Here is a guide I created when I configured TM1Web in my lab.
Note that I used TM1 10.2.2 FP1, Tomcat etc, bog standard TM1 install for my server components.
1. References Required
TM1 Service Account – Used to start TM1 services
TM1 Server Name – Machine on which TM1 will be running
TM1 Domain Name – Domain on which TM1 server and Clients will be active
Domain Controller Name – Name of machine used to authenticate users (KDC)
TM1 Install folder – e.g. C:\program files\ibm\cognos\tm1_64
2. Service Account
Identify the account being used to start the TM1 Admin Server and instances, mine is called TM1-SVC
Ensure all TM1 services are configured to use this account and that account has prescribed permissions.
3. }ClientProperties Rule
Create/Update the rule to add the domain to configured clients.
Code: Select all
SKIPCHECK;
#=====ADMIN=====
['Admin','UniqueID']=S:'GEOTON@MYDOMAIN';
#================
#=====GENERAL=====
['UniqueID']=S:!}Clients|'@MYDOMAIN';
#==================
FEEDERS;
Note: }ClientProperties set to use domain MYDOMAIN – MYDOMAIN.COM did not work!
4. TM1S.CFG
Update the TM1S.CFG to use Integrated Login with Kerberos
Code: Select all
IntegratedSecurityMode=3
SecurityPackageName=Kerberos
ServicePrincipalName=tm1s/TM1SERVER.MYDOMAIN.COM@MYDOMAIN.COM
Example:
setspn -U -F -S tm1s/myserver.example.com example\tm1s_plan
From the command prompt, running as administrator, enter the following:
Code: Select all
Setspn –U –F –S tm1s/TM1SERVER.MYDOMAIN.COM TM1-SVC
Probably a good place to restart services and check the you can log in using Integrated through Architect/Perspectives to ensure that the basics are working.
6. TM1Web_Config.XML
On the TM1SERVER, edit the following file:
<TM1 Install>\webapps\tm1web\WEB-INF\configuration\tm1web_config.xml
Locate the line that reads,
Code: Select all
<add key="IntegratedSecurityModuleName" value="LoginModule name"/>
Replace the value of this key with TM1SignedOnUserLoginContext if not already done.
The line should read:
Code: Select all
<add key="IntegratedSecurityModuleName" value="TM1SignedOnUserLoginContext"/>
Save and close the file.
7. TM1WebLogin.config
In a text editor such as Notepad or vi, create a new empty file and save it under the name TM1WebLogin.config as
<TM1 Install>\bin64\jre\7.0\lib\security\TM1WebLogin.config
In the text editor, create a new login context with a name of TM1SignedOnUserLoginContext and specify the JRE's JAAS Kerberos login module.
Note the option useDefaultCcache had been included to disable the default credential cache. For an IBM JRE the contents of the file should look like this:
Code: Select all
TM1SignedOnUserLoginContext {
com.ibm.security.auth.module.Krb5LoginModule required
useDefaultCcache=false
debug=true
credsType=initiator;
};
Open the following file
<TM1 Install>\bin64\jre\7.0\lib\security\java.security
Search for the text login.config.url. This should identify a snippet which looks like this:
Code: Select all
# Default login configuration file
#login.config.url.1=file:${user.home}/.java.login.config
login.config.url.1=file:${java.home}/lib/security/login.config
Replace the name of the file (login.config) in the line which is not a comment (does not start with a # character) with TM1WebLogin.config. The result should look as follows,
Code: Select all
# Default login configuration file
#login.config.url.1=file:${user.home}/.java.login.config
login.config.url.1=file:${java.home}/lib/security/TM1WebLogin.config
9. krb5.conf
Create a new file as
<TM1 Install>\bin64\jre\7.0\lib\security\krb5.conf
Update with the following:
Code: Select all
[libdefaults]
default_realm = MYDOMAIN.COM
default_tkt_enctypes = rc4-hmac des-cbc-crc
default_tgs_enctypes = rc4-hmac des-cbc-crc
ticket_lifetime = 1200
[realms]
MYDOMAIN.COM = {
kdc = MYDC. MYDOMAIN.COM
admin_server = MYDC. MYDOMAIN.COM
default_domain = MYDOMAIN.com
}
[domain_realm]
. MYDOMAIN.com = MYDOMAIN.COM
[appdefaults]
MYDC is the domain controller on the network to which TM1Server belongs.
9.1. Finding the KDC
Open up the computer properties for TM1Server that is on the relevant domain – Windows Key + Pause/Break
Or go to Control Panel, System and Security, System
Get the FQDN from the Domain: item
10. First time login
Restart Applications server to ensure Java is reloaded etc.
Connect to http://<TM1Server>:9510/tm1web
In Cognos TM1 Web version 10.2, you must enter your Microsoft Windows authentication in the Cognos TM1 Web login dialog box, there is not tick box for integrated log.
NOTE: If your TM1 server has underscores (or possibly other special characters) in the name e.g. TM1_SERVER, you will get an error message on login – Session timed out – check IBM Technote 1458105
https://www-304.ibm.com/support/docview ... wg21458105
GOOD LUCK!
