Access permissions and capabilities for dynamic cubes

Use the IBM® Cognos® groups, roles, and capabilities to define access permissions that are required for modeling, configuring, managing, and optimizing dynamic cubes.

User permissions and capabilities can differ from one environment to another. For example, in a development environment, a user might be granted the capabilities to assign cubes to a dispatcher and to start the cubes. In a production environment, the same user might not be granted access to publish a cube to the content store.

The user roles from previous versions of IBM Cognos Dynamic Cubes were renamed so that they are more consistent with the predefined role names in the Cognos namespace in IBM Cognos Analytics. The following table shows the mapping between the new and old role names.

Table 1. New and old role names
New role name	Old role name
Dynamic Cubes Modelers	Model cubes
Dynamic Cubes Security Administrators	Secure cubes
Dynamic Cubes Configuration Administrators	Configure cubes
Dynamic Cubes Managers	Manage cubes
Dynamic Cubes Optimizers	Optimize cubes
Dynamic Cubes Administrators	No equivalent role
No equivalent role	Prime cubes

The following table describes the user roles that are associated with managing dynamic cubes and the typical tasks that these roles perform. Administrators must ensure that these roles are created in the Cognos namespace in IBM Cognos Administration.

Table 2. Roles and tasks associated with managing dynamic cubes
Role	Tasks
Dynamic Cubes Modelers	Model and publish cubes, assign cubes to dispatchers, and start cubes. If needed, this role can be further broken down to limit the capabilities of individual users (as outlined in Table 3).
Dynamic Cubes Security Administrators	Assign users, groups, or roles to dynamic cubes security views.
Dynamic Cubes Configuration Administrators	Assign cubes to server groups and dispatchers, and configure the query service and individual cubes.
Dynamic Cubes Managers	Perform interactive administrative tasks on cubes, and create and schedule query service administrative tasks.
Dynamic Cubes Optimizers	Save in-memory aggregate recommendations from Aggregate Advisor to the content store. To perform other Aggregate Advisor tasks, an administrator only needs access to IBM Cognos Dynamic Query Analyzer and an account in IBM Cognos Analytics.
Dynamic Cubes Administrators	Perform all of the operations described in this table. This role is assigned to all the roles described in Table 3 or Table 4).

Each role requires an associated IBM Cognos Analytics capability to perform specific tasks on dynamic cubes. To grant access to a capability, you must grant the correct permissions for it to the appropriate roles. For example, dynamic cube modelers who create models need execute and traverse permissions for the Import relational metadata capability.

The following table lists the roles and the capabilities that these roles require for managing dynamic cubes.

Table 3. Roles and their capabilities
Role	Capability	Required access permissions
Dynamic Cube Modelers (creating new models)	Import relational metadata	Execute, Traverse
Dynamic Cube Modelers (starting cubes)	Administration Administration > Configure and manage the system	Execute, Traverse
Dynamic Cube Modelers (generating cubes or dimensions with data samples)	Specification Execution	Execute, Traverse
Dynamic Cubes Security Administrators	Administration Administration > Data Source Connections	Execute, Traverse
Dynamic Cubes Configuration Administrators	Administration Administration > Administration tasks Administration > Configure and manage the system Administration > Data Source Connections	Execute, Traverse
Dynamic Cubes Managers	Administration Administration > Administration tasks Administration > Configure and manage the system Administration > Query Service Administration Administration > Run activities and schedules Scheduling Cognos Viewer Cognos Viewer > Run With Options	Execute, Traverse
Dynamic Cubes Optimizers (saving in-memory recommendations)	Administration > Configure and manage the system	Execute, Traverse

Tip: Capabilities are also referred to as secured functions and features. This distinction is helpful when dealing with two-level capabilities, such as the Administration capabilities. In this case, capabilities such as Configure and manage the system, Data Source Connections, or Query Service Administration are secured features of the Administration capability, which itself is a secured function. For more information about the IBM Cognos Analytics capabilities, see the security sections in the IBM Cognos Analytics Administration and Security Guide.

In addition to capabilities, dynamic cube administrators need the correct combination of access permissions for the content store objects. The following table specifies the objects and the permissions required for specific roles.

Table 4. Content store objects permissions for roles
Role	Content store object	Required access permissions
Dynamic Cubes Modelers (publishing cube to a server)	Configuration, Data Source Connections, Directory, Cognos	Read, Write, Execute, Traverse
Dynamic Cubes Modelers (publishing a package)	My Folders, Public Folders	Read, Write, Traverse
Dynamic Cubes Modelers (assigning cube to a dispatcher)	Query Service (on one or more dispatchers), Configuration, Dispatchers and Services	Read, Write, Execute, Traverse
Dynamic Cubes Security Administrators	Configuration, Data Source Connections, Directory, Cognos	Read, Write, Execute, Traverse, Set policy
Dynamic Cubes Configuration Administrators	Configuration, Query Service (on all dispatchers on which cubes are managed), Dispatchers and Services	Read, Write, Execute, Traverse
Dynamic Cubes Managers	Query Service (on all dispatchers on which cubes are managed) Configuration, Content Administration	Read, Write, Execute, Traverse
Dynamic Cubes Optimizers (saving in-memory recommendations)	Configuration, Data Source Connections, Directory, Cognos	Read, Write, Execute, Traverse

Securing cube data

Each source dynamic cube is assigned a single data access account. The dynamic query mode server that hosts dynamic cubes is a trusted process that uses the connection and signon for the specified account to access the underlying relational data source for the dynamic cube when the account user creates trusted credentials.

A Cognos system administrator has access to all data within a dynamic cube. However, a dynamic cube does not necessarily expose all the data accessible through the relational data source connection. In such cases, it may be required to ensure that the system administrator does not have the ability to access the relational data source using the data access account assigned to a dynamic cube.

The configuration of the relational data source is no different than the configuration of any other relational data source in IBM Cognos Analytics. If an explicit signon that consists of a user ID and password is used to access the relational data source, the system administrators can grant themselves access to this signon and use it to connect to the relational data source.

If users are granted the capability to manage their own data source signons, these users can create and save a signon for a particular data source. This self-managed signon can be used to secure a dynamic cube, assuming that the users have also created trusted credentials. The system administrators can assign the data access account of a specific user to secure the dynamic cube, but they cannot use the signon to access the relational data source.

If an external namespace is used for authentication to an external data source, there is no signon that the system administrator can use to access the relational data source. In this case, the trusted dynamic query mode server impersonates the user of the data access account to sign on to the relational database.