TM1 Forum

Hi,

We use TM1 application web. We also let users to run TI processes to update actual data for the cubes in TM1 workflow applications.
The key users (non-Admin) are not able to update cubes in applications when the workflow application is turned on due to data reservation (REQUIREDSHARED).
However when application is turned off, the users are able to load data via TI processes as data reservation is turned off for those cubes.
We now have an issue with this.
For the nodes that are submitted (locked) in the workflow application, even if we turn off the application and remove data reservation for the cubes ( remove REQUIREDSHARED in cube properties), the users are not able to update actual data via TI processes. We see "Access denied to cell" error in TI error logs.

Did you also face this problem? How did you manage to solve it?

Regards,

Have you tried checking the security control cube for the approval dimension?

jim wood wrote:Have you tried checking the security control cube for the approval dimension?

Which cube do you mean?

It looks }SecurityOverlayGlobal_CubeName cubes are holding the records about the nodes being locked or not. But I do not know how I can disable it looking at this cube when updating data via TI. It looks erasing DATARESERVATIONMODE in }CubeProperties cube for the application cubes does not disable it.

I found http://www-01.ibm.com/support/docview.w ... wg21649612
This should not be a design intend when the application is turned off or when the data reservation mode is disabled for the cube.

I know this is an old thread, but we're encountering the same problem where we need users to be able to run a TI process that updates a cube used in our Contributor application, and specifically they need to do that when the node is locked. In 9.5.2 this wasn't a problem, but it won't work in 10.2.2. Did you ever find a way around this?

lpahnke wrote:I know this is an old thread, but we're encountering the same problem where we need users to be able to run a TI process that updates a cube used in our Contributor application, and specifically they need to do that when the node is locked. In 9.5.2 this wasn't a problem, but it won't work in 10.2.2. Did you ever find a way around this?

We had to use RunTI and get the process executed as an ADMIN user.

Hello all!
There is a (not well documented) TI function "CubeLockOverride", which allows TurboIntegrator to write to a locked cube.
You can find information on CubeWise's blog:
http://cubewise.com/blog/things-you-mig ... ity-part-2

I had forgotten I posted this, but what we ended up doing was within the TI process that's updating the cube, we first run a TI process that gives the user executing it admin rights, then we make the updates to the cube, and then we take the admin rights away. We also created a nightly TI process that removes admin rights for all users who aren't real admins, in case anything has gone wrong with the process they ran and their admin rights didn't get taken away properly.

That's rather dangerous.
If your server crashes during executing the process (and so process does not remove admin rights): after server start and until midnight, the user will be almighty (that reminds me a story of Cinderella )

Well if the server crashes I think we have a bigger problem than users having admin rights, as at that point no one will have any access at all....
Anyway, I think we may also have the remove admin rights process scheduled in a startup chore as well, which would cover that case, although this is a good reminder that I should check that to be sure.