Configure the ConnectionsMetricsAdmin role on Cognos

Configure the ConnectionsMetricsAdmin role in Cognos Business Intelligence to ensure the Metrics administrator has access to features and reports.

The default custom authentication provider is configured automatically in Cognos during installation and configuration. When configuring the ConnectionsMetricsAdmin role, we must be logged in using the Cognos administrator account specified during Cognos installation. If the Cognos administrator cannot view and add other users, consult the LDAP administrator.

After configuring LDAP authentication for Cognos Business Intelligence, configure the ConnectionsMetricsAdmin role so that specified LDAP users can access Cognos features. In particular, you will want to add the following users to this role:

• The user assigned to the Cognos administrator account

  The Cognos administrator is the primary person responsible for configuring Cognos features and reports.

• All users who have been assigned to the admin role for Connections

  Anyone tasked with administering the Connections deployment should have access to Cognos features to ensure they can manage the full deployment as needed.

• All users who have been assigned to the metrics-report-run role

  Users who have been authorized to run global metrics reports require access to Cognos before they can work with the reports. We can also add these users to ConnectionsMetricsReader role instead, if you do not want the users to become administrators of Cognos BI.

1. Set cognos.admin.username as an administrator for WAS :

   This setting should have been configured automatically by the Cognos Installation Wizard. Check the setting in the dmgr Console. Only perform the following steps if the Cognos administrative user cannot be found in the Administrator role of DM.

   1. Start the dmgr, log into the dmgr, and go to...
      Users and Groups | Administrative user roles | Add | Administrator

   2. search for the user...
      cognos.admin.username

      ...which is specified cognos-setup.properties.

   3. Select the target user and click the move button to move the user name to the Mapped to role field.

   4. Click OK and then click Save.

   5. Log out of the dmgr.

   6. Restart the dmgr and the nodes.

   7. Restart Cognos server.

   8. Log into the dmgr using...
      cognos.admin.username

      Verify the user can search for users and groups in WAS console.

2. Use a browser to navigate to the Cognos deployment with the following address:
   http://Host_Name:Port/Context_Root/servlet/dispatch/ext

   where:

   • Host_Name is the fully qualified host name of the Cognos server; for example, host.myco.com. This value is specified in the was.fqdn.hostname property in the cognos-setup.properties file used for installing the server.

   • Port is the port the Cognos server is listening on.

   • Context_Root is the context root to which you installed the Cognos server; for example, cognos. This value is specified in the ognos.contextroot property in the cognos-setup.properties file; its default value is "cognos".

3. Log in to Cognos using the Cognos administrator account set up previously.

4. On the next page, click Launch and then select IBM Cognos Administration.

5. Select the Security tab.

6. On the Directory page, select Cognos from the list.

7. Add users to the ConnectionsMetricsAdmin role:

   1. Locate the ConnectionsMetricsAdmin role and click the More button that follows it.

      By default the list displays 15 roles at a time. To see more roles, use the arrow keys to scroll through the list or edit the number of entries displayed at one time.

   2. Click the Set properties icon.

   3. In the properties window, click the Members tab, and then click Add.

   4. In the Add window, click Show users in the list.

   5. Select the directory named with the value specified in cognos.namespace in cognos-setup.properties file from the Directory list.

   6. Select all users who require administrator access to Cognos Business Intelligence, and click Add to add them to the role.

      Use the Search button to search for a particular user. Remember to add at least the following users:

      • The Cognos administrator

      • All Connections administrators

      • All users assigned to the metrics-report-run role

      If a folder icon displays next to a user’s name and we cannot select that user, this may indicate the Cognos is treating the user as a folder instead of as a user. For instructions on correcting this problem, see Troubleshooting the Cognos BI Server.

   7. Click OK to save the change.

8. Limit access to the System Administrators role by removing Everyone from the members list:

   1. Back in the Cognos roles list, locate the System Administrators role click the More button that follows it.

   2. Click the Set properties icon.

   3. In the properties window, click the Members tab.

   4. In the Members window, select Everyone, and then click Remove to delete it from the list of members.

   5. Click OK to save the change.

9. Disable the anonymous access for Cognos BI server using the Cognos Configuration tool :

   If the AIX or Linux server does not support a graphical user interface, refer to the sample in Configure HTTP manually for Cognos BI Server to see how to modify the Cognos configuration setting without a graphical user interface by editing the cogstartup.xml file.

   1. Navigate to the /bin64 subdirectory of the Cognos BI Server install directory, for example:

      • AIX or Linux: /opt/IBM/Cognos64/bin64/

      • Windows: C:.IBM\Cognos\bin64

   2. Start the Cognos Configuration tool ...

      • AIX or Linux: ./cogconfig.sh

      • Windows: cogconfigw.exe

   3. Expand Local Configuration > Security > Authentication > Cognos to set Allow anonymous access? to False.

   4. Click File > Save.

   5. Exit the Cognos Configuration tool, making sure to select No at the following prompt:
      The service 'IBM Cognos' is not running on the local computer. Before we can use it the computer must start the service. Do to start this service before exiting?

   6. Restart Cognos server.

   After completing this configuration, all users who can access the global metrics also become administrators of Cognos BI. If we are concerned about the Cognos security control to limit these Metrics users only to be able to view global metrics but not to have administrator rights for Cognos.

   1. Perform steps 3 through 7 to add the global metrics users who do not need to have administrator rights to the ConnectionsMetricsReader role instead.

   2. Repeat step 8 to remove these users from the member list of ConnectionsMetricsAdmin role.

Parent topic:
Configure Cognos Business Intelligence

Previous topic: Grant access to community metrics

Next topic: Configure PowerCube refresh schedules