IBM Support

How do you restrict users based on their License Roles in Cognos Analytics (version 11.1.1 +)

Question & Answer


Question

How do you restrict users based on their License Roles in Cognos Analytics (version 11.1.1 +)

Answer

You can assign capabilities based on license role entitlements. This allows you to restrict users to perform only the functions to which they are entitled.

You must perform the tasks in this order:

  1. Check box icon Assign yourself to the System Administrators role
  2. Check box icon Restrict access to members of the Cognos namespace
  3. Check box icon Remove the Everyone group from the System Administrators role
  4. Check box icon Assign users to their predefined roles
  5. Check box icon Remove Analytics Viewer capabilities to match license requirements
  6. Check box icon Grant Dashboard capabilities to specific roles and users (11.1.4 only)

For information about usage restrictions, see the License Information Documents (http://www-03.ibm.com/software/sla/sladb.nsf/searchlis/?searchview&searchorder=4&searchmax=0&query=(IBM+Cognos+Analytics+11.1) for your program.

1. Assign yourself to the System Administrators role

As administrator, you must first ensure that your personal userid and any applicable administrative groups are members of the System Administrators role.

Only after you have completed this task can you remove the Everyone group from the System Administrators role.

Procedure

  1. Log on to Cognos Analytics using the administrator userid and password.
  2. Click Manage > People > Accounts.
  3. Select the Cognos namespace.
  4. Click the More icon More icon next to the System Administrators role and then click the View members icon.
  5. Click Select.
  6. Add your personal userid, and any applicable administrative groups, to the System Administrators role.
2. Restrict access to members of the Cognos namespace

You or the installer can configure access to Cognos Analytics so that only users who are members of any group or role in the Cognos namespace can access the application.

Procedure

  1. On each Content Manager computer, start IBM Cognos Configuration.
  2. In the Explorer window, under Security, click Authentication.
  3. In the Properties window, change the value of Restrict access to members of the built-in namespace to True.
  4. From the File menu, click Save.
3. Remove the Everyone group from the System Administrators role
Important Ensure that you have assigned your userid to the System Administrators role before you remove the Everyone group from the System Administrators role. Otherwise, that role will be locked out and no one will be able to make any further administrative changes.

The Everyone group is a Cognos group that comprises every userid in the Cognos namespace. By default, after installation the Everyone group is assigned to the System Administrators role. This initial configuration gives every user, even those who are not targeted as administrators, full access to all capabilities.

Purpose

This task removes, from all users, all the capabilities that they were initially assigned from a default installation. After completing this task, your next step will be to assign users and groups to their predefined roles. Users will then have access only to the capabilities that they require for their own role.

Procedure

  1. Log on with your personal userid, which you previously assigned to the System Administrators role.
  2. Click Manage > People > Accounts.
  3. Select the Cognos namespace.
  4. Click the More icon More icon next to the System Administrators role and then click the View members icon.
  5. Click the Remove member icon Remove member icon next to Everyone group and then click OK.
4. Assign users to their predefined roles

You can now assign users and groups to their predefined roles. These roles are as follows:

  • Analytics Explorers
  • Analytics Users
  • Analytics Viewers

About this task

By assigning each user to their predefined role, you are effectively granting them the capabilities that are associated with their role. To see a matrix of the default capabilities that are available to each predefined role, see Default permissions based on licenses.

Procedure

  1. Log on as the System Administrator.
  2. Click Manage > People > Accounts.
  3. Select the Cognos namespace.
  4. Click the More icon More icon next to the Analytics Explorers role and then click the View members icon.
  5. Click Select.
  6. Add the applicable users and groups as members of the Analytics Explorers role.
  7. Repeat steps 4-6 for these roles:
    • Analytics Users
    • Analytics Viewer
5. Remove Analytics Viewer capabilities to match license requirements

About this task

Certain capabilities count toward an Analytics User license that are not intended for Analytics Viewer licensees. By default, however, these capabilities are granted to the Everyone group. In this task, you narrow the list of users granted these capabilities to only those who are appropriately licensed. The net effect is that the capabilities are removed from Analytics Viewer licensees, moving in line with their license entitlements.

This task has two parts:

  1. Add specific roles to each of these capabilities:
    • Generate CSV Output
    • Generate PDF Output
    • Generate XLS Output
    • Generate XML Output
    • Data sets
  2. Remove the Everyone group from the capabilities listed above. As a result, only the roles that were added in part 1 retain the capabilities.

Procedure

  1. Log on as a System Administrator.
  2. Click Manage > People > Capabilities.
  3. Click the More icon More icon next to the Generate CSV Output capability and then click Customize access.
  4. Click the Add member icon Add member icon.
  5. Click the Cognos namespace.
  6. Press Ctrl-click to multi-select Analytics Users, Analytics Explorers, Authors, Modelers, and Report Administrators.
  7. Click Add and then click Close.
  8. In the Permissions column, for each role you added, select Access.
  9. Click the Remove member icon Remove member icon next to the Everyone group and then click OK.
  10. Repeat steps 3-9 for the remaining capabilities:
    • Generate PDF Output
    • Generate XLS Output
    • Generate XML Output
    • Data sets
  11. Scroll to the External Repositories capability.
    1. Click the More icon More icon.
    2. Click Customize access.
    3. Click the Remove member icon Remove member icon next to the Everyone group.
    4. Click OK.
  12. Scroll to the Snapshots capability.
    1. Click the More icon More icon.
    2. Click Customize access.
    3. Click the Remove member icon Remove member icon next to the Everyone group.
    4. Click OK.
6. Grant Dashboard capabilities to specific roles and users (11.1.4 only)

Applies to version 11.1.4 and subsequent versions unless specifically overridden In Cognos Analytics 11.1.4 only, you must customize the Dashboard capability and the Dashboard > Create/Edit secured feature.

Procedure

  1. Log on as a System Administrator.
  2. Click Manage > People > Capabilities.
  3. Scroll to the Dashboard capability.
    1. Click the More icon More icon.
    2. Click Customize access.
    3. Click the Add member icon Add member icon.
    4. Click the Cognos namespace.
    5. Select Analytics Viewer.
    6. Click Add and then click Close.
    7. In the Permissions column for Analytics Viewer, select Access.
  4. Expand the Dashboard capability and then click the More icon More icon next to Create/Edit.
    1. Click Customize access.
    2. Click the Remove member icon Remove member icon next to the Analytics Viewer role.
    3. Click the Add member icon Add member icon.
    4. Navigate to your namespace, select the appropriate groups or users, and then click Add.
    5. Click the Add member icon Add member icon.
    6. Navigate to the Cognos namespace.
    7. Press Ctrl-click to multi-select Analytics Users, Analytics Explorers, Authors, Modelers, and Report Administrators.
    8. Click Add and then click Close.
    9. In the Permissions column, for each user, group, and role that you added, select Access.

Related Information

Cognos BI 10 Licensed Roles

[{"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Product":{"code":"SSTSF6","label":"IBM Cognos Analytics"},"ARM Category":[{"code":"","label":""}],"Platform":[{"code":"PF002","label":"AIX"},{"code":"PF010","label":"HP-UX"},{"code":"PF016","label":"Linux"},{"code":"PF027","label":"Solaris"},{"code":"PF033","label":"Windows"}],"Version":"11.1.x","Edition":"All Editions","Line of Business":{"code":"LOB10","label":"Data and AI"}}]

Document Information

Modified date:
01 March 2021

UID

ibm10735275

Page Feedback