Integrating IBM Cognos Analytics with IBM Cloud Pak for AIOps

  The installation and integration of IBM Cognos® Analytics is available only for technology preview, and is not for production usage.

Run the setupCognos.sh command to configure OpenID Connect (OIDC) authentication and single sign-on (SSO) between IBM Cloud Pak for AIOps and IBM Cognos Analytics.

Before you begin

Important: You must have a deployment of IBM Cognos Analytics set up in order to integrate with IBM Cloud Pak for AIOps. For information about IBM Cognos Analytics installations, see the IBM Cognos Analytics documentation.

  • Clone the repository containing the required scripts from github.com: aiops-cognos-analytics. For example:

    git clone git@github.com:IBM/cp4waiops-samples.git

  • If required, install jq where you plan to run this script. To install jq, see Download jq.

  • Obtain a IBM Cognos Analytics API key from an administrator.

    • The IBM Cognos Analytics administrator can get the key from any existing namespace under Profile and Settings > My API keys.

    • The IBM Cognos Analytics administrator must first Renew credentials if My credentials - Manage is disabled.

      My credentials

    • The IBM Cognos Analytics user should have the administration capabilities to Manage Namespaces and Users, Groups, and Roles.

  • From the command-line, authenticate with the IBM Cloud Pak for AIOps cluster as an admin user.

  • Add the IBM Cloud Pak for AIOps cluster CA to IBM Cognos Analytics as documented here. If you're using the default Red Hat OpenShift ingress CA, find it by running the following command:

    kubectl get -n openshift-ingress-operator secrets router-ca -o jsonpath={.data."tls\.crt"} | base64 --decode

  • Restart the IBM Cognos Analytics server.

Procedure

Run the following command:

./setupCognos.sh -u cognos_url [-k cognos_api_key] [-n cognos_namespace] [-g cognos_gateway] [-c aiops_client] [-r]

Where:

-u cognos_url (required) IBM Cognos Analytics server in the form of hostname:port.

-k cognos_api_key (optional) API key of the IBM Cognos Analytics user under which the setup will run. If no API key is specified, anonymous user is used.

-n cognos_namespace (optional) name of the IBM Cognos Analytics namespace that will be created for IBM Cloud Pak for AIOps users. If not specified, the IBM Cloud Pak for AIOps cluster name is used.

-g cognos_gateway (options) path of the IBM Cognos Analytics gateway. If not specified, /bi is used.

-c aiops_client (optional) name of the OIDC client that will be created in IBM Cloud Pak for AIOps. If not specified, the IBM Cloud Pak for AIOps cluster name is used.

-r (optional) remove the IBM Cognos Analytics namespace and OIDC client.

Configuring permissions to see IBM Cognos Analytics navigation entry in IBM Cloud Pak for AIOps

For any roles that require visibility of the IBM Cognos Analytics navigation entries, you can add the required permission through the Access control page. For more information about managing permissions, see Managing user access control and Roles and permissions.

The following permissions are required for such users:

  • Manage dashboards/reports
  • View dashboards

Notes

  • SSO with Red Hat OpenShift is not supported.

  • If the IBM Cloud Pak for AIOps cluster uses self-signed certificates, you must add a browser security exception before using these widgets in IBM Cognos Analytics. Refer to your browser documentation for instructions.

  • IBM Cognos Analytics users cannot modify a namespace that they're using.

  • For SSO to be effective, anonymous access must be disabled after successfully running this script.