Configure TM1 CAM Authentication using Cognos Analytics 11.0 with SSO

Answer

Part 1 - Verify the configuration of IIS for Cognos Analytics 11 with SSO

To configure the IIS gateway for Cognos Analytics 11 it's recommended to use the CA_IIS_config.bat script found here: http://www-01.ibm.com/support/docview.wss?uid=swg22000097. This script will automatically complete the IIS configuration that is detailed here: https://www.ibm.com/support/knowledgecenter/SSEP7J_11.0.0/com.ibm.swg.ba.cognos.inst_cr_winux.doc/t_gateway_iis.html

Take note of the alias name set in the CA_IIS_config.bat file before the script is run.

In addition to the CA_IIS_config.bat the following items should also verified.

1 - The URLs in Cognos Configuration for Cognos Analtyics 11 use the fully qualified domain name (FQDN).

2 - The Gateway URL in Cognos Configuration for Cognos Analytics is configured as follows (gateway.domain.com is the FQDN for the Cognos Analytics gateway server and <alias name> is the alias that was set in CA_IIS_config.bat before running the script.

http://gateway.domain.com:80/<alias name>/bi/v1/disp

3 - Examine the .\<cognos analytics 11>\webcontent\default.htm and .\<cognos analytics 11>\webcontent\index.html file. Update the line starting with <meta http-equiv="refresh" as follows (where <alias name> is the alias used in the CA_IIS_config.bat script file).

<meta http-equiv="refresh" content="0; URL=/<alias name>/bi/">



Part 2 - Configure the TM1 Server for CAM Authentication

The tm1s.cfg file should be configured with the following parameters.

IntegratedSecurityMode=5
ClientCAMURI=http://gateway.domain.com:80/<alias name>/bi/v1/disp
ServerCAMURI=http://app.domain.com:9300/p2pd/servlet/dispatch

Note that on a single server Cognos Analytics 11 install gateway.domain.com and app.domain.com would be the same system.

As of Planning Analtyics 2.0 Local it's no longer required to restart the TM1 Server after making changes to the IntegratedSecurityMode, ClientCAMURI, or ServerCAMURI parameters.

At this point TM1 Architect and Perspective should be able to connect to the TM1 model using CAM authentication with SSO.



Part 3 - Configure CAM Authentication for TM1Web, pmpsvc, and pmhub

The configuration for CAM Authentication with TM1Web can be found here:

https://www.ibm.com/support/knowledgecenter/SSD29G_2.0.0/com.ibm.swg.ba.cognos.tm1_inst.2.0.0.doc/t_tm1_inst_tm1web_cogsecurity.html

The configuration for CAM Authentication with pmpsvc can be found here:

https://www.ibm.com/support/knowledgecenter/SSD29G_2.0.0/com.ibm.swg.ba.cognos.tm1_inst.2.0.0.doc/t_config_tm1_cont.html

The configuration for CAM Authentication with pmhub can be found here:

https://www.ibm.com/support/knowledgecenter/SSD29G_2.0.0/com.ibm.swg.ba.cognos.tm1_inst.2.0.0.doc/t_tm1_opsconsole_cogsecurity.html

The following Technote provides additional details of the CAM authentication configuration for TM1Web, pmpsvc, and pmhub: http://www-01.ibm.com/support/docview.wss?uid=swg21958925

In addition to steps in the above documentation, the planning.html, pmhub.html and tm1 directory (from the BI interoperability files) must be copied in the <Cognos Analytics 11>/webcontent/bi/ directory in the Cognos Analytics 11 gateway installation.