Applying security in Cognos framework manager

Below are types of security in framework

● data security (p. 257)
You create a security filter and apply it to a specific query subject. The filter controls the data
that is shown to your users when they set up their reports.
● object security (p. 259)
You secure an object directly by allowing users access to the object, denying users access to the object, or keeping it hidden from all users. In case of Object level security user will still see the object , but cant access it
● package security (p. 261)
You apply security to a package and identify who has access to that package.

Setting up data level security for product line

1) I created 2 groups Mountain and Camping in cognos administration
2) Put both those groups under Author role
3)Put user A under Mountain and B under Camping group.
4) Click on product dimension and click on security filter
5) add filter like below
[Dimensional view].[Products].[Products].[Product line]  =[Dimensional view].[Products].[Products].[Product line]->[Products].[991]

----- product 991 is your camping equipment.I have dragged it from members
6)Publish the model
7)Create a simple list report by draging product line from product dimension
8)Login with User A and run the report
9)Login with User B and run the report




Object Level security

1) Specified by using Action menu.
2) The object still will be shown but user will not have access




User Permission in Cognos

1)If you have a folder and in that you have your reports saved.You need transverse permission to see the reports and go inside the folder.So transverse is must.
2)Execute is must if you want to execute the report
3)Read is must if you want to open the report in report studio4)
4)set policy is must if you want to give permissions .Without set policy you can see the security tab
5)Write is required if you want to delete a report

Roles in Cognos

The one idea that is to be kept in mind is role have predefined permissions which are not shown in capabilities.Like consumers have read permission to cognos report studio.


These roles already have capabilities defined. For list of initial roles and what are their capabilities refer cognos administration guide

Predefined Entries - page 298

If a user wants access to query studio ,Add the user as member of query user role
If a user wants access to Analysis studio ,Add the user as member of Analysis user role
If a user wants access to report studio ,Add the user as member of Author user role


Note -when a person is added as author they can only execute and tranvese report cant create them.Initially only report administrators have capability to create reports.

Scenario 2 

We want to show as below

Users from each branch are allowed to see the sales of their own branch and the aggregated total sales accross all branches - ``Branch(ALL)'' as Cognos calls it.
If we put a security filter on the Branch dimension or the Sales measure then we filter out all the data, so the aggregate value will only show one branch.
(At least that's what's gonna happen with a DMR model.)
What should we do? 

Got this question from below link 

http://unofficialcognostraining.blogspot.in/2008/02/data-level-security-filter-challenge.html

I am taking the example of product line and revenue .

Parameter map Example

Parameter maps are basically lookup tables .simple example would be getting the product information based on the environment variable there are some predefined macros that help you get the information about a parameter map

 There are 2 types of session parameters .
 1) Environment (defined by cognos) and
 2) Model (this we can create)

 runlocale and machine are two session parameters that need some more understanding parameter maps and session parameter are defined by using #$ (hash and dollar)

 Session parameters are macros available in either Framework Manager or in Report Studio that can be used to dynamically determine and display information about a user's session. This can be especially handy for general display purposes (such as a person's name) or for security implementation. [edit]Parameters

These are the session parameters available in 8.3. account.defaultName account.personalInfo.businessPhone
account.personalInfo.email
 account.personalInfo.givenName
account.personalInfo.surname
 account.personalInfo.timeZoneID
account.personalInfo.userName

The syntax to use this information in a report (say in a data item) is: #sq($account.defaultName)# Additionally, one of the most useful macros is: #CSVIdentityNameList()# which returns a list of all the groups a user is in (all namespaces). One way to use that to secure data is to put a filter on a query subject in Framework Manager with some data column looking up the person's groups to see if the row should be returned: [AD Security Group] in (#CSVIdentityNameList()#)

Cognos Application Firewall (CAF)

Got from Ironside group.
http://www.ironsidegroup.com/2010/01/29/understanding-the-cognos-application-firewall/

Basic idea

Firewall will analyse the HTTP and XML request before the gateway or dispatcher process them.

IBM Cognos Application Firewall (CAF) is a security tool used to supplement the existing IBM Cognos 8 security infrastructure at the application level. CAF analyzes, modifies, and validates HTTP and XML requests before the gateways or dispatchers process them, and before they are sent to the requesting client or service. It acts as a smart proxy for the IBM Cognos product gateways and dispatchers, and prevents the IBM Cognos 8 components from malicious data. The most common forms of malicious data are buffer overflows and cross-site scripting (XSS) attacks, either through script injection in valid pages or redirection to other Web sites.”

what is the gateway URI does .

Note -Cognos has dispatcher it does not have gateway .Gateway is a part of cognow web server.you can directly send request to dispatcher too  however for security reason a gateway comes into picture

How does it work?

Request Validation

The Cognos Application Firewall examines all URLs that originate or terminate within your installation of IBM Cognos 8. If a URL contains a host name that does not match those that were configured on the Environment page of your Cognos Configuration application, then it will be rejected by default. This is to prevent a scenario where a user may be unknowingly directed to a malicious site, or even a site that is masquerading as IBM Cognos where their login or personal information may be captured and later used to compromise the system.

Error Message Obfuscation

The CAF will prevent any non-administrative user from ever seeing the actual details of any error message generated by the system. Instead, the dispatcher will supply a numeric SecureError ID which can then be referenced by an administrator within the server log file in order to extract the true details of this error message. This prevents users from obtaining potentially damaging information from detailed error messages, which often contain application and database server names, as well as application or query information that could be used by a savvy hacker to develop a targeted attack that could compromise either IBM Cognos or potentially any of the systems with which it interfaces.

Parameter Signing

The CAF also provides parameter signing, where a unique key or signature is generated and appended to report parameters by the application when a URL is constructed. Those signatures are then checked by the dispatcher when it receives the request to ensure that it originated from a trusted source and were not tampered with between the client and the application.

How to run Active report without saving it

Hi Guys,

What i am looking for is running the active report from public folders by clicking on report name ,However if its a activer report it gives pop up box saying open or save .I do not want this .

Succesfully found solution in non prod environment .The solution does not work in production .If you have installed Cognso on your personal laptop .It will definately work .In production due to security setting it does not work 

A workaround I found. that works in my production(Might not work for you still give it a try)

1. Run the Active Report via Report Studio and get its URL from the browser.
2. Create a new dummy blank report ; Insert an HTML item that will redirect to the Active Report URL.

3) write a java script below in that HTML item to open the active report in same page so it looks like as if the active report is opening directly

<script language="javascript" type="text/javascript">
window.navigate ('your url from browser of report studio run')
</script>

Note . window.navigate will open url in the same page .If you use window.open it will open the URL in a new page .It will give you one blank page and one active report page so better use window.navigate

Now when the user runs the dummy blank report...it gives the effect of running the active report from the web.

Trying for solutoin in actual production environment as above solution wont work

This is your basic home page url

http://localhost/cognos10/cgi-bin/cognos.cgi?b_action=xts.run&m=portal/welcome/welcome.xts


The below is the main thing .Rest are parameters passed on what to do.you can modify them to get your work done

b_action= tells it to open cognosviewer
&ui.action =run
&ui.object =Which object to open that is your report'great_outdoors_sales'
Remember its cognosViewer (Notice upper case V there otherwise it does not work)

Actual URL

http://localhost/cognos10/cgi-bin/cognos.cgi?b_action=cognosViewer&ui.action=run&ui.object=/content/package[@name='GO Sales (analysis)']/interactiveReport[@name='active try']

The request will be rejected by firewall with below error

DPR-ERR-2079 Firewall Security Rejection CAF rejection details are available in the log.

An CAF error is displayed as prohibited characters are being passed on the URI such as single quotes ('). The URI should not include single quote characters. They should be encoded to avoid rejections by XSS filter.

Meaning

Cognos does not like the 'Go sales(analysis)' put there in single quotes need to encode it so that its not rejected

simple and Foolish workaround

Go to cognos configuration .Cognos application Firewall >CAF validation > set to false .This will turn off firewall

not in readable form

The URL that appears in the browser when active report is run is below.Notice that is not in readable form we cant make out what it is?


http://localhost/cognos10/cgi-bin/cognos.cgi?b_action=dc&f=b3V0cHV0MTMzNjQ1MDMwMzA_&k=FAAAADmDsJBUfOMFhpFvzzLV3SiDn-uIcf0QGb2PnicFKirWldTRmRTd6CI_&s=FAAAADmDsJBUfOMFhpFvzzLV3SiDn-uIbLwe7jr36ThFXYQHLmFt7cQuLN8_&did=1&viewer=true


To open as if openining from report studio .Notice teh ui.tool=reportstudio

http://localhost/cognos10/cgi-bin/cognos.cgi?b_action=cognosViewer&ui.tool=reportStudio&ui.action=run&ui.object=/content/package[@name='GO Sales (analysis)']/interactiveReport[@name='active try']

Some Powerplay transformer basics

3) Difference between native sql and pass through sql
a)Both native and pass through sql cannot refere to any parameters of cognos.Native sql is fired directly on database and hav to be self contained . same for pass through sql .It also cannot use data from multiple data sources defined in model.
try using native sql for two schemas which has grant priviledges
b)Pass through sql allows you to use statements that are not valid inside a subquery such as order by . IT will not pass the sql as a single sql but it will pass both the statements separate and join in cognos .THat is both the query and subquery will be sent separately and joined in the cognos
{} curly brackets denote Native SQL.
{{}} double curly brackets denote passthrough SQL.

Cognos models file extensions - pyg, pyh, pyi, mdl, pyj

The PYH and PYI models are compiled to a binary format and are Cognos series 7 version specific. IBM Cognos 8 uses a PYJ file format. Models stored in the binary format are generally quicker to open and refresh.
MDL (Model Definition Language) file format is a model saved in an ASCII file (its structure can be understood pretty easily). It is compatible between different version of transformer and can be edited in any text editor.
It takes more time to work with MDL files because when it is being opened, Transformer compiles it anyway in the background.

The biggest difference between PYI/PYJ and MDL file is that in the binary PYI file stores passwords to the datasources(usually database connections) and MDL file contains only an userid and password needs to be provided every time the cube is refreshed.

Problem solution:





In many cases, when users access cubes only locally with the PowerPlay client and there's no need to apply the security at all, it can be removed. To see if the security classes is applied, just have a look at the 'User classes' panel in the PowerPlay Transformer and check if there are any entries.

To remove security from the model and the cube go to File -> Model Properties... -> Authentication and uncheck the Include Acces Manager user classes in the model box.



To bring back the authentication classes choose the Access manager configuration from a dropdown list and drag & drop the corresponding user classes to the powercube area.





When the security should be applied in the cubes, then you must review the authentication. Have a look at the access manager, rebuild the user classes when propmptet and compare with PowerPlay clients installed on different machines.



To see the authentication settings go to configuration manager, open the current configuration and verify options in the Services -> Access Manager - Directory Server -> General menu.

----------------------------------------------------------------------



Check whether the model has a category with more than 65536 children in the source data. If this is the case, modify the source so that it breaks down the children into several subcategories.



-----------------------------------------------------------------------------------



How to run CognosScript macros written in CognosScipt



CognosScript programs (macros) can be written, run, debugged and tested in the CognosScript Editor which comes with the installation of Cognos PowerPlay.

The PowerPlay Macros are saved to a text format and have a mac extension. When the file is run it is automatically compiled to a binary file with has a mcx extension.

Once the script is saved, tested and works stable, it is very likely that there will be a need to run it from the command line. There is a program called runmac32.exe in the \bin\ cognos installation folder which makes it possible to run cognosscipt macros externally.



To run a cognos macro from the command line just type in the following at the command prompt:

"C:\Program Files\Cognos\cer3\bin\runmac32.exe" D:\script.mac



It is also possible to pass a parameter to the script (you'll find an example on how to read the parameter in CognosScript on our pages). It can be done by adding the parameter simply at the end of the command: "C:\Program Files\Cognos\cer3\bin\runmac32.exe" D:\script.mac string_parameter



--------------------------------------------------------------------------------------------------------



It is possible to drill through from PowerPlay to:



other PowerCubes

PowerPlay reports

Cognos 8 applications and Cognos Impromptu report

CognosScript macro files

Microsoft Office files(doc, xls, ppt)


Where to Find log files for Transformer.


Usually when you build a cube a transformer folder will be created in your my folders it has log folder under it 

Bulk loading of Screen tips in Framework

Hi Guys ,

The idea is to set a second language apart from english like french .Then set your active language to french and give a translation for french to english ,but while giving translation give translation only for screen tip and export the file. Then change back your active language again to english .So you have your screen tip property automatically updated

Below are the instruction that i copied from it toolbox .Check out the link present

http://it.toolbox.com/wiki/index.php/Bulk_Load_Screen_Tips_in_Framework_Manager

Instructions:

Below are step-by-step instructions.
Within FM, you must first create a screen tip for each item. In the screen tip property, type ST and then copy/paste the item name to identify it as a screen tip (e.g., ST Year). Properties without a value are not included in the export, so this step is necessary.

Note - Be careful this has to done before defining the second language.

Add a second language to the project. Project -> Languages -> Define Languages. Pick another language such as French to add to the project.
Change the active language to French.

Select the query subject for which screen tips are to be provided. It might be easiest to do one query subject at a time (e.g., select Product, continue with steps below, and then come back to this step for the next query subject). All the text items in the export file come out alphabetically arranged, so doing them one subject at a time gives better context for what the tip refers to. Try exporting a bunch of subjects at once and you’ll see what I mean.

Export a translation file containing both languages. Project -> Languages -> Export Translation File. In the dialog, export both languages. Specify selected objects (rather than all objects) and keep the Include Children check box checked. Navigate to a location where the file will go, provide a file name, and save as type CSV.

This is how it looks like

Open the file in Excel, update values in the English (en) column. Only those with the ST prefix need to be modified and replaced with a business description. Save and close the file. It might be convenient to show the published package to the business user so they can refer to the actual data as they are writing tips.

With the completed spreadsheet, go back in FM and select the same query subject that was used for the export. The active language should still be French (or whatever you selected in step 2).

Import the translation file. -> Languages -> Import Translation File. Specify translation from French to English. Specify selected objects and navigate to the updated CSV file, then click OK.

Change the active language back to English and review the screen tips.

Go back to step 4 and repeat for the next query subject.

When all tips are loaded, remove the additional language using Project -> Languages -> Define Languages.

Showing Text as measure in Crosstab

Hi Guys,

You will get this idea in IT toolbox .But that is not the point of noting this .Few things that i learned while trying

1) If you use define content property of crosstab it will override the measure values and you will be able to display whatever you have . Like placing measure twice .Helpful for conditional drill throughs .

2) If you select fact cells using ancestor button there is a property text source > source type you can specify it to be data item value you will see whatever the value is there of data item .By default it is set to cell value that is the cell that is the intersection of the rows and columns . however i think it wont display the the interseciton value in case you are calculation like

case when revenue >100 then 'YES' else 'NO' .It wont be able to display property yes and no values using this property

From IBM site

The method used to create this report was to add the measure as a nested data item under the columns, then change the Source Type property to Report Expression. After that define an expression that will calculate what text to show based on the value of the measure for that cell.

Do not add the measure to the crosstab corner or it will not work, it must be nested under the columns or rows. If you want to, you can set the Box Type property for the measure column header to None to hide it.