Question & Answer
Question
The matrix below describes how to specify capabilities and permissions in Cognos Analytics based on the license role entitlements. For Cognos Analytics Version 11.0.7 and above please see the following technote: http://www-01.ibm.com/support/docview.wss?uid=swg21684890 For a Video Tutorial please click on the following link: https://www.youtube.com/watch?v=jfAJYXqdfkI For Cognos Business Intelligence 10 please see the following technote: http://www-01.ibm.com/support/docview.wss?uid=swg21626203
Answer
How to set up capabilities and permissions per group or user based on their license role entitlements in Cognos Analytics 11
IBM Cognos Analytics License Roles are:
• Analytics Administrator
• Analytics Explorer
• Analytics User
• Information Distribution
Roles and Capabilities entitlements per each IBM Cognos Analytics License Roles:
License | Cognos Role | Capability |
Analytics Administrator | System Administrator, or any other Administrator Roles (Directory Administrators Library Administrators Metrics Administrators Mobile Administrators Portal Administrators Report Administrators Server Administrators ) |
All Analytics Explorer capabilities PLUS Manage (note 5) Administration Console IBM Cognos Software Development Kit |
Analytics Explorer | Consumers + Authors + Mobile Users + Metrics Authors + Modelers | All Analytics User Capabilities PLUS IBM Planning Analytics for Microsoft Excel IBM Cognos Framework Manager IBM Cognos Cube Designer/Dynamic Query Analyzer Transformer |
Analytics User | Consumers + Authors + Mobile Users + Modelers | All Information Distribution capability PLUS Create new Reports, Dashboards, Stories or Data Modules Execute Reports and respond to prompts IBM Cognos for Microsoft Office IBM Cognos Workspace IBM Cognos Insight IBM Cognos Event Studio IBM Cognos Query Studio IBM Cognos Analysis Studio Create Data Server Connections Upload Files |
Information Distribution | Readers + Mobile Users (note 1) | Receive Burst Report Outputs (inc Active Reports) View Scheduled Reports IBM Cognos Portal IBM Cognos Mobile Applications |
Note 1: No license for Cognos Workspace* or the new Dashboard, Upload Files or Data Modelling interface in Cognos Analytics. This capability needs to be removed.(see note 2)
Note 2: In order to comply with licensing regulations it may be required to remove the capability for a studio from a Cognos Role. See detailed steps below (Step G)
Note 3: Usage restrictions are in the Program-unique Terms section of the license. Please refer the license information:
http://www-03.ibm.com/software/sla/sladb.nsf/searchlis/?searchview&searchorder=4&searchmax=0&query=%28IBM+Cognos+Analytics+Administrator%29
Note 4: IBM does not recommend the mixing of charge metrics for end users. In the case where this is required, users accessing components of the system licensed under the PVU charge metric must be licensed. PVUs must be owned for each of the components inclusive of the Cognos Analytics server with DQ. Users accessing servers under the Authorized User charge metric are not limited to the number or size of servers which they can access.
Note 5: Analytics User and higher licenses have access to Manage > Data Server Connections. Also Jobs and datasources in the Administration Console.
Note 6: IBM Cognos Analysis For Microsoft Excel (CAFÉ) was changed to Planning Analytics for Excel to reflect the changes to TM1.
Detailed Steps to limit user access to areas of Cognos Analytics 11:
A. Restrict access to members of the built-in namespace
- Open Cognos Configuration and under the ‘Security’ tab, click on ‘Authentication’.
- Against ‘Restrict access to members of the built-in namespace?’ set the value to ‘True’. This excludes all others from third party authentication sources who are not explicitly part of a Cognos namespace group or role as defined in Cognos Analytics 11.
- Save the configuration and restart the Cognos service.
- Log into the Cognos Analytics 11 ‘Welcome’ dashboard as an administrator.
B. Steps to create the ‘Analytics Administrator’ licensed role:
- Log on as the Analytics Administrator and go to ‘Manage’ then ‘Accounts’ and select the Cognos Namespace.
- Select the ‘System Administrator’ Cognos Role and then select the ‘Members’ tab.
- Click the ‘Add Member’ button and select your group or user from your namespace.
- Click on the ‘minus’ button next to ‘Everyone’. Click on ‘OK’ to confirm deletion.
NOTE: Before removing the ‘Everyone’ group, make sure that one or more administrators are explicitly Added as a member of the ‘System Administrator’ role of the ‘Cognos’ namespace. Otherwise, once the ‘Everyone’ group is removed, that role will be locked out and no further changes can be made.
C. Steps to remove the ‘Everyone’ group from the built-in Cognos roles:
- Log on as the Analytics Administrator and go to ‘Manage’ then ‘Accounts’ and select the Cognos Namespace.
- Select the ‘Adaptive Analytics Users’ role and then select the ‘members’ tab.
- Click on the ‘minus’ button next to ‘Everyone’ and Click on ‘OK’ to confirm deletion.
- Repeat steps 1 -3 for the following roles: Analysis Users, Authors, Cognos Insight Users, Consumers, Controller users, Data Manager Authors, Express Authors, Mobile Users, Metrics Authors, Metric Users, Planning Contributor Users, Powerplay Users, Query Users and Readers.
D. Steps to create the Analytics Explorer licensed role
The ‘Analytics Explorer’ licensed role should be a member of the ‘Authors’, ‘Consumers’, ‘Metrics Authors’, ‘Mobile Users’ & 'Modelers' Cognos roles. (see matrix above)
- Log on as the ‘Analytics Administrator’ and go to ‘Manage’ then ‘Accounts’ and select the Cognos Namespace.
- Select the ‘Authors’ Cognos Role and then select the ‘Members’ tab.
- Click the ‘Add Member’ button and select your group or user from your namespace.
- Repeat steps 2-3 to add the user to the ‘Consumers’, ‘Metric Authors’, ‘Mobile users’ & ‘Modelers’ Cognos roles.
E. Steps to create the Analytics User licensed role
The ‘Analytics User’ licensed role should be a member of the ‘Authors’, ‘Consumers’, ‘Mobile Users’ & ‘Modelers’ Cognos roles. (see matrix above)
- Log on as the ‘Analytics Administrator’ and go to ‘Manage’ then ‘Accounts’ and select the Cognos Namespace.
- Select the ‘Authors’ Cognos Role and then select the ‘Members’ tab.
- Click the ‘Add Member’ button and select your group or user from your namespace.
- Repeat steps 2-3 to add the user to the ‘Consumers’, ‘Mobile users’ & ‘Modelers’ Cognos roles.
F. Steps to create the Information Distribution licensed role
The ‘Information Distribution’ licensed role should be a member of the ‘Readers’ and ‘Mobile Users’ Cognos roles. (see matrix above) In addition, there is a requirement that the ‘Executive Dashboard’, ‘Web Based Modeling’, ‘Upload Files’ and ‘Dashboard’ capabilities are removed from this role’
- Log on as the ‘Analytics Administrator’ and go to ‘Manage’ then ‘Accounts’ and select the Cognos Namespace.
- Select the ‘Readers’ Cognos Role and then select the ‘Members’ tab.
- Click the ‘Add Member’ button and select your group or user from your namespace.
- Repeat steps 2-3 to add the user to the ‘Mobile users’ Cognos role.
G. Steps to modify Capabilities for the Information Distribution role
- Log on as the ‘Analytics Administrator’ and go to ‘Manage’ then ‘Administration Console’ then ‘Security’ and choose ‘Capabilities’.
- Scroll to the ‘Executive Dashboard’ capability and select ‘set properties.
- Go to ‘Permissions’ and click ‘add’.
- Navigate to your group or user from your namespace and move it to the ‘selected entries’ Click ‘OK’.
- In the ‘permissions’ window place a check next to your group or user and select ‘Deny’ for ‘execute’ and ‘traverse’ and then ‘OK’.
- Repeat steps 2-5 for the ‘Web Based Modeling’, ‘Upload Files’ and ‘Dashboard’ capabilities.
- Scroll to the 'Generate CSV Output' capability and click Set properties.
- Go to 'Permissions' and click 'add.
- Navigate to your group or user from your namespace and move it to the ‘selected entries’.
- Navigate to 'Cognos namespace' and move the following roles to the 'selected entries' -> Analytics Users, Analytics Explorers, Authors, Modellers, Report Administrators and then click 'OK'.
- In the ‘permissions’ window place a check next to your group or user and Analytics Users, Analytics Explorers, Authors, Modellers, Report Administrators select ‘Grant’ for ‘execute’ and ‘traverse’ and then ‘OK’.
- In the ‘permissions’ window, place a check next to everyone and click 'remove.
- Repeat steps 7 -12 for 'Generate PDF Output ', Generate XLS Output', Generate XML Output', Data sets'.
- Scroll to the 'External Repositories ' capability and click set properties.
- Go to 'Permissions' window place a check next to everyone and click 'remove'.
- Repeat steps 14 -15 for 'Snapshots'.
Additional related information that should be read when considering security and licensing of your IBM Cognos environment:
The matrix above is based on the License Information Documents for IBM Cognos Analytics. They can be found by clicking on the License Role
http://www-03.ibm.com/software/sla/sladb.nsf/searchlis/?searchview&searchorder=4&searchmax=0&query=%28IBM+Cognos+Analytics+Administrator%29
Related Information
Was this topic helpful?
Document Information
Modified date:
15 April 2019
UID
swg22007870