Managing Capabilities

You permit an bibus » account, bibus » group, or bibus » role to use IBM® Cognos® functionality in specific contexts by granting both global capabilities and object-level capabilities.

The mechanisms and structures used to assign capabilities support fine-grained policy configurations, similar to those of a security policy. For example, to allow an bibus » account, to create reports using IBM Cognos Analytics - Reporting on the Sales bibus » package:

Similarly, you determine the functionality available to an bibus » account, bibus » group, or bibus » role, by querying global capabilities for who has been granted or denied them, and then querying individual objects, such as an instance of the bibus » package, for who has specific capabilities on the object. The effectiveUserCapabilities property returns what the current bibus » account is entitled to do with an object. To simplify individual bibus » account, UI development, effectiveUserCapabilities property includes capabilities inherited from a superior container, such as a bibus » folder, and globally. Administrative UI development requiring the acquisition of multiple bibus » account, bibus » group, or bibus » role capabilities involves querying and matching global and object-level capabilities.

The bibus » package class supports policies that specify the set of capabilities granted to an bibus » account when using a particular bibus » package. The bibus » content and bibus » folder classes also include the userCapabilityPolicies property to simplify capability administration. Capability policies for an object are acquired from a superior object, such as a bibus » folder, unless specified in the object.

The Public Folders predefined object defines default capability policies for a contained bibus » package. The Everyone bibus » group is granted all capabilities that can be specified on an object. By default, the canUseObjectCapabilities capability is not granted to any bibus » role. A member of the Directory Administrators bibus » role must grant the capability to someone before object capabilities can be assigned.