Express 64 - Admin can't create objects in Xcelerator (TM1)

[rollo19]

Administrator has no rights in CXMD to create objects or manage security. Anyone come across this?
I had cleaned out all non-control objects from CXMD data directory before adding another data directory. Perhaps I deleted something I shouldn't have (no errors or warnings)

[Herman Moller]

The security side of express can be a pain.....

How I see express security working is the following:

1) User sets up the initial security for Cognos Express Manager world. Sets up the user and the groups
2) User sets up internal TM1 Security in the good old fashioned way of right click on Tm1 server and selecting the security fields by following the same structure as 1)

Things that you can look at to try and solve your problem:

- Check that the security group in 1) is the admin group. I dont have express near me but do you have a Express Xcelerator Adminstrator?
- Try looking at the TM1 security to see if you are a Admin user
- Are you logging in as Cognos Express Security or some form of AD? I found trying to log in as AD could be tricky.

HTH

Herman

[dkleist]

I haven't seen that error, but I did give up a while back on CX when I realized I could not get a second data directory (service) to work.

I didn't bother digging around to verify, but it seemed that CX is constructed to allow only the CXMD data directory/service. Cannot verify and didn't bother -- it would seem some hooks and hacks are under the hood (okay, bonnet <g>) to achieve/manage the integration.

[rollo19]

Cheers Herman
All components installed
Yes user set up via Express security in the Admin group with access to all components
In Architect if I right click security, the options are grayed out - so that's no security options or ability to create objects rights
Looking in }ClientGroups the CAM Admin users added by Express don't belong to TM1 SeurityAdmin or DataAdmin groups (and I can't edit that).

The second data directory does seem to work - thought that was a nice compromise to the single server (ahem thread) limit. Add a semi colon with no spaces e.g. DataBaseDirectory = C:/IBM/Cognos Express/Xcelerator/Custom/TM1Data/CXMD;C:/Your model data directory with no conflicting objects. I think all you need in the second data directory is:
[TM1S]
ServerName=
DataBaseDirectory="..
AdminHost=
PortNumber=
Protocol=TCP

To verify that it wasn't a control object I'd inadvertently deleted, I threw the original sample data directory back in there and re-started. Same issue - can't edit security, or create objects.

In theory, adding users to Express is dead easy but ironically enough, Enterprise TM1 under C8 CAM security with some external security source might be easier.. you know what's going on under the hood Logged it with support, will post the outcome

[Martin Ryan]

Not sure if it's still required with the new Express setup, but do you have the tm1p.lic file in the right directory? In vanilla TM1 a user can have admin rights, but if they don't have the Perspectives licence they only get Client functionality, which means no rights over security or adding or deleting objects.

Not sure if it's relevant though as I think the symptom of that is not that they options are greyed out, but rather they simply aren't there.

Martin

[rollo19]

-

[Martin Ryan]

Vanilla TM1 requires tm1p8.lic to be in the C:\Windows (I think, maybe it's in the Documents and Settings folder along with tm1p.ini) of the client's PC. It's different from tm1s.lic.

Martin

[belair22]

Vanilla TM1 requires tm1p8.lic to be in the C:\Windows (I think, maybe it's in the Documents and Settings folder along with tm1p.ini) of the client's PC. It's different from tm1s.lic.

Martin

The TM1p8.lic requirement was removed in 9.1SP4 and above (however it's not documented) - administration access is controlled by TM1 security.

[Michel Zijlema]

Vanilla TM1 requires tm1p8.lic to be in the C:\Windows (I think, maybe it's in the Documents and Settings folder along with tm1p.ini) of the client's PC. It's different from tm1s.lic.

Martin

The TM1p8.lic requirement was removed in 9.1SP4 and above (however it's not documented) - administration access is controlled by TM1 security.

According to this information from IBM the tmp18.lic is still required in version 9.4 (which Express uses).

Michel

[kangkc]

Most likely the Cognos Express Administrator is not part of the Admin group. Have this problem a few time especially if you develop the models from a TM1 environment and port it over to Cognos Express as CX uses CAM for authentication.

What I do is to switch the security mode from 4 to 2, login using TM1 security (the good old TM1 Admin), associate the Cognos Express Administrator to the Admin group, switch security mode back to 4, restart.

Did about two implementations, always get the same issue and resolve by the same method above.

[stephen waters]

The TM1p8.lic requirement was removed in 9.1SP4 and above (however it's not documented) - administration access is controlled by TM1 security.

Not correct, you need the TM1p8.Lic file up to at least 9.4 to run as perspectives rather than client.
The 9.4 splash screen is confusing since it now says "TM1 Perspectives " even if you are running as client, unlike earlier versions which had either client\perspectives. However the Windows title bar on server explorer still tells you what mode you are running in.


You are probably confusing it with the move away from customised license keys for both server and perpsectives that happened some time in 9.1.

[stephen waters]

I didn't bother digging around to verify, but it seemed that CX is constructed to allow only the CXMD data directory/service. Cannot verify and didn't bother -- it would seem some hooks and hacks are under the hood (okay, bonnet <g>) to achieve/manage the integration.

I think this is because CX is designed and licensed to be used for a single application, if you want to use multiple unlinked servers you are meant to buy another instance of CX, if you want too link\access multiple servers you are meant to buy Enterprise TM1. There may well be a back door way of getting round this but it might not be allowable under your license.

[rollo19]

Most likely the Cognos Express Administrator is not part of the Admin group. Have this problem a few time especially if you develop the models from a TM1 environment and port it over to Cognos Express as CX uses CAM for authentication.

What I do is to switch the security mode from 4 to 2, login using TM1 security (the good old TM1 Admin), associate the Cognos Express Administrator to the Admin group, switch security mode back to 4, restart.

Did about two implementations, always get the same issue and resolve by the same method above.

That'll do it kangkc thanks. An obvious one really, guilty of assuming Express Manager was all pre-configured to add Administrative & Xcelerator users to TM1 'Admin' group!

[belair22]

The TM1p8.lic requirement was removed in 9.1SP4 and above (however it's not documented) - administration access is controlled by TM1 security.

Not correct, you need the TM1p8.Lic file up to at least 9.4 to run as perspectives rather than client.
The 9.4 splash screen is confusing since it now says "TM1 Perspectives " even if you are running as client, unlike earlier versions which had either client\perspectives. However the Windows title bar on server explorer still tells you what mode you are running in.


You are probably confusing it with the move away from customised license keys for both server and perpsectives that happened some time in 9.1.

Stephen - you are correct the TM1p8.lic requirement is STILL required (I stand corrected), HOWEVER the install AUTOMATICALLY pushes the file onto every client PC in 9.1SP4 and above (this was not the case in 9.1SP3). That means every client is BY DEFAULT a full blown PERSPECTIVES user. Under older versions of TM1 it was necessary to copy the TM1p8.lic into C:\Documents and Settings\<username>\Application Data\Applix\TM1\ in order for this access.
Noticed this when deploying SP4 to a new client 1-2 years ago and contacted IBM for confirmation.

Back to the quote above from MARTIN : The point I had attempted to make is there is no need to manually move these files any longer hence this is unlikely to be the cause of the issue.

From memory the move away from "customised licence keys" was also in the same version (9.1SP4) - suggest quite a few major changes were made in this 'minor' revision.