Setting up Framework Manager for Cognos Analytics on Cloud Dedicated

Resolving The Problem

Framework Manager installation

Steps:

1. Download and install Framework Manager the traditional way.
   Download link for 11.0.x: https://<CognosOnCloudURL>/p2pd/fm/model_bi.zip
   Contact support for FM version 11.1.2+ if your Cognos Analytics environment is on 11.1.x.
2. For 11.0.x replace the security policy JAR files (in the <FM Install path>\jre\lib\security folder or in the \jre\lib\security of your specified JAVA_HOME location with the unrestricted versions of them. The policy files can be downloaded from: https://public.dhe.ibm.com/ibmdl/export/pub/systems/cloud/runtimes/java/security/jce_policy/
3. Note: In FM 11.1.3+ the policy files come with the installation. The policy files can be located in ..\ibm-jre\lib\security\policy\unlimited. Copy the local_policy.jar and the US_export_policy.jar files from <FM Install path>\ibm-jre\lib\security\policy\unlimited to <FM Install path>\ibm-jre\lib\security (For version 11.1.3 only the JRE folder is <FM Install path>\jre\...)
4. Note: In FM 11.1.7+ You do not need to manually import the SSL certificates. If you are on 11.1.7+ you can skip to Framework Manager Configuration of this document otherwise continue on.
   Prior to 11.1.7  SSL certificates must be imported into the local environment.
   Steps:
   Using Firefox browser, extract the ssl certificates from your environment url:
   11.0.x - https://<CA_CLOUD_NAME>.bi.ibmcloud.com/bi/
   11.1.x - https://<CA_CLOUD_NAME>.ca.analytics.ibm.com/bi/
   Note:
   (a) To extract the certificates, you need to click the lock icon on the left side of the url > Show connection details > More Information > View certificate > Details tab. Click “DigiCert Global Root G2” and export button. Save file with default options. Then, export also the “DigiCert Global CA G2".
   (b) Other browsers like Chrome offers multiple export formats, ensure it's "Base64 encoded".
5. Open Cognos Configuration once to create the required certificate files and then a command window as Administrator.
6. If you have not already set the JAVA_HOME variable, you must do so now. To do so, execute the following command:
   set JAVA_HOME=<Framework Manager install>\ibm-jre (or to the location of your JRE)
7. Change to the <Framework manager install>\bin directory
8. Execute the commands
   ThirdPartyCertificateTool.bat -i -T -r <path to certificate>\DigiCertGlobalRootG2.crt -p NoPassWordSet
   ThirdPartyCertificateTool.bat -i -T -r <path to certificate>\DigiCertGlobalCAG2.crt -p NoPassWordSet
   Note:
   Failures like the following can be ignored ...
   
   ... as long as the import itself succeeds, for example:
   Loaded CA certificate: '< your cert details>'
   Stored CA certificate(s).

Framework Manager Configuration

1. Launch Cognos Configuration and edit the Gateway URI and Dispatcher URI for external applications and set Encrypt data files to true.

11.0.x 
Gateway URI - https://<CA_CLOUD_NAME>.bi.ibmcloud.com:443/bi/v1/disp
Dispatcher URI - https://<CA_CLOUD_NAME>.bi.ibmcloud.com:443/bi/v1/disp

11.1.x
Gateway URI - https://<CA_CLOUD_NAME>.ca.analytics.ibm.com:443/bi/v1/disp
Dispatcher URI - https://<CA_CLOUD_NAME>.ca.analytics.ibm.com:443/p2pd/servlet/dispatch

2. Update the Cryptography. Set the Digest algorithm to SHA-512.

3. Update the Provider. Set the Confidentiality and PDF Confidentiality algorithms to 256-bit.

4. For IBM Cognos Analytics on Cloud version 11.0.6 or lower, set Supported cipher suites as shown:

For IBM Cognos Analytics on Cloud version 11.0.7 or higher, set Supported cipher suites as shown:

5. Save the configuration. A warning message indicating the certificate need to be trusted is displayed. Click [Yes] to accept the trust. 

6. Close Cognos Configuration.

7. Launch Framework Manager.