TM1 Forum

What methods do people use for taking their system "offline" such that non admin users cannot login via TM1Web (or perspectives)?

At certain times we want to take the system offline while TM1 Administrators perform certain tasks and at present even though we lock the system and advise the users it is unavailable they will still try to login so long as they can access the login page (or perspectives)....

I've been thinking about various ways to make the system appear offline and wondering what approaches others have used?

maybe this one?
https://www.ibm.com/support/knowledgece ... 509d6.html

Nah, that's changing the homepage after the users have logged in which we do already. I need to prevent them from logging in.

macsir wrote: ↑Fri Aug 23, 2019 2:19 am maybe this one?
https://www.ibm.com/support/knowledgece ... 509d6.html

One quick thought:
Unfortunately there is no login possible/not possible switch - at least I haven't met one yet.
Maybe it could go over the rights.
Use TI to read out all user rights and save them to a file or cube. Remove the rights from all users or create a group that is not allowed to do anything and assign the group to the users.
After maintenance, restore the rights.
Then the users can log in, but see nothing and do not disturb.

If you are using authentication, other than TM1, you could try overwriting the UniqueID with a rule triggered by a flag - Invalidating this should prevent integrated logins.

Have you looked at this?

lotsaram wrote: ↑Fri Aug 23, 2019 12:11 pm Have you looked at this?

clever way - i like ist
hopefully he's using PA

If you are already using security mode 1 you could put a rule on the }ClientProperties cube that assigned a crazy password like 7dhsye4$2Hu7)d or similar to every client except ADMIN. No one would be able to login unless they could guess the password. When you want to go back simply remove the rule.

orlando wrote: ↑Fri Aug 23, 2019 12:19 pm

lotsaram wrote: ↑Fri Aug 23, 2019 12:11 pm Have you looked at this?

clever way - i like ist
hopefully he's using PA

oh yeah this would be an option...unfortunately we're not upgrading to PA for a few months

If you dont need TM1Web/Applicaiton Web to check your admin changes. It would be a possibility to just stop those services.

Another solution I have used once was to close the firewall on the web-server so noone could access it. This way I could use the system since I was on the server. But noone else could access it from an external laptop.

Hello
We use for this 2 step:

1 tm1kill.exe to kick all users from model.
2 run process append to all users *LOCK* string to passworh hash.
I would like to warn you against using this approach. if you delete the line * LOCK * and insert the old password hash, we encounter a problem, cellpuss uses the trimm function, which leads to problems for some users.

Now we are considering a situation with password rules and there is also a more elegant solution that we will implement a bit later:
to OFFLINE
1 savedataall
2 copy file cube }ClientsProperties to temp folder (via executecommnd)
3 change password hash for all users exclude 'admins'
to ONLINE
1 cubeunload(}ClientsProperties)
2 copy file cube from temp folder to datafolder
enjoy

This sounds useful! But does unload work for }ClientProperties?

lotsaram wrote: ↑Wed Sep 04, 2019 5:23 pm This sounds useful! But does unload work for }ClientProperties?

We tested. YES

to OFFLINE
1 savedataall
2 copy file cube }ClientsProperties to temp folder (via executecommnd)
3 change password hash for all users exclude 'admins'
to ONLINE
1 cubeunload(}ClientsProperties)
2 copy file cube from temp folder to datafolder

So, in this scenario if the users keeps trying to login they will lock their account given their password has changed?? Does copying the }ClientProperties cube back resolve the fact that MaximumLoginAttempts has been reached? Because normally a locked account can only be reset but changing the password (or restarting the TM1 service).

I feel like this method might be a bit flawed (what about if integrated login is used?)...but maybe a variation on this could be applied....

Yep you right. MaximumLoginAttempts it's dynamic params you cn change it anytime.

integratedmode dinamic params only in PA not in TM1/.