Preventing output to Excel

[cccschip]

It's simple...we want to prevent most of our users from dumping data from Cognos to Excel spreadsheets.  We lose control of sensitive data (a security violation) and we find the behavior generally disabling in that users refuse to learn features of Cognos because they are "more comfortable" in Excel.

But how does one do this?

I've read many posts on this topic, but they always come up short and are too simplistic.  They tend to be all-or-none approaches.  Everyone can or everyone cannot.  Neither is acceptable.

Anyone out there have a reasonable approach for managing a user's ability to export to Excel in a flexible and dynamic manner?

I'm all ears!

[cccschip]

Wow...no responses!  Just back from vacation and was really hoping to have stirred up some thoughts.  Surely this is an issue with some/many of you.  any input will be appreciated.

[CognosPaul]

I've got about 3 hours free/ week these days; not as much time for interesting problems as I used to.

You probably already know that you can the system.xml to hide specific report formats and hide specific elements. I wrote a post about hiding elements that you normally can't hide. The xsl files have an if statement to check against the blacklist. If you can find the files that control the toolbars (report viewer and cognos viewer are likely to have different files), you could do the same thing.

[cccschip]

No need to apologize Paul, especially now that you've pointed out one possibility.  I was just expecting this to be an issue that many had dealt with.  Perhaps I'm wrong about that, but this has been a huge concern in both of the Cognos shops I've worked at.

As for your WordPress post, I lack access to that site...so cannot read it.

We do know where the pertinent elements are in the XML, but I do not know how to check against a blacklist.  Can anyone point me to more about that.  Remember, our goal is that management of the users who have Excel abilities is flexible and dynamic.  It cannot require outages to the Cognos system.

[bi4u2]

cccschip

You can modify the permissions to the 'Toolbar' capability (under Cognos Viewer). For instance if you take the Consumers group out of that capability, a Consumer can run a report but not get the Toolbar icons. This will prevent them from exporting to PDF as well, so you could make PDF the default run option on the report.

Cindy

[bdbits]

You can use groups in system.xml to filter toolbar items. So you could change membership in the group to change access to the toolbar items without an outage (other than the one for initial setup to modify system.xml).

Are you able to get to the support site? I think RV_TOOLBAR_BUTTONS_XLS is the one you'll want to modify.

http://publib.boulder.ibm.com/infocenter/cbi/v10r1m1/index.jsp?topic=%2Fcom.ibm.swg.ba.cognos.ug_cra.10.1.1.doc%2Fc_customizetheuserinterfacebasedongroupandrolemembership.html

DISCLAIMER: I only found this recently, and have not yet tried it. But it is officially documented, so not really a hack and should work.

[cccschip]

We found the direct (toolbar-based) approach insufficient.  Users still had ways to get around it...such as through the Run With Options dialog.

Altering the system.xml seems more complete and we'll have to review that suggestion more thoroughly.  But I have the feeling that we've already gone down that path and, again, found it lacking in some way. I just can't remember the problem.  Maybe something to do with Query Studio.  Maybe something to do with the fact that Excel output can be obtained through things other than UI elements.  Again, we'll have to review this.  I hope we just missed something in our first attempt with this approach.