TM1 9.4.1 Security login Setup

[obriensh]

Hello, I has been tasked of getting TM1 setup up use either LDAP or integrated login because of SOX issues. I'm not entirely certain of the install but since this was done way before me or anyone on my team. They are using TM1 logins I'm assuming that TM1 security was chosen during the install.

Question being, can this be changed afterwards without uninstalling TM1 all together?
Reason being is when I try to use integrated login I get "Server refuses Integrated login,Integrated login has been set appropriately. Retry connection."

I have searched and dug through manuals to setup integrated security and even tried LDAP, etldap exports.
Cube properties have been set with rule to use <username>@<domain> and can view proper login id is set under the UniqueID field.
Config file has been changed to use Kerberos and NTLM and at one point had all the LDAP connection settings.
AD servers & TM1 server rebooted, AD properties for the service account checked.
Have used the same account with LDP tool to make sure it can authenticate and search AD objects.

Any suggestions???, as I'm at wits end here. Also complete uninstall and re-install is not an option at this time.

[qml]

We had a thread on this very subject recently. Have a look if anything in there helps.

[obriensh]

We had a thread on this very subject recently. Have a look if anything in there helps.

Yes, I looked over that thread several times and checking settings, user accounts. Since the fix for that thread was a reboot of the servers, I tried the same. Which leads me to believe there was something done during the install that is causing my issues? I did see in the admin guide that you had to do complete uninstall/install to change the Security Settings from the install wizard.
We are using Excel plugin, no web interface is installed so I don't that SPN would be an issue.

Can the security settings in fact be changed from the config file and still work without the uninstall/install?

[lotsaram]

I did see in the admin guide that you had to do complete uninstall/install to change the Security Settings from the install wizard.
We are using Excel plugin, no web interface is installed so I don't that SPN would be an issue.

Can the security settings in fact be changed from the config file and still work without the uninstall/install?

The admin guide would have you do a full uninstall/reinstall for many things for which there is no need, changing security mode being one of them.

[obriensh]

Ok, thanks for the info. This is just stumping me.

[tomok]

9.4.1 is pretty old so I can't remember all the details but there was a version in the past that you had to check "Use Integrated Login" during the install or it wouldn't work just changing the tm1s.cfg setting. I think there must have been some drivers, DLL's, etc. that weren't installed unless you picked it. I think they changed that in 9.5. I had situation around 5 or 6 years ago where a client changed their mind to use integrated login and we had to uninstall/re-install to get it to work. I'm presuming a uninstall is out of the question because you no longer have the install package? Bummer. If you have the package you can try installing on a different box and comparing the DLL's and registry to see what's different.

[obriensh]

9.4.1 is pretty old so I can't remember all the details but there was a version in the past that you had to check "Use Integrated Login" during the install or it wouldn't work just changing the tm1s.cfg setting. I think there must have been some drivers, DLL's, etc. that weren't installed unless you picked it. I think they changed that in 9.5. I had situation around 5 or 6 years ago where a client changed their mind to use integrated login and we had to uninstall/re-install to get it to work. I'm presuming a uninstall is out of the question because you no longer have the install package? Bummer. If you have the package you can try installing on a different box and comparing the DLL's and registry to see what's different.

hummm, this is what I was not looking forward to. I do have the installation media along with the fix pack that is currently installed. Guess I will need to research the best way to uninstall/install without dumping all the data and users, plus all the change control docs that would need to be done.

[qml]

Guess I will need to research the best way to uninstall/install without dumping all the data and users, plus all the change control docs that would need to be done.

The software is separate from the models, so you can uninstall/re-install it without affecting your data and users in any way. Your admin host service along with all TM1 services will need to be down for the time you run the installer, but that is really not a biggie with 9.4 where installation only takes a few minutes (with 10.x it's an order of magnitude more).

[lotsaram]

hummm, this is what I was not looking forward to. I do have the installation media along with the fix pack that is currently installed. Guess I will need to research the best way to uninstall/install without dumping all the data and users, plus all the change control docs that would need to be done.

Sounds like you are new to TM1 administration, and while being diligent in researching what to to have overlooked a few key things! All is not as dark and gloomy as you might think. Just to back up or put another spin on what qml has said un installing and reinstalling TM1 does not dump data and users! Yes there may be a period of time during the install when the production environment will be unavailable but the contents of the server data directory where all cube data and user infos are stored will remain exactly as is and can be re-connected to after the install by users just like before. (that is provided no one does anything stupid like wipe C and D drives, reinstall the OS, etc.) Should really be no big deal apart from the downtime, but enabling integrated login is a significant change so this should be able to be planned for and communicated, again no big deal.

[obriensh]

Hey all, I just wanted to post the actual fix for my issue, just in case it helps someone one day.
After talking with IBM support and making changes and what not without success. At one point we changed the default Client message port from the default and we noticed the setting was not showing like they should (using netstat cmd).
After checking a clean Tm1server.log, there is was sticking out like a sore thumb. The configuration directory was pointing to c:\Windows folder and not the TM1 Data folder's config file. Made changes to the newly discovered config file, restarted services and all went as it should have. I had done a search for tm1s.cfg files early in the troubleshooting process on the dive that application was installed on, it just so happens it was not on the C: drive.