Save the rights of a Contributor Application via TI

Post Reply
Okamasu
Posts: 12
Joined: Thu Sep 13, 2018 12:38 pm
OLAP Product: IBM Cognos TM1
Version: 10.2
Excel Version: 2010

Save the rights of a Contributor Application via TI

Post by Okamasu »

Hello,

I'm a consultant working on a 10.2 Cognos TM1 application. (So I don't have access of the data folder or the batch or Cognos BI Portal)
I have a Business process that I have to do frequently to create new elements in a dimension used in Contributor.
So my current process is :
1. TI to create the elements
2. Update the approval hierarchy
3. Go to Contributor to save the security on the applications
4. Refresh security of the instance

I want to cut short this process so that I have only 1 TI to launch and it does everything.

But here is my question for you guys :
Is it possible to just "save the rights" of a contributor application to refresh it and apply it on the new elements of the approval hierarchy ?
I searched for a bit and the only thing I saw was to redeploy the application with batch files launched via a TI.

Thank you in advance for your answers
User avatar
Elessar
Community Contributor
Posts: 331
Joined: Mon Nov 21, 2011 12:33 pm
OLAP Product: PA 2
Version: 2.0.9
Excel Version: 2016
Contact:

Re: Save the rights of a Contributor Application via TI

Post by Elessar »

Hi,

You are lucky, because TM1 Applications Maintenance utility was introduced in 10.2 =)
https://www.ibm.com/support/knowledgece ... ation.html

The 3rd point can be performed by creating a file with security rights and importing it using AMU:
https://www.ibm.com/support/knowledgece ... stool.html
Best regards, Alexander Dvoynev

TM1 and Data Science blog: 6th article - PAfE + VBA: Commit each cell without pressing “Commit” button.
Okamasu
Posts: 12
Joined: Thu Sep 13, 2018 12:38 pm
OLAP Product: IBM Cognos TM1
Version: 10.2
Excel Version: 2010

Re: Save the rights of a Contributor Application via TI

Post by Okamasu »

Elessar,

Thank you for your answer.

These are the links I saw before posting.
My question was about if it was possible to do the fifth step without using a "ExecuteCommand" to launch a .bat.

If it is really not possible I'll search a way to use the .bat
babytiger
Posts: 78
Joined: Wed Jul 31, 2013 4:32 am
OLAP Product: Cognos TM1, EP, Analyst
Version: 10.2.2
Excel Version: 2013
Location: Sydney AU

Re: Save the rights of a Contributor Application via TI

Post by babytiger »

Yes, you can refresh/save rights of a Contributor Application via TI.

I've done that for a few contributor apps for multiple clients.

1. You need to find out which apps (assuming you have multiple apps that use different approval dim/subsets). You can get all the info via "}tp_applications". It should give you approval dim, shadow dim, approval subset etc.

2. Once you've added/deleted elements of the approval dim, update of shadow dim using }tp_deploy_create_shadow_dimension process.

3. With security updates, there are multiple security cubes you need to update (depending on your contributor app configuration):
  • }CellSecurity_}tp_application_permission}sAppID
  • }ElementSecurity_}tp_application_permission}sAppID
  • }ElementSecurity_ApprovalShadowDim
  • }tp_task_security} | cubes (that matches your appID)
  • }tp_rights_update_RDCLS_static_rights
  • there may be more security cubes involved, depending on your setup.
The problem (or drawback) is, you can only use one method for each app. Meaning, you can use TI method, or manual security load via Performance Modeler. Not recommending to combine the methods. It gets very confusing.

I prefer the TI method, because it reduces manual intervention, less human error.
MK
Okamasu
Posts: 12
Joined: Thu Sep 13, 2018 12:38 pm
OLAP Product: IBM Cognos TM1
Version: 10.2
Excel Version: 2010

Re: Save the rights of a Contributor Application via TI

Post by Okamasu »

Thank you very much babytiger, I will try it !
Okamasu
Posts: 12
Joined: Thu Sep 13, 2018 12:38 pm
OLAP Product: IBM Cognos TM1
Version: 10.2
Excel Version: 2010

Re: Save the rights of a Contributor Application via TI

Post by Okamasu »

Hello again,

I have another question on this subject, is it possible to create rules for the Contributor's security as you'd create rules for Perspective's security ?
I'm asking this since it is not possible to have dynamic approval subset for Contributor.

Thank you in advance !
babytiger
Posts: 78
Joined: Wed Jul 31, 2013 4:32 am
OLAP Product: Cognos TM1, EP, Analyst
Version: 10.2.2
Excel Version: 2013
Location: Sydney AU

Re: Save the rights of a Contributor Application via TI

Post by babytiger »

The security cubes I've mentioned in my post behaves the same way as other security cubes in TM1. So, you can apply rules to those cube if you want. Just need to make sure you trigger a security refresh after update of approval dim. Because ruled security doesn't take effect straightaway, it is different to static values.
MK
Okamasu
Posts: 12
Joined: Thu Sep 13, 2018 12:38 pm
OLAP Product: IBM Cognos TM1
Version: 10.2
Excel Version: 2010

Re: Save the rights of a Contributor Application via TI

Post by Okamasu »

Thank you again for your answers, i'll try some things and when I'm finished I'll put here my method.
Okamasu
Posts: 12
Joined: Thu Sep 13, 2018 12:38 pm
OLAP Product: IBM Cognos TM1
Version: 10.2
Excel Version: 2010

Re: Save the rights of a Contributor Application via TI

Post by Okamasu »

Hello Again,

I think i miss something somewhere but dunno what. I must confess i'm not really understanding well what the Cognos' script do.

My script update perfectly fine the dimensions and the approval subset.
I created rules for the security cubes so that I don't have to think about it.
But the scripts to update the security....
Would you be so kind to explain to this novice that I am where I am wrong in these lines ?

Code: Select all

### Update the security of Contributor ###
ExecuteProcess('}tp_deploy_create_shadow_dimension', 'pExecutionId', 'None', 'pAppId', 'MyAppId', 'pApprovalDim', 'MyApprovalDim', 'pApprovalSubset', 'MyApprovalSubset', 'pSubsetAlias', 'None', 'pIncrShadowDimUpdate', 'Y');
ExecuteProcess('}tp_deploy_create_shadow_dimension', 'pExecutionId', 'None', 'pAppId', 'MySecondAppId', 'pApprovalDim', 'MySecondApprovalDim', 'pApprovalSubset', 'MySecondApprovalSubset', 'pSubsetAlias', 'None', 'pIncrShadowDimUpdate', 'Y');

ExecuteProcess('}tp_rights_update_RDCLS_static_rights', 'pExecutionId', 'None', 'pAppId', 'MyAppId', 'pCube', 'None', 'pApprovalDim', 'MyApprovalDim', 'pUpdateSubset', 'None', 'pVersionDim', 'None', 'pGroupsDim', '}Groups');
ExecuteProcess('}tp_rights_update_RDCLS_static_rights', 'pExecutionId', 'None', 'pAppId', 'MySecondAppId', 'pCube', 'None', 'pApprovalDim', 'MySecondApprovalDim', 'pUpdateSubset', 'None', 'pVersionDim', 'None', 'pGroupsDim', '}Groups');
I honestly don't understand much when I try to look into these scripts with how they are not commented and all.

Thank you very much in advance
babytiger
Posts: 78
Joined: Wed Jul 31, 2013 4:32 am
OLAP Product: Cognos TM1, EP, Analyst
Version: 10.2.2
Excel Version: 2013
Location: Sydney AU

Re: Save the rights of a Contributor Application via TI

Post by babytiger »

Sorry if my original post was a bit brief and/or confusing.

Just want to clarify a couple of things:
  1. TI: }tp_deploy_create_shadow_dimension - This TI replicates your ApprovalDim to a shadow dimension, eg. }tp_task}....... This TI doesn't have anything to do with security.
  2. TI: }tp_rights_update_RDCLS_static_rights - I never had the need to run this TI. If you are referring to my original post, I was meaning the cube that you need to update. If your application(s) are using ElementSecurity, as oppose to CellSecurity, then you probably won't find this }tp_rights_update_RDCLS_static_rights cube. It is used as the source for updating '}tp_intermediate_RDCLS}' | Cube.
Since your security cubes are ruled, here are the steps I would suggest:
  1. Update Approval Dim (your existing TI/process, no change required)
  2. Update of Approval Dim subset (your existing TI/process, no change required)
  3. Update shadow dimension(s), using TI: }tp_deploy_create_shadow_dimension
  4. Refresh security using : SecurityRefresh;. Because ruled security will not take effect until you perform a security refresh, or restart the TM1 server instance.
MK
Okamasu
Posts: 12
Joined: Thu Sep 13, 2018 12:38 pm
OLAP Product: IBM Cognos TM1
Version: 10.2
Excel Version: 2010

Re: Save the rights of a Contributor Application via TI

Post by Okamasu »

Hello,

I applied the method you told me and it seems to work.

I just had one issue : I had to apply the new security on the contributor's application once after launching the script for the first time.
When I tried my TI for the first time, the contributor told me that the dimension wasn't available or something like that. I applied the security via contributor, then launched again my TI with a new approval subset and it worked perfectly fine.

Thank you very much for your help babytiger !
Okamasu
Posts: 12
Joined: Thu Sep 13, 2018 12:38 pm
OLAP Product: IBM Cognos TM1
Version: 10.2
Excel Version: 2010

Re: Save the rights of a Contributor Application via TI

Post by Okamasu »

Welp, I guess my tests weren't good enough since what I implemented has multiple problems.
I'll continue to search how to correct my things and will update this post.
Okamasu
Posts: 12
Joined: Thu Sep 13, 2018 12:38 pm
OLAP Product: IBM Cognos TM1
Version: 10.2
Excel Version: 2010

Re: Save the rights of a Contributor Application via TI

Post by Okamasu »

Finally I have resolved my issue.
I was putting an MDX on my approval subset and then passing this same subset as static in the prolog of my TI. Because of the way the TI works, it was conflicting and not working properly.
I passed the second step (dynamic subset to static substep) in the epilog with all the other steps after it and it works perfectly fine !

For future reader which want to know how I did it :
I have a TI which in the prologue launch another TI to update my dimension with new elements from a file.
Still in the prologue, I add a MDX to modify the subset used for Contributor.
In the Epilog I transform my subset now dynamic as a static subset.
Still in the Epilog I launch the script }tp_deploy_create_shadow_dimension with my different parameters.
And finally I have a SecurityRefresh.

Easy peasy lemon squeezie.

Thanks again for the help !
Post Reply