Assigning capabilities

[dougp]

My concept of feature permissions is very simple.  I have three types of users:  viewers (can navigate and run reports and dashboards), developers (can create and edit reports, dashboards, datasets, data modules), and administrators (administration, Framework Manager modeling).  This is managed through "capabilities".

The capability assignments (permissions) appear to be available only from the perspective of the capabilities.  That means I must inspect and adjust all 113 capabilities.  This complexity nearly completely ensures that I'll always be out of compliance with my licensing.

Is there a way to manage capability assignments from the perspective of roles?  Then I can simply make sure all appropriate boxes are checked for each of 3 roles.

[MFGF]

My concept of feature permissions is very simple.  I have three types of users:  viewers (can navigate and run reports and dashboards), developers (can create and edit reports, dashboards, datasets, data modules), and administrators (administration, Framework Manager modeling).  This is managed through "capabilities".

The capability assignments (permissions) appear to be available only from the perspective of the capabilities.  That means I must inspect and adjust all 113 capabilities.  This complexity nearly completely ensures that I'll always be out of compliance with my licensing.

Is there a way to manage capability assignments from the perspective of roles?  Then I can simply make sure all appropriate boxes are checked for each of 3 roles.

Hi Doug,

IBM introduced roles that reflect the license levels available (eg Analytics Viewer, Analytics Users, Analytics Explorers, Analytics Administrators) that are already tied in to the correct capabilities for each license. The idea was to make it simpler to ensure that users have the correct capabilities for the license they own. I would be looking at utilizing these roles for your users, rather than adding individual capabilities for each.

Cheers!

MF.

[dougp]

Thanks.  I'll take that as a "No."

I needed to customize some capability assignments.  For example, some folks needed the Report Studio > User Defined SQL capability, but most should not have it.  IMO For ad hoc reporting and data exploration, most Analytics Users should be able to create reports using the standard UI elements -- given appropriate data security has been implemented in the models -- but only a handful of highly-skilled users should also be able to write custom SQL to handle things Cognos doesn't do well natively, like recursive CTEs.  Granting that capability to all Analytics Users allows curious report developers with little or no SQL coding skills to wreak havoc on the database server.

That may be a poor example since the capability is implemented wrong.  I figure only certain people should be able to develop reports using raw SQL, but everyone should be able to run reports developed in that manner.  Unfortunately, if you can't create a report using raw SQL, you also can't run a report that uses that feature.  I ended up having to enable the capability for all Analytics Users.  Risky.

[dougp]

If I wanted to revert to the default role/capability assignments, is there a documented process to reset.

[MFGF]

Thanks.  I'll take that as a "No."

I needed to customize some capability assignments.  For example, some folks needed the Report Studio > User Defined SQL capability, but most should not have it.  IMO For ad hoc reporting and data exploration, most Analytics Users should be able to create reports using the standard UI elements -- given appropriate data security has been implemented in the models -- but only a handful of highly-skilled users should also be able to write custom SQL to handle things Cognos doesn't do well natively, like recursive CTEs.  Granting that capability to all Analytics Users allows curious report developers with little or no SQL coding skills to wreak havoc on the database server.

That may be a poor example since the capability is implemented wrong.  I figure only certain people should be able to develop reports using raw SQL, but everyone should be able to run reports developed in that manner.  Unfortunately, if you can't create a report using raw SQL, you also can't run a report that uses that feature.  I ended up having to enable the capability for all Analytics Users.  Risky.

Hi Doug,

In that situation, I would leave the standard role for Analytics Users as-is, and add a new role that has just the capability for User Defined SQL enabled. For any of the highly-skilled users that need the SQL functionality, add them to both the Analytics User role and to the new role - they will get the sum of the capabilities from both.

Cheers!

MF.

[MFGF]

If I wanted to revert to the default role/capability assignments, is there a documented process to reset.

Not that I know of, sadly.

MF.

[dougp]

One more thing...

Is there a way to reset my license usage counts (Manage > Licenses)?  It looks like I have a few hundred users who last logged into Cognos over 2 years ago.

[sdf]

@dougp

The license usage depends on the current user profile count. So as long as the user profile exists, they will be counted and exist in the license count.




sdef