Cognos Insight: TM1 server connection through Web Proxy?

[spiri79]

Dear TM1 Experts,

we're currently tuning a TM1 architecture (ver 10.2.1) designed to be used everywhere via web, also outside our corporate WAN.
TM1 server farm is running on the cloud, and successfully reachable using Cognos Insight (including SSL support) ONLY if there is no web proxy between the client and TM1 server.

Trying to connect the TM1 instance through a web proxy always results in error (please see the attachment below)

Capture.PNG (148.19 KiB) Viewed 5644 times

we tried unsuccessfully with several customizations of cognosrcp.ini

Code: Select all

vm.location=plugins/com.ibm.jre7.win32.x86_64_10.2.1043.0/jre/bin/classic/jvm.dll
vm.heapsize.preferred=26M
main.class=com.ibm.cognos.provagent.startup.QuickStarter
vmarg.1=-Xshareclasses:name=provagent,nonfatal
vmarg.2=-Djava.net.useSystemProxies=true      ;this entry!
;vmarg.3=-Xdebug
;vmarg.4=-Xrunjdwp:transport=dt_socket,address=7070,server=y,suspend=y
classpath.1=startup.jar
;single.instance=dde
;dde.enabled=true
;dde.server.name=Cognos.CognosRCP
;dde.topic=system
;dde.class=org.boris.winrun4j.DDE
;log=log.txt
log.level=none

and CognosInsight.ini

Code: Select all

-vmargs
-Xscmx48M
-Xshareclasses:name=cognosdesktop,nonfatal
-Xgcpolicy:gencon
-Duser.language=en 
-Xms100M
-Xmx1536M

We tried as well local JVM configuration. Insight is always trying a direct connection, ignoring the system proxy.

Any idea?

Thanks,

Pete

[spiri79]

some test done below. No way to force a custom https proxy entry.

Code: Select all

vm.location=plugins/com.ibm.jre7.win32.x86_64_10.2.1043.0/jre/bin/classic/jvm.dll
vm.heapsize.preferred=26M
main.class=com.ibm.cognos.provagent.startup.QuickStarter
vmarg.1=-Xshareclasses:name=provagent,nonfatal
vmarg.2=-DproxySet=true
vmarg.3=-Dhttps.proxyHost=10.57.xxx.xxx
vmarg.4=-Dhttps.proxyPort=8080
;vmarg.2=-Dhttps.proxySet=true
;vmarg.2=-Djava.net.useSystemProxies=false
;vmarg.2=-Dhttps.proxyHost=10.57.xxx.xxx -Dhttps.proxyPort=8080 -DproxySet=true
;vmarg.2=-Djava.net.useSystemProxies=true
;vmarg.3=-Xdebug
;vmarg.4=-Xrunjdwp:transport=dt_socket,address=7070,server=y,suspend=y
classpath.1=startup.jar
;single.instance=dde
;dde.enabled=true
;dde.server.name=Cognos.CognosRCP
;dde.topic=system
;dde.class=org.boris.winrun4j.DDE
;log=log.txt
log.level=none

and/or

Code: Select all

-vmargs
-Dhttps.proxySet=true
-Dhttps.proxyHost=10.57.xxx.xxx
-Dhttps.proxyPort=8080
-Xscmx48M
-Xshareclasses:name=cognosdesktop,nonfatal
-Xgcpolicy:gencon
-Duser.language=en 
-Xms100M
-Xmx1536M

[spiri79]

just to recap the situation. Our AD domain is distributing the proxy configuration to all the clients via policies, using an automatic WPAD configuration script (resulting in the browser options as LAN Settings > "automatically detect settings").
It seems that Cognos Insight is able to read the System Proxy field only if explicitly configured in the browser > lan settings tab. In our case it's translating the entry as "direct connection", resulting in TM1 connection timeout.

The question is now how to force the usage of a specific https proxy Host and Port, manipulating the .ini files or equivalent.

I tried also changing the local JVM settings, unfortunately Insight is using a bundled stand-alone version of the Java machine, not the local system one.

It seems that proxy settings updated using the bundled JVM control panel anyhow available are not influential :

Code: Select all

C:\Users\user.name\AppData\Local\Programs\IBM\Cognos Insight\plugins\com.ibm.jre7.win32.x86_64_10.2.1043.0\jre\bin\javacpl.exe

same story manipulating the java net configuration file:

Code: Select all

C:\Users\user.name\AppData\Local\Programs\IBM\Cognos Insight\plugins\com.ibm.jre7.win32.x86_64_10.2.1043.0\jre\lib\net.properties

I suspect proxy logics have been hardcoded in the app

Last but not least, using 3rd party tools like proxifier (http://www.proxifier.com/) is not an option in our case.

Please help us!

[tomok]

All very interesting but where in the documentation did you read where it is possible to run TM1 network traffic through a web proxy? A hack is a hack. Sometimes they work, sometimes they don't.

[spiri79]

Hi Tomok,

well indeed it works. Technically the proxy is transparent concerning the connection to TM1 server, apart of some extra hop. If the proxy is configured as system one, or using a tool like proxifier that force all the connection through it, the connection works perfectly.
The real matter is not having in Insight a configuration panel to set this parameter. Quite weird for such a product...

Pete

[tomok]

I never said it wouldn't work. My point was simply that when you attempt something that is not explicitly supported then you can't really complain about it when it doesn't work. FWIW, I doubt many people have tried this because 1) TM1 has historically performed very poorly in a cloud environment and 2) Insight is a relatively new product that is not anywhere near ready for prime time.

[spiri79]

I got your point and it is totally reasonable what you said . Pioneer's job is never easy, hope to find a solution or acceptable workaround