Question & Answer
Question
The matrix below describes how to specify capabilities and permissions in Cognos Analytics based on the license role entitlements. For Cognos Analytics Version 11.0.0 to 11.0.6 please see the following technote: http://www-01.ibm.com/support/docview.wss?uid=swg22007870 For Cognos Business Intelligence 10 please see the following technote: http://www-01.ibm.com/support/docview.wss?uid=swg21626203 *Please Note. These steps are only for Custom Installations. For Easy Installations please use the steps for version 11.0.0 - 11.0.6 above
Answer
For a Video Tutorial please use the following link: https://youtu.be/a9fZ9DM8JwM
How to set up capabilities and permissions per group or user based on their license role entitlements in Cognos Analytics version 11.0.7 +
IBM Cognos Analytics License Roles are:
• Analytics Administrator
• Analytics Explorer
• Analytics User
• Information Distribution
Roles and Capabilities entitlements per each IBM Cognos Analytics License Roles:
| License | Cognos Role | Capability |
| Analytics Administrator | Analytics Administrators | All Analytics Explorer capabilities PLUS Manage (note 3) Administration Console IBM Cognos Software Development Kit |
| Analytics Explorer | Analytics Explorers | All Analytics User Capabilities PLUS IBM Planning Analytics for Microsoft Excel IBM Cognos Framework Manager IBM Cognos Cube Designer/Dynamic Query Analyzer Transformer |
| Analytics User | Analytics Users | All Information Distribution capability PLUS Create new Reports, Dashboards, Stories or Data Modules Execute Reports and respond to prompts IBM Cognos for Microsoft Office IBM Cognos Workspace IBM Cognos Insight IBM Cognos Event Studio IBM Cognos Query Studio IBM Cognos Analysis Studio Create Data Server Connections Upload Files Create new Job (legacy) |
| Information Distribution | Information Distribution | Receive Burst Report Outputs (inc Active Reports) View Scheduled Reports IBM Cognos Portal IBM Cognos Mobile Applications |
Note 1: Usage restrictions are in the Program-unique Terms section of the license. Please refer the license information:
http://www-03.ibm.com/software/sla/sladb.nsf/searchlis/?searchview&searchorder=4&searchmax=0&query=%28IBM+Cognos+Analytics+Administrator%29
Note 2: IBM does not recommend the mixing of charge metrics for end users. In the case where this is required, users accessing components of the system licensed under the PVU charge metric must be licensed. PVUs must be owned for each of the components inclusive of the Cognos Analytics server with DQ. Users accessing servers under the Authorized User charge metric are not limited to the number or size of servers which they can access. For Cognos Analytics systems licensed under PVU define the routing rules https://www.ibm.com/support/knowledgecenter/en/SSEP7J_11.0.0/com.ibm.swg.ba.cognos.ug_cra.doc/c_specifyadvanceddispatcherrouting.html#SpecifyAdvancedDispatcherRouting
Note 3: Analytics User and higher licenses have access to Manage > Data Server Connections and Manage> New Job. Also Data source connections in the Administration Console.
Note 4: Analytics Explorer : If it's not a new install and you are using the permissions defined in the previous release, give permission to the new capability "Desktop tools" to the Analytics Explorer licensee. See detailed steps in the section G.
Note 5: IBM Cognos Analysis For Microsoft Excel (CAFÉ) was changed to Planning Analytics for Excel to reflect the changes to TM1.
Detailed Steps to limit user access to areas of Cognos Analytics 11:
A. Restrict access to members of the built-in namespace
- Open Cognos Configuration and under the ‘Security’ tab, click on ‘Authentication’.
- Against ‘Restrict access to members of the built-in namespace?’ set the value to ‘True’. This excludes all others from third party authentication sources who are not explicitly part of a Cognos namespace group or role as defined in Cognos Analytics 11.
- Save the configuration and restart the Cognos service.
- Log into the Cognos Analytics 11 ‘Welcome’ dashboard as an administrator.
B. Steps to create the ‘Analytics Administrator’ licensed role:
- Log on as the Analytics Administrator and go to ‘Manage’ then ‘Accounts’ and select the Cognos Namespace.
- Select the ‘Analytics Administrators’ Cognos Role and then select the ‘Members’ tab.
- Click the ‘Add Member’ button and select your group or user from your namespace.
C. Steps to remove Everyone from the System Administrator Cognos role:
- Log on as the Analytics Administrator and go to ‘Manage’ then ‘Accounts’ and select the Cognos Namespace.
- Select the ‘System Administrator’ Cognos Role and then select the ‘Members’ tab.
- Click on the ‘minus’ button next to ‘Everyone’. Click on ‘OK’ to confirm deletion.
NOTE: Before removing the ‘Everyone’ group, make sure that one or more administrators are explicitly Added as a member of the ‘Analytics Administrators’ role of the ‘Cognos’ namespace. Otherwise, once the ‘Everyone’ group is removed, that role will be locked out and no further changes can be made.
D. Steps to create the Analytics Explorer licensed role
The ‘Analytics Explorer’ licensed role should be a member of the 'Analytics Explorer' Cognos role. (see matrix above)
- Log on as the ‘Analytics Administrator’ and go to ‘Manage’ then ‘Accounts’ and select the Cognos Namespace.
- Select the ‘‘Analytics Explorer’’ Cognos Role and then select the ‘Members’ tab.
- Click the ‘Add Member’ button and select your group or user from your namespace.
E. Steps to create the Analytics User licensed role
The ‘Analytics User’ licensed role should be a member of the 'Analytics User' Cognos role. (see matrix above)
- Log on as the ‘Analytics Administrator’ and go to ‘Manage’ then ‘Accounts’ and select the Cognos Namespace.
- Select the ‘Analytics User’ Cognos Role and then select the ‘Members’ tab.
- Click the ‘Add Member’ button and select your group or user from your namespace.
F. Steps to create the Information Distribution licensed role
The ‘Information Distribution’ licensed role should be a member of the 'Information Distribution' Cognos Role. (see matrix above)
- Log on as the ‘Analytics Administrator’ and go to ‘Manage’ then ‘Accounts’ and select the Cognos Namespace.
- Select the ‘Information Distribution' Cognos Role and then select the ‘Members’ tab.
- Click the ‘Add Member’ button and select your group or user from your namespace.
G. Steps to give permission to the new capability "Desktop tools"
1. Log on as the ‘Analytics Administrator’ and go to ‘Manage’ then ‘Administration Console’ then ‘Security’ and choose ‘Capabilities’.
2. Scroll to the ‘Desktop Tools’ capability and select ‘Set properties'.
3. Go to ‘Permissions’ and click ‘Add’.
4. Navigate to your group or user from your namespace and move it to the ‘selected entries’ Click ‘OK’.
5. In the ‘permissions’ window place a check next to your group or user and select 'Grant' for all and then ‘OK’.
H. Steps to modify Capabilities for the Information Distribution role
1. Log on as the ‘Analytics Administrator’ and go to ‘Manage’, then ‘Administration Console’, then ‘Security’ and then choose ‘Capabilities’.
2. Scroll to the 'Generate CSV Output' capability and click Set properties.
3. Go to 'Permissions' and click 'Add'.
4. Navigate to your group or user from your namespace and move it to the ‘selected entries’.
5. Navigate to 'Cognos namespace' and move the following roles to the 'selected entries' -> Analytics Users, Analytics Explorers, Authors, Modellers, Report Administrators and click 'OK'.
6. In the ‘permissions’ window, place a check next to your group or user and Analytics Users, Analytics Explorers, Authors, Modellers, Report Administrators select ‘Grant’ for ‘execute’ and ‘traverse’ un-select all selected entries.
7. In the ‘permissions’ window place a check next to everyone and click 'remove' and then ‘OK’.
8. Repeat steps 1 -6 for 'Generate PDF Output ', Generate XLS Output', Generate XML Output', and Data sets'
9. Scroll to the 'External Repositories ' capability and click set properties.
10. Go to 'Permissions' window, place a check next to everyone, and click 'remove'
11. Repeat step 9 -10 for 'Snapshots'.
Additional related information that should be read when considering security and licensing of your IBM Cognos environment:
- The matrix above is based on the License Information Documents for IBM Cognos Analytics. They can be found by clicking on the License Role
http://www-03.ibm.com/software/sla/sladb.nsf/searchlis/?searchview&searchorder=4&searchmax=0&query=%28IBM+Cognos+Analytics+Administrator%29
Related Information
Was this topic helpful?
Document Information
Modified date:
15 April 2019
UID
swg21684890