Cognos 11.1.7 capability path

[Cognos91]

Has anyone had any issues with the secured functions for secured features being not showing up?
For example,
Report Studio, Query Studio, Dashboards are secured functions under Capability - Search Path = /capability/securedFunction[@name='Dashboard']
Each of these capabilities, may or may not contain secured features - such as Report Studio as Allow Bursting, User Defined SQL,Create/Delete etc.
The Search Path for which is: /capability/securedFunction[@name='Report Studio']/securedFeature[@name='User Defined SQL']

I would assume the same for capability Dashboard.
It contains a Secured Feature, named as Create/Edit
However the search path for which is: /capability/securedFunction[@name='Dashboard']/productCapability[@name='Create/Edit']
This seems new in Cognos 11.1.7 version.

When we tried upgrading from 11.0.13 to 11.1.7, we are noticing that the Dashboard - Create/Edit does not get installed. Our SDK code, is a simple one that pulls in all capabilities. Thus, all Secured Functions show up under My preferences > my capabilties.
When we pull in all secured features, the Create/Edit is left out.


Just a bit background - The Create/Edit feature for Dashboard capability was introduced in 11.1.4 version. This is what IBM site states for this secured function:
Create/Edit: This secured function controls access to the New > Dashboard and New > Story functions. Users require Execute permissions for the Dashboard and Create/Edit capability to both create or edit dashboards and stories.
Note: To administer this secured function, you must select Manage > People > Capabilities. You cannot administer this capability from the Administration console.

Any inputs/ know-how on how to tackle this part would be greatly appreciated.

[Cognos91]

Adding in more info to see if anyone has encountered this issue.

While working through, we found out that the list of capabilities under Cognos UI > Manage > People > Capabilities is different than the list of capabilities under Administration Console.
So you will not find the new capabilities such as AI, Email, etc listed under Administration Console.
Also, the new (or existing ones too) capabilities such as AI, Email (previously under Scheduling) all have new search path - \capabilities\productcapability\

The issue is that SDK can be used to update/modify the capabilities listed under Administration Console, and not Cognos Manage UI.

Cognos link (https://www.ibm.com/docs/en/cognos-analytics/11.1.0?topic=guide-capabilities) to administer the new search path based capabilities also mentions  that to .." To administer this capability and its secured functions, you must select Manage > People > Capabilities. You cannot administer this capability from the Administration console.."

So my question is if we cannot permissions to these capabilities via SDK, then is there a way to update the system.xml (under templates) or any xml files to automate the permissions for capabilities.
What I am looking for is: if a change is made on the Manage UI in front end, which xml file gets updated in the back-end? This way, a script can be generated to automate the permissions process via updating an xml file.

The other way would be REST APIs (but am not sure how to go about this).

Any insight would be helpful.

[dougp]

I have not had to deal with that from that perspective, but I do have a question:  Is this a general administration question, or is it an SDK question?  Is there any way to get to this other than through the SDK?

I'm using 11.1.7 (upgraded from 10.2.1 -> 11.0.4 -> 11.0.7 -> 11.0.13 with a few fix packs thrown in).  I see in Administration console | Security | Capabilities I can click on Dashboard (like I can on Report Studio) but the resulting page is empty.  Is that what you are asking about?

[Cognos91]

Yes, its a general administration question via SDK. I am trying to see if SDK would answer it (since we use it currently).

We are also upgrading from 11.0.13 to 11.1.7 LTS.

For Dashboard, under Administration Console | Security | Capabilities, you will see only Dashboard.
However, under Manage | People | Capabilities, you will not only see Dashboard, but also see Create and Edit.

Similarly, you will see, AI, Email under Manage | People | Capabilities. These are not displayed under the Administration Console list.

So there is clearly a mismatch between the capabilities list , listed under Manage UI and the list of capabilities listed under the Admin Console.

The issue is that the search path for these capabilities now reads as \capability\productcapability, and SDK does not read it.
The capabilities listed under Administration Console have their search path defined as \capability\securedfunction and if there are features under a particular function such as Report Studio > Bursting, it is defined as \capability\securedfunction(name=ReportStudio)\securedfeature (name=Bursting).

So, my question is will SDK help read the new \capability\productcapability path? (We have not had any luck so far).

If not, then what is the best option? Could we hack the xml file to define the permissions on the capabilities?
our goal is to automate the permissions and control capabilities via a script.