IBM Support

How do you restrict users based on their License Roles in Cognos Analytics (version 11.0.7 +)

Question & Answer


Question

The matrix below describes how to specify capabilities and permissions in Cognos Analytics based on the license role entitlements. For Cognos Analytics Version 11.0.0 to 11.0.6 please see the following technote: http://www-01.ibm.com/support/docview.wss?uid=swg22007870 For Cognos Business Intelligence 10 please see the following technote: http://www-01.ibm.com/support/docview.wss?uid=swg21626203 *Please Note. These steps are only for Custom Installations. For Easy Installations please use the steps for version 11.0.0 - 11.0.6 above

Answer

For a Video Tutorial please use the following link: https://youtu.be/a9fZ9DM8JwM

How to set up capabilities and permissions per group or user based on their license role entitlements in Cognos Analytics version 11.0.7 +

IBM Cognos Analytics License Roles are:

• Analytics Administrator
• Analytics Explorer
• Analytics User
• Information Distribution

Roles and Capabilities entitlements per each IBM Cognos Analytics License Roles:

 

License Cognos Role Capability
Analytics Administrator Analytics Administrators All Analytics Explorer capabilities PLUS
Manage (note 3)
Administration Console
IBM Cognos Software Development Kit
Analytics Explorer Analytics Explorers All Analytics User Capabilities PLUS
IBM Planning Analytics for Microsoft Excel
IBM Cognos Framework Manager
IBM Cognos Cube Designer/Dynamic Query Analyzer
Transformer
Analytics User Analytics Users All Information Distribution capability PLUS
Create new Reports, Dashboards, Stories or Data Modules
Execute Reports and respond to prompts
IBM Cognos for Microsoft Office
IBM Cognos Workspace
IBM Cognos Insight
IBM Cognos Event Studio
IBM Cognos Query Studio
IBM Cognos Analysis Studio
Create Data Server Connections
Upload Files
Create new Job (legacy)
Information Distribution Information Distribution Receive Burst Report Outputs (inc Active Reports)
View Scheduled Reports
IBM Cognos Portal
IBM Cognos Mobile Applications


Note 1: Usage restrictions are in the Program-unique Terms section of the license. Please refer the license information:

http://www-03.ibm.com/software/sla/sladb.nsf/searchlis/?searchview&searchorder=4&searchmax=0&query=%28IBM+Cognos+Analytics+Administrator%29

Note 2: IBM does not recommend the mixing of charge metrics for end users. In the case where this is required, users accessing components of the system licensed under the PVU charge metric must be licensed. PVUs must be owned for each of the components inclusive of the Cognos Analytics server with DQ. Users accessing servers under the Authorized User charge metric are not limited to the number or size of servers which they can access. For Cognos Analytics systems licensed under PVU define the routing rules https://www.ibm.com/support/knowledgecenter/en/SSEP7J_11.0.0/com.ibm.swg.ba.cognos.ug_cra.doc/c_specifyadvanceddispatcherrouting.html#SpecifyAdvancedDispatcherRouting

Note 3: Analytics User and higher licenses have access to Manage > Data Server Connections and Manage> New Job. Also Data source connections in the Administration Console.


Note 4: Analytics Explorer : If it's not a new install and you are using the permissions defined in the previous release, give permission to the new capability "Desktop tools" to the Analytics Explorer licensee. See detailed steps in the section G.

Note 5: IBM Cognos Analysis For Microsoft Excel (CAFÉ) was changed to Planning Analytics for Excel to reflect the changes to TM1.

Detailed Steps to limit user access to areas of Cognos Analytics 11:

A. Restrict access to members of the built-in namespace

  1. Open Cognos Configuration and under the ‘Security’ tab, click on ‘Authentication’.
  2. Against ‘Restrict access to members of the built-in namespace?’ set the value to ‘True’. This excludes all others from third party authentication sources who are not explicitly part of a Cognos namespace group or role as defined in Cognos Analytics 11.
  3. Save the configuration and restart the Cognos service.
  4. Log into the Cognos Analytics 11 ‘Welcome’ dashboard as an administrator.

B. Steps to create the ‘Analytics Administrator’ licensed role:

  1. Log on as the Analytics Administrator and go to ‘Manage’ then ‘Accounts’ and select the Cognos Namespace.
  2. Select the ‘Analytics Administrators’ Cognos Role and then select the ‘Members’ tab.
  3. Click the ‘Add Member’ button and select your group or user from your namespace.

C. Steps to remove Everyone from the System Administrator Cognos role:

  1. Log on as the Analytics Administrator and go to ‘Manage’ then ‘Accounts’ and select the Cognos Namespace.
  2. Select the ‘System Administrator’ Cognos Role and then select the ‘Members’ tab.
  3. Click on the ‘minus’ button next to ‘Everyone’. Click on ‘OK’ to confirm deletion.


NOTE: Before removing the ‘Everyone’ group, make sure that one or more administrators are explicitly Added as a member of the ‘Analytics Administrators’ role of the ‘Cognos’ namespace. Otherwise, once the ‘Everyone’ group is removed, that role will be locked out and no further changes can be made.

D. Steps to create the Analytics Explorer licensed role

The ‘Analytics Explorer’ licensed role should be a member of the 'Analytics Explorer' Cognos role. (see matrix above)

  1. Log on as the ‘Analytics Administrator’ and go to ‘Manage’ then ‘Accounts’ and select the Cognos Namespace.
  2. Select the ‘‘Analytics Explorer’ Cognos Role and then select the ‘Members’ tab.
  3. Click the ‘Add Member’ button and select your group or user from your namespace.

E. Steps to create the Analytics User licensed role

The ‘Analytics User’ licensed role should be a member of the 'Analytics User' Cognos role. (see matrix above)

  1. Log on as the ‘Analytics Administrator’ and go to ‘Manage’ then ‘Accounts’ and select the Cognos Namespace.
  2. Select the ‘Analytics User’ Cognos Role and then select the ‘Members’ tab.
  3. Click the ‘Add Member’ button and select your group or user from your namespace.

F. Steps to create the Information Distribution licensed role

The ‘Information Distribution’ licensed role should be a member of the 'Information Distribution' Cognos Role. (see matrix above)

  1. Log on as the ‘Analytics Administrator’ and go to ‘Manage’ then ‘Accounts’ and select the Cognos Namespace.
  2. Select the Information Distribution' Cognos Role and then select the ‘Members’ tab.
  3. Click the ‘Add Member’ button and select your group or user from your namespace.


G. Steps to give permission to the new capability "Desktop tools"
1. Log on as the ‘Analytics Administrator’ and go to ‘Manage’ then ‘Administration Console’ then ‘Security’ and choose ‘Capabilities’.
2. Scroll to the ‘Desktop Tools’ capability and select ‘Set properties'.
3. Go to ‘Permissions’ and click ‘Add’.
4. Navigate to your group or user from your namespace and move it to the ‘selected entries’ Click ‘OK’.
5. In the ‘permissions’ window place a check next to your group or user and select 'Grant' for all and then ‘OK’.

H. Steps to modify Capabilities for the Information Distribution role
      1. Log on as the ‘Analytics Administrator’ and go to ‘Manage’, then ‘Administration Console’, then ‘Security’ and then choose ‘Capabilities’.
      2. Scroll to the 'Generate CSV Output' capability and click Set properties.
      3. Go to 'Permissions' and click 'Add'.
      4. Navigate to your group or user from your namespace and move it to the ‘selected entries’.
      5. Navigate to 'Cognos namespace' and move the following roles to the 'selected entries' -> Analytics Users, Analytics Explorers, Authors, Modellers, Report Administrators and click 'OK'.
      6. In the ‘permissions’ window, place a check next to your group or user and Analytics Users, Analytics Explorers, Authors, Modellers, Report Administrators select ‘Grant’ for ‘execute’ and ‘traverse’ un-select all selected entries.
      7. In the ‘permissions’ window place a check next to everyone and click 'remove' and then ‘OK’.
      8. Repeat steps 1 -6 for 'Generate PDF Output ', Generate XLS Output', Generate XML Output', and Data sets'
      9. Scroll to the 'External Repositories ' capability and click set properties.
      10. Go to 'Permissions' window, place a check next to everyone, and click 'remove'
      11. Repeat step 9 -10 for 'Snapshots'.


Additional related information that should be read when considering security and licensing of your IBM Cognos environment:

[{"Product":{"code":"SSTSF6","label":"Cognos Analytics"},"Business Unit":{"code":"BU002","label":"Business Analytics"},"Component":"Administration and Configuration v11x","Platform":[{"code":"PF002","label":"AIX"},{"code":"PF010","label":"HP-UX"},{"code":"PF016","label":"Linux"},{"code":"PF027","label":"Solaris"},{"code":"PF033","label":"Windows"}],"Version":"11.0.10;11.0.9;11.0.8;11.0.7","Edition":"All Editions"},{"Product":{"code":"SSEP7J","label":"Cognos Business Intelligence"},"Business Unit":{"code":"BU002","label":"Business Analytics"},"Component":" ","Platform":[{"code":"","label":""}],"Version":"","Edition":""}]

Document Information

Modified date:
15 April 2019

UID

swg21684890