standard users get invalid response

[Invisi]

We have a new Cognos environment, set up by our supplier. Our main users are in the group Analytics Administrators and can access the environment fine. When we want to add users, and we add them to the Cognos Group Analytics Users, they can't log in and get a message that includes 'Invalid Response'. We can't figure out what the issue is, as our admin users can log in and use the environment fine. Who will tell me what the source of this issue is?

[MFGF]

We have a new Cognos environment, set up by our supplier. Our main users are in the group Analytics Administrators and can access the environment fine. When we want to add users, and we add them to the Cognos Group Analytics Users, they can't log in and get a message that includes 'Invalid Response'. We can't figure out what the issue is, as our admin users can log in and use the environment fine. Who will tell me what the source of this issue is?

My guess would be permissions. Anyone who belongs to the Analytics Administrators role can see and do everything, regardless of what capabilities and permissions are defined. Anyone who doesn't belong to this role is governed by the capabilities and permissions set for their groups/roles. What permissions are defined for the Analytics Users role at the root of Team Content? What capabilities are defined for this role?

One other thing to mention... Analytics Administrator licenses are very (very) expensive, and it's unusual for an organization to hold more than a handful of them. I would be making sure that people who don't hold this license are not put into the Analytics Administrator role. If and when IBM's representatives come in to undertake an audit (or Software License Review) they will be looking very hard at who has currently and historically been logging in as an Administrator. If they find non-compliance, things can quickly get very expensive.

Cheers!

MF.

[Invisi]

Firstly sorry for the late response, I was abroad for a few days.

This is about a fresh install. The external consultant that configured the install seems to have forgotten or removed something that causes that people added are denied access. We put me and my colleague in the Administrator role so that we can log in and administer the environment. What I look for is in which Cognos group or role we have to put people or an AD group so that they can access the Cognos environment. Somehow it seems that something there is missing, at least compared to my Cognos 10 and Cognos 8 experience. The various Cognos groups and roles should have their default behaviour and permissions.

[MFGF]

Firstly sorry for the late response, I was abroad for a few days.

This is about a fresh install. The external consultant that configured the install seems to have forgotten or removed something that causes that people added are denied access. We put me and my colleague in the Administrator role so that we can log in and administer the environment. What I look for is in which Cognos group or role we have to put people or an AD group so that they can access the Cognos environment. Somehow it seems that something there is missing, at least compared to my Cognos 10 and Cognos 8 experience. The various Cognos groups and roles should have their default behaviour and permissions.

Did you get chance to look at what permissions are defined for the Analytics Users role at the root of Team Content and what capabilities are defined for this role?

MF.

[Invisi]

I don't know what you mean with the root of Team Content. Is that a capability?

[Invisi]

Sorry, you mean the folder Team Content, right? The Cognos here is in another language and I failed to recognise it at first. My first time seriously working with Cognos 11. Their core permission (?) is execute?

[MFGF]

Sorry, you mean the folder Team Content, right? The Cognos here is in another language and I failed to recognise it at first. My first time seriously working with Cognos 11. Their core permission (?) is execute?

I suspect this might be your problem. Unless Traverse is granted as well, users will not have privileges to see objects and navigate in Team Content and lower. I would grant a selection of "Read" (both Read and Traverse), "Run" (Read, Execute and Traverse) or "Write" (Read, Write, Execute and Traverse) to your groups and roles, depending what you want them to be able to do.

Cheers!

MF.

[Invisi]

Thanks again for the feedback.

*whine mode on* I really find the new interface totally crap. I want to update my language settings, but I miss a 'save' button and the changed languages are reverted to the old settings when I close my browser. Also the language changes are ignored. Also the settings you suggest seem impossible to do. Who invented this terrible GUI? *whine mode off*

I try to explain what I do as good as possible from my language, as the translations seem to be slightly off from what I read and expect in English.
1) I click Team Content
2) I click the Settings icon
3) I get 3 tabs, where the middle tab seem to be the permissions. There I see different roles and groups. Next to these groups I can select ONLY ONE permission of Read, Run, Write and what I would translate to 'trace', but seems to be full in English? Since I can select only one permission, I have no idea how or where to do what you propose. It's a drop-down list. For the group that contains the users, it's set to Run. Where to set Traverse?

[Invisi]

Anybody? Now our delivery stagnates because I insist that users test on this environment before reports go to production.

[sir_jeroen]

This error can also be caused by invalid permissions on your external namespace (e.g. active directory).
Please go to Cognos administration > security and check the permissions on your namespace

[Invisi]

Thank you for the tip. The permissions on the external namespace are 'Custom'. Clicking on Custom reveals it means deny on Read, Write, Execute, Traverse and Set Policy on the 'group' with the name of the namespace. It looks to me that the whole group is blocked? The Cognos namespace has 'Run' for Everyone and  'Full' for Directory Administrators. What I fail to understand is why we who are part of the Analysis Administrators group don't suffer from this block where users in other groups are denied access. I will put 'Run' as permission for the whole AD? I will try that and get back here with the result.

[Invisi]

Now when I let somebody try to log on, I get a different error. Now it is that verification failed. So changing the permissions on the root of the AD helps. I will change lower levels also.