboarding and Stories. Only JPG and PNG files are supported at this time. Please note: Themes and Extensions are an incremental feature that changes with each product release. The samples included with each release have been verified with that release only, and may not support backward or forward compatibility. Related posts: New Base Samples for IBM #Cognos Analytics 11.0.7 Cognos Analytics Customization: Sign In Pages (11.0.6+) Video: How to create Themes and Extensions (11.0.4+) Customization samples (themes and extensions) in 11.0.4 Customizing IBM Cognos Analytics (11.0.4) IBM Knowledge Center: Customizing Cognos Analytics Please visit our IBM Business Analytics Support channel on YouTube.

Blog

How to use Logging in #Cognos Analytics 11.0.7

Cognos Analytics 11.0.7 provides new types of ‘Logging’ Diagnostic logging User session logging The purpose of this logging feature is to help diagnosing complex problems by collecting related logs from easily accessible web-based menu Log files change Here is quick overview on some of the main log files. Log file Changes Description cogaudit.log New Renamed from previous ‘cogserver.log’. Contains the audit information cognosserver.log New Log messages from dispatcher (cognosserver liberty server) dataset-service.log New Log messages from dataset service (dataset-service liberty server) p2pd_messages.log unchanged Log standard error and output from cognosserver dq_messages.log unchanged Log standard error and output from dataset-service pogo_<date>.log replaced Log data are now written into one of new files *session_<id>.log New Generated when enabling session logging. Log either session_<id>_cognosserver or session_<id>_dataset-service How to enable Diagnostic logging Cognos Administrator can use diagnostic logging in order to troubleshoot issues such as intermittent and service-specific related problems in Cognos Analytics environment. Before enabling diagnostic logging, Cognos Administrator can review and update size limit and maximum number of files to keep Go to Manage > Configuration > System, select ‘Diagnostic logging’ tab Size limit for server log file (default: 200 MB) Maximum number of backup server log files (default: 10) Cognos Administrators can either use built-in topics or custom topics. Below step is showing how to use one of built-in topics. Go to Manage > Configuration > Diagnostic logging By default, six default built-in topics are displayed as shown below Selecting any of these topics will display its short description on ‘Active topic’ (For example, select MOSER and it displays Modeling service) To see more available built-in topics, select ‘Show all’ and select desired topic. Note that only one topic can be enabled. Click Apply (No need to restart Cognos Analytics service) Look for either of following in the logs directory cognosserver.log dataset-service.log To reset, either click ‘Reset’ or select built-in topic ‘DEFAULT LOGGING’ and click ‘Apply’   How to enable Session logging Session logging can be used when a user can reproduce the problem but do not want to impact the system by enabling logging on all servers. It is also useful when it is not clear on what components or services to enable logging for troubleshooting purpose. Session logging is allowing a user to trace their session activity through the application on Cognos Analytics server and log to a unique separate session logs. Before enabling session logging, a user can check with Cognos Admin whether session logging is enabled or not. Cognos Admin can also review and update size limit for log files and max number of files to keep. Go to Manage > Configuration > System, select ‘Diagnostic logging’ tab Enable user session logging (default: On) Size limit for user session log files (per user, default: 25 MB) Maximum number of backup log files (per use session, default: 10) Once confirmed, a user can enable session logging with the following step Personal setting > Log my session   Turn On Session Logging Take a note on generated unique Log identifier Reproduce the problem (for example, run a report with the issue) Look for session logs which are stored in the logs directory Cognos Admin need to collect the user session logs Session logging can be disabled by setting it off from Personal setting or closing the browser session. By default, session logging is disabled after one hour Considerations Review product documentation for Cognos Analytics 11.0.7 about this new feature https://www.ibm.com/support/knowledgecenter/SSEP7J_11.0.0/com.ibm.swg.ba.cognos.ag_manage.doc/c_ca_config_logging.html For session logging, all logging are dynamically changed to DEBUG level for one specific user only For diagnostic logging, custom topic can be built by creating own JSON from referencing built-in topics using download option. It is recommended to consult with IBM Support on using custom topics as combining more than one component or modifying logging level can negatively impact system performance dataset-service*.log will not be generated for Classic Query Mode reports (CQM) When using package based reports (Dynamic Query Mode) on distributed Cognos Analytics environment with more than 2 report servers, report requests are following round-robin fashion by default so dataset-service*.log will be generated on the application tier which processed executing the reports

Blog

How to connect #Cognos Analytics to DashDB on IBM Cloud

The purpose of this blog is to demonstrate the capabilities of connecting an on premise instance of  Cognos Analytics to  a cloud-based database service instance hosted on IBM Cloud. This is a great environment for testing purposes and provides insight into Cognos Analytics full capabilities against IBM DB2 Warehouse on Cloud for Analytics. The following are the actual steps taken to get this working using your free IBM Cloud account. To setup a free account go to https://console.eu-gb.bluemix.net and sign up. Environment: Cognos Analytics Server 11 Video: Steps: Create a Test DashDB instance: Create a IBM Cloud account and log in, then select "Services" and click on "Db2 Warehouse". 2. Then give the Service a unique name and click on the "Create" button. 3. Once the service has been created the following page will be displayed: Create the credentials: 4. Next, click the service that has been created and  click on “Service credentials” then “New credential”. 5. Next, give the credential label a name and click “Add”. 6. This will generate a json document with all the connection and signon details. You can see entries for an SSL connection string  "ssljdbcurl" and a non SSL connection string  "jdbcurl" as well as Port and password information. Download and Install the JDBC driver: 7. The next stage is to download/install the drivers. From the console click on “Manage” and then click on “Open”. 8. Click on the “Download” section and download the drivers based on the OS platform. 9. In this case, since CA 11  is on Windows 2016, download the “Driver Package for Windows 64-bit” and install on the CA 11 Server. The next section is specific to setting up the CA 11  Datasource Connection to IBM DB2 Warehouse on Cloud From the Driver Package installation locate the JDBC Driver (<installation>\IBM DATA SERVER DRIVER\java\db2jdbc4.jar) Copy this over to the CA 11 R6 /drivers directory (<installation>\ibm\cognos\analytics\drivers) Restart the Cognos Analytics service. Creating the Dynamic Datasource using the JDBC Driver Information In Cognos Analytics: 10. Login to Cognos Analytics and select “Manage” – “Administration Console” – “Configuration” – “Datasources”. 11. Create a new JDBC Type Datasource Connection. 12. With regards to the signon, use the credentials as generated in the JSON document above. 13. Test the connection, then go to the properties of the datasource and enable the “Allow web-based modeling” option so it’s visible in CA11. 14. You can now create a new Framework Manager Model, import the datasource and the table(s) and publish a package.   Please visit the IBM Cognos Analytics channel on YouTube.  

Blog

VIDEO: How to upgrade your version of #Cognos Analytics

New to Cognos Analytics 11 is the ability to install a new version of IBM Cognos Analytics over the top of your current version of the product. This installs a higher version without overwriting existing Cognos maintained configuration files from the previous installation. The new and improved upgrade procedure allows customers to take advantage of the Cognos Analytics continuous delivery model and deploy new features quickly and easily. Video   In the video we will show you: How to backup your environment and preserve any customized files. How to perform the upgrade for both the server and client tools. How to verify that the upgrade worked successfully. Environment: Cognos Analytics 11.0.6 Please visit the IBM Cognos Analytics channel on YouTube.

Blog

IBM #Cognos Analytics Customization: Sign In Pages (11.0.6+)

The sample files SampleLogin.zip and SampleLoginMultiple.zip are examples of views that replace the product’s default sign in page with an alternate customized version. Downloads: SampleLogin.zip SampleLoginMultiple.zip SampleLogin.zip is coded to a single authentication type: SampleLoginMultiple.zip is coded so that the user can choose between two or more authentication types via a dropdown: Caution: These are samples with authentication placeholders. Do not set these samples as your default Sign In Page until you have configured them to match your installation’s authentication type (you won’t be able to log in!). Here are some easy instructions on how to do this: How to Configure the Authentication in SampleLogin.zip and SampleLoginMultiple.zip (11.0.6+) Icons in the Sample If you unzip the file called SampleLoginMultiple.zip and look in the folder SampleLoginMultiple\login\images\, you will find the images that we use in the sample: namespace.svg username.svg password.svg The images are specified in the file called SampleLoginView.html, which is located in the folder SampleLoginMultiple\login\js\views\. If you change the image filenames by adding your own images, you will need to update this file to point to the new images. The images can be SVG, PNG, JPG, or GIF, and they are 24px by 24px. Here is a video overview on creating, using, and uploading extensions: How to create Themes and Extensions in Cognos Analytics The syntax for the declarative JSON in the sample extensions can be found here. This document shows you how to determine the ID of a user interface object. The set of available pre-built action controllers, as well as instructions for creating custom action controllers, are documented here. Extension and Perspective Names An extension is a container. A perspective declaratively defines a new UI screen/capability in the Cognos user interface. There could be multiple perspectives defined in a single extension. Consequently, our best practice is to ensure that the perspectives have names that are different from the extension’s name: Additionally, our best practice when naming an extension is to use an underscore to separate multiple words. When naming a perspective, do not include any spaces, and capitalize each word after the first word. Positioning and Weights Many of the sample extensions allow you to place objects in specific locations. For example, if you extract SampleExtensionButtonWebsite.zip and open spec.json in a text editor, you will see: The line "containerId": "com.ibm.bi.glass.navbarTrailingGroup", specifies the area of the product to display the extension: This document shows you how to determine the ID of a user interface object. The line "weight": 100, specifies the position of the object within the container. The higher the number, the earlier it appears in the container. For example, here are some of the weights for core objects in the product: Please note: Themes and Extensions are an incremental feature that changes with each product release. The samples included with each release have been verified with that release only, and may not support backward or forward compatibility. Related posts: Customization Samples Video: How to Create Themes and Extensions Customizing IBM Cognos Analytics 11.0.4 IBM Knowledge Center: Customizing Cognos Analytics Please visit our IBM Business Analytics Support channel on YouTube.