Trouble Shooting Report's Security Group

[gosoccer]

Hi everyone,

We have established the necessary Groups based on certain Filters in Framework Model for a single report. We used the specific Subject Query and assigned the Groups using the Action - Data Security option.

The security is working fine in one environment but when we move the same report to a different environment, it is not filtering the Subject Query and all the information is shown in the Prompt Page instead of only one State in this case.

Does anyone know how to trouble shoot this issue within the Report Author. We don't have access to Framework Model as a part of this environment unfortunately.

I just need to see the security (GROUPS we established) within the Report Author if possible. If not, to debug or get it from a log file that the GROUP is there in the report's package and there is some sort of LDAP BINDING failure of some sort.

if you could help with this issue, I'll greatly appreciate it.

Thx so much for your time :) :)

[MFGF]

Hi everyone,

We have established the necessary Groups based on certain Filters in Framework Model for a single report. We used the specific Subject Query and assigned the Groups using the Action - Data Security option.

The security is working fine in one environment but when we move the same report to a different environment, it is not filtering the Subject Query and all the information is shown in the Prompt Page instead of only one State in this case.

Does anyone know how to trouble shoot this issue within the Report Author. We don't have access to Framework Model as a part of this environment unfortunately.

I just need to see the security (GROUPS we established) within the Report Author if possible. If not, to debug or get it from a log file that the GROUP is there in the report's package and there is some sort of LDAP BINDING failure of some sort.

if you could help with this issue, I'll greatly appreciate it.

Thx so much for your time :) :)

Is Report Author one of your groups or roles, or do you mean Report Studio?

It sounds to me like the groups you are using are different between your two environments. Are they Cognos groups or LDAP groups? Are you using the same authentication provider in both, and are both configured with the same namespace settings?

There is a CSVIdentityNameList() macro function you can use in a report to see what groups and roles a user belongs to, but you can't see groups and roles your login isn't a member of.

You're going to struggle to see a full list of groups in anything other than the Administration Console. Can you get into this? Are the CAMIDs the same between the two instances?

MF.

[gosoccer]

Sorry,
Yes, Report Studio.

If we use the Data Security option in Framework Model (see attached) to add the groups, would that be Cognos GROUPS?
The actual Cognos BI Server environments are established using LDAP environment. I'm not sure if the LDAP environments are in
IBM and Oracle for the actual LDAP installation or not. I don't have an answer on this but will findout. "Are you using the same authentication provider in both, and are both configured with the same namespace settings?"

As for the Administration Console, I don't have access but I can get with the people who are running this environment.

I'll see what I can do with the CSVIdentityNameList() macro function. I take it I would create the Macro based on Query that goes after the
specific Subject Query? If you have an example, it would help me tremendously.

Thx so much, :) :)

[MFGF]

If we use the Data Security option in Framework Model (see attached) to add the groups, would that be Cognos GROUPS?

It could be either. It depends on which namespace you brought in the groups from. If it was the Cognos namespace they are Cognos groups. If it was the LDAP namespace they are LDAP groups.

The actual Cognos BI Server environments are established using LDAP environment. I'm not sure if the LDAP environments are in
IBM and Oracle for the actual LDAP installation or not. I don't have an answer on this but will findout. "Are you using the same authentication provider in both, and are both configured with the same namespace settings?"

As for the Administration Console, I don't have access but I can get with the people who are running this environment.

I'll see what I can do with the CSVIdentityNameList() macro function. I take it I would create the Macro based on Query that goes after the
specific Subject Query? If you have an example, it would help me tremendously.

Thx so much, :) :)

You can create a simple list report and create a query calculation that uses the expression #sq(CSVIdentityNameList ())#
This will list the groups and roles your user belongs to.

MF.

[gosoccer]

YES YES  :) :)That worked great and I can see the ONLY specific GROUP related to the individual user id (NH), so the question is if I have a bunch of state, do I need to filter the Query based on <STATE> in (#sq(CSVIdentityNameList ())#). Or what do you think?

It seems like the same Query does show only the NH State but it is not part of the actual Query Filter so the Prompt selection is showing all the states?

Thx so much!!!

[MFGF]

YES YES  :) :)That worked great and I can see the ONLY specific GROUP related to the individual user id (NH), so the question is if I have a bunch of state, do I need to filter the Query based on <STATE> in (#sq(CSVIdentityNameList ())#). Or what do you think?

It seems like the same Query does show only the NH State but it is not part of the actual Query Filter so the Prompt selection is showing all the states?

Thx so much!!!

That would probably work as a temporary fix, but the best and most robust solution is to get your FM modeller to fix the model so that you don't need to jump through these hoops every time you write a report.

Cheers!

MF.

[gosoccer]

Good point. If I may ask, what should be the same between what's inputted to the FM Model and LDAP?
Based on what you mentioned,

So the CAMIDs needs to be the same between the two Instances. Meaning the FM Model Cognos LDAP and
the Cognos BI LDAP that is used? Right?

Thx

[MFGF]

Good point. If I may ask, what should be the same between what's inputted to the FM Model and LDAP?
Based on what you mentioned,

So the CAMIDs needs to be the same between the two Instances. Meaning the FM Model Cognos LDAP and
the Cognos BI LDAP that is used? Right?

Thx

I assumed when you mentioned two instances that you have two different Cognos BI servers - is that the case? Or do you mean you have a single BI server and an FM install? Your last post above seems to imply this might be what you mean, but it's not clear.

If you have two BI Instances you need to make sure they are both using the same LDAP, and the configuration for each used the same values (eg the same namespace name).

If you have one BI instance, then FM will be configured to use this as its authentication too, hopefully.

MF.