Troubleshooting
Problem
Customer would like to create a new user whose only role is to create, alter and delete user accounts in Controller (but not access other financial/functional features in the Controller client).
- In otherwords, they are trying to perform the task described inside separate IBM Technote #620465.
To achieve this, customer creates a new 'User Group' as a sub-group from 'MAIN'
- For example, they create a new user group called 'ITDEPT'.
Afterwards, they create a brand new user, and assigns them membership of the user group 'ITDEPT'.
- However, when they log on with this new user, they cannot create/delete/change existing users accounts
Specifically, when a member of this group logs onto Controller and launches 'Maintain - Rights - Users and Groups' the ability to change any account settings is greyed out (for all users *apart* from the users who belong to the same user group that he/she is a member of, for example 'ITDEPT').
Why is this?
Symptom
Imagine a scenario where:
- There is a user group 'ITDEPT' whose parent is the group 'MAIN':
- There is a user with user-group administrative permissions called 'ITSUP' who is a member of the user group 'ITDEPT'
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
If that user (ITSUP) creates a new user (for example 'USER1') inside the same user group (ITDEPT) then this works OK.
- Specifically, if they logon as user 'ITSUP' then they can successfully edit the properties of any user inside the group 'ITDEPT', for example:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
However, if that user (ITSUP) looks at a different user group (for example 'MAIN'), and looks at any user inside that different user group (MAIN) then all the settings are greyed out.
- Specifically, if they logon as user 'ITSUP' then they cannot edit the properties of any user inside the group 'MAIN', for example:
The button to 'delete' this user is greyed out.
However, the button 'New' is not greyed out...
...although if this button is pressed, then the only user group (that can be selected) is the one that the user belongs to ("ITDEPT"):
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Cause
There are other possible causes for this symptom.
- TIP: See separate IBM Technote #6129303 for more examples.
This Technote specifically relates to the scenario where the cause is that the behaviour is by design.
More Information
Any user that is not a member of the group 'MAIN' can only ever change users who belong to the same group that they themselves belong to.
- For more details on how to create a 'special' user (whose only role in Controller is to create new and edit existing users), see separate IBM Technote #620465.
Resolving The Problem
To be able to change users in all groups, you need to log on as either:
- The user ADM
- A user who belongs to the very top-level user group (called 'MAIN').
Example:
Modify the user, they belong to the top user group (MAIN).
- For example, below shows a user with user-group administrative permissions called 'ITSUP' who is a member of the user group 'MAIN'
Related Information
[{"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Product":{"code":"SS9S6B","label":"IBM Cognos Controller"},"Component":"Controller","Platform":[{"code":"PF033","label":"Windows"}],"Version":"All Versions","Edition":"","Line of Business":{"code":"LOB10","label":"Data and AI"}}]
Historical Number
1035485
Was this topic helpful?
Document Information
Modified date:
30 March 2020
UID
swg21371182