Question & Answer
Question
Why can I not get the report output in CSV , PDF , XML , and XLS format anymore with SDK API, Mashup Services requests and API , or with the SDK Applications code ? This all worked in a previous version of IBM Cognos 10.2.1 and below. How come a user can run a Report in Cognos Connection and get one of these output formats correctly , while using the REST / SOAP Mashup Request , SDK Application , or URL Request a failure is received back ? This happens also from Custom Portals, other WebServers , HTML Pages and other external to IBM Cognos Gateway or components that sent any URL , Mashup , SDK or HTTP Requests to the IBM Cognos Server.
Cause
These Report Output formats are now restricted , starting with the C10.2.2 release of IBM Cognos Software.
The Administrator of the system needs to explicitly set Allowed for an Authenticated User the canGenerateXXXOutput capability, where XXX stands for PDF , XLS , CSV or XML
Answer
New in version 10.2.2 are the output format restrictions for these outputs in the product.
See in the IBM Cognos Software Development reference below in Appendix Section New in Version 10.2.2
In IBM® Cognos® Business Intelligence, to manage system resources , administrators can now restrict the ability of users to run reports in the Cognos CSV (Microsoft Excel format) and XLS , PDF , and XML report output formats.
These report output formats are now separately secured Server side functions that control the format options that users can see and run in the user interfaces.
The Administrator can control with the following four capabilities , which User Account can run successfully retrieve these output formats :
canGenerateCSVOutput capability
canGeneratePDFOutput capability
canGenerateXLSOutput capability
canGenerateXMLOutput capability
It becomes currently very important that this is set up correctly in Cognos Connection Portal for the User Account by Administrators.
PROBLEMS :
The problem with not getting the Output for the User, will be present with existing applications under these conditions :
- Administrator has not set these capabilities for the specific logged on Authenticated User.
- If a "general logon" is used in the External Applications which not have been given these capabilities.
- if not the complete IBM Cognos Cookie values (there are 7 cookie parameters for Cognos) on HTTP or HTTPS requests are provided.
- Allowing users or applications to connect to IBM Cognos with the same "user" credentials, i.e. "Generic Logon"
- External Applications , Custom Portals , HTML Pages , ASPX and JSP Pages , SDK and Mashup Applications and even External Cognos Portlets all used in Custom Portals need to sent proper sequences of HTTP requests to avoid this issue.
Then if you have Mashup or SDK Applications that connect to IBM Cognos , they need to use the User Account as the User who is running the Report Requests for these outputs.
No more can a "generic user" being used as logon , if users are configured separately for these capabilities by the Administrator.
Software SDK Applications that have been made that use a "Generic User Account" require to be set up with these capabilities , to ensure that report output can be received back from the Report / Batch Report Service.
A side effect for such applications is that then ALL Users will have the same capabilities for this output generation , and that is very often not desired for the Business.
Therefore all External Mashup / SDK Applications should be made correctly , in that the User Credential , or the complete Cookie values for IBM Cognos are being used for Authentication , ensuring that reports are run "as that User with the right Capabilities".
In the SDK Software Application it is also possible to set these capabilities beforehand , when running reports.
External Applications to IBM Cognos Gateway and Cognos Connection
With Custom Portals or External Applications the problem will be that the Server Side capabilties for canGenerateXXXOutput may not have been propagated on the HTTP Header to the Session Cookies that exist externally for the user session.
It is then also not possible to sent a direct SDK URL API or Mashup API request that includes a Report Request for XXX Output and includes the Logon request as well.
The logon Request will work, but the Report Request for Output will be rejected by the Report Service with a Failure on these canGenerateXXXOutput capability , because the HTTP Header does not include these settings yet from the original request.
A refresh of the Browser Request subsequently , may get the output.
For Mashup Services this re-request from the browser does not work as RDS has received the error from the Report Service, and will not allow a re-request.
From External Applications , Portals and SDK / Mashup Application the solution is to sequence specific requests separately. For Example :
1. The Logon Request is emitted first. This sets up the session cookies in the Cognos Gateway. These will not include as of yet the canGenerateXXXOutput capabilities. The received HTTP Header back will have only the gateway session parameters at this point.
2. This HTTP Header should now be used for
Please consult the IBM Cognos Administration and Security Guide for further information , and the Cognos SDK Software Development Guide for the details on Capability.
Related Information
Was this topic helpful?
Document Information
Modified date:
24 February 2020
UID
swg21968364