Content

Overview

You can set up a proxy server that forwards requests from IBM® Cognos® TM1® client applications to the TM1 Application Server.

A proxy server (sometimes called a reverse proxy) can provide benefits such as the following:

· Hide the existence and characteristics of the application server

· Optimize request processing

· Distribute load

· Perform front-end auditing

· Perform additional security

Additionally, a proxy is required when the internal domains and ports of the TM1 Application Server are not available for direct access from the Internet where TM1 client applications are used.

A proxy environment consists of the following components:

· The TM1 client application, such as IBM Cognos Analysis for Microsoft Excel, in the Internet

· Proxy server, TM1 Application Server, and TM1 Server in the internal network

· If you are using Cognos security with TM1, the Cognos Business Intelligence server in the internal network

Setting up IBM Cognos TM1 to operate with a proxy
You can set up IBM® Cognos® TM1® to operate with a proxy.

Procedure

1. Install and configure TM1 Application Server, TM1 Admin Server, and TM1 server. Follow the installation and configuration procedures in the IBM Cognos TM1 documentation.

2. If you want to use Cognos security with TM1, set up Cognos security and test the environment before you introduce the proxy. For more details about Cognos security, see Overview to Cognos security.

3. Install and configure the proxy to interoperate with the TM1 Application Server. The details of this step are highly dependent on the type of proxy software you are using and are therefore beyond the scope of the TM1 documentation. In general, the proxy should permit access to the internal network domain and to the port running TM1 Application Server, with particular access to the following contexts and their sub-contexts: pmhub.

4. Install and run the TM1 client application, such as Cognos Analysis for Microsoft Excel, within the internal network. This step ensures that you have configured TM1 and the client application before you enhance the setup to include the proxy.

5. Configure TM1 Application Server to interoperate with the proxy. For more information, see Using a proxy.

Configuring IBM Cognos TM1 Application Server to interoperate with a proxy
After you have set up TM1® and the proxy server, the next step is to configure the TM1 Application Server to interoperate with the proxy.

About this task

Use IBM® Cognos® Configuration to configure the TM1 Application Server to interoperate with a proxy.

Note: This topic applies to IBM Cognos Analysis for Microsoft Excel, IBM Cognos Performance Management Hub, IBM Cognos Operations Console, and IBM Cognos TM1 Mobile Contributor. More configuration is required for other TM1 client applications. For more information, see TM1 Web and TM1 Applications Utilizing a Load Balancing Appliance.

Procedure

1. Stop the TM1 Application Server.

2. Change the External server URI property. Change the default value of http://localhost:9510 to the protocol, domain, and port of the proxy as it should be addressed from a running instance of the TM1 client application in the Internet. Use a fully qualified host domain. For example: http://myproxy.mycompany.com:1234

Important: Use fully qualified domain names (for example, myproxy.mycompany.com rather than myproxy) when you set the External server URI property. Connection definitions (for example, within Cognos Analysis for Microsoft Excel) and navigation by users within browsers should reference the matching fully qualified name. A mix of short names (myproxy) and long names (myproxy.mycompany.com) is not recommended.

3. Restart the TM1 Application Server.

4. If you are using Cognos security (Cognos Access Manager) with TM1, see Using a proxy.

5. Test your configuration changes.

a. Connect a running instance of the client application, such as Cognos Analysis for Microsoft Excel, using the proxy address rather than the default address.

b. Log in to IBM Cognos Performance Management Hub using the following URL: http://myproxy.mycompany.com:1234/pmhub/pm/security/login

Configuring IBM Cognos TM1 Application Server for IBM Cognos security when using a proxy
In a TM1® installation that uses IBM® Cognos® security (CAM), you need to do more steps to support the proxy.

Before you begin

· TM1 is configured with Cognos security

· IBM Cognos Business Intelligence (BI) software must already be installed and configured with namespaces.

Procedure

1. Disable anonymous access.

a. Open IBM Cognos Configuration in the BI installation location, not in the TM1 installation location.

b. Expand Security > Authentication and then click Cognos.

c. Ensure that Allow anonymous access is set to False.

2. Set the Cognos security URL in IBM Cognos Performance Management Hub (PM Hub).

a. Go to the PM Hub portal Login page using a proxy-based URL such as http://myproxy.mycompany.com:1234/pmhub/pm/security/login

b. Click the Namespace list and select any TM1 server instance. Enter your Cognos user name and password and log in.

c. Click the Administration and Configuration link.

d. Expand com.ibm.ba.pm.resource.security and click com.ibm.ba.pm.resource.security.dictionary.

e. Edit the CAMBIURL property.

If the TM1 Application Server can access the BI dispatcher directly within the network, you can use a direct URL: http://internal.bi.server:9300/p2pd/dispatch

If the proxy is protecting the internal URI behind a secured firewall, specify the proxy in the URL: http://myproxy.mycompany.com:1234/p2pd/dispatch

Note: Configure the proxy server to redirect requests to the Cognos BI dispatcher for the URL context p2pd in the same way as for other TM1 based contexts such as pmhub, tm1web, and pmpsvc.

If you are using Single Signon with the BI gateway, you might need to set the CAMGatewayURL property. Set CAMGatewayURL using the same steps as you used to set CAMBIURL.

3. Test the configuration.

a. Log out of PM Hub.

b. Go back to the PM Hub portal Login page.

c. Click the Namespace list. You should see TM1 servers in the list, as before, plus IBM Cognos BI namespaces.

Note: BI namespaces must be defined in your Cognos BI installation configuration to appear in the Namespace list.

Troubleshooting proxy setup for TM1

Follow these steps to troubleshoot connection issues in a TM1 environment that includes a proxy.

1. Determine where the problem is occurring:

a. In a TM1 client application, access the TM1 server directly, without using the proxy URI. For example, start Cognos TM1 Performance Modeler and click Connect Directly.

b. If you are using Cognos security, use a TM1 web application, such as TM1 Web, to access the Cognos BI server, without the proxy URI. Try again using the proxy URI.

c. In a TM1 web application, such as TM1 Web, access the TM1 Server via TM1 Application Server, without using the proxy URI. Try again using the proxy URI.

d. In a TM1 client application, such as Cognos Analysis for Microsoft Excel, access the TM1 Server via TM1 Application Server, without using the proxy URI. Try again using the proxy URI

Note: You might have difficulty accessing servers if the proxy is a firewall. In this case, run the TM1 client or web application within the firewall to test connections without the proxy.

2. If one of the tests in Step 1 fails, check the configuration for that connection, retry, and then continue with the next test.