TM1 Forum

Hi All,
How do I give an user the access to run one specific TI process without adding the user to the "Admin" group? He/she belongs to "Planner" group..When I click on the "security assignments" option for Processes, I can see only "None" and "Read" option enabled. Other options are grayed out.

Also can you please provide links where I can read the privileges that default groups in TM1 have? (like "Admin", "Security Admin", "Data Admin")

Also there are some groups which start with '}'...what are these groups for? I remember these were not created by us..

Thanks in Advance..

Regards,
Deepu.

Security Assignments is correct. "Read" right is enough to let it run. Your error may have a different reason.

Regarding rights for Admin, DataAdmin, SecurityAdmin it is best to read the manuals. Same for system objects (starting with }).

Thanks for your response, Marcus.
But, we also need to provide our users 'write' access on specific TI processes that are relevant to their areas.
How/Can we provide this access to the relevant user groups?

Regards,
Deepu.

If I remember rightly, you should be able to 'type' in 'admin' text in the security assignments window for the processes, into the grid, rather than selecting it (as it is greyed out) on the bottom of the window.

I hope this makes sense.

Thanks, But unfortunately it doesn't let me 'type' anything on the grid cells. Instead I can copy-paste contents from elsewhere into the grid cell. I am also unable to copy-paste anything other than 'None' or 'Read' - probably since these are the only two options which is NOT greyed out.
It simply does not reflect the change after I re-open the grid.

Please help !

Thanks,
Deepu.

The only options for TI security are ADMIN - ie change/delete etc - and READ, which in this context means run. If you want users to update them they'll need to have admin (on these TIs, not in general).
Worth thinking about why users need to change them eg is it data sources, if so better to have the names in a cube which users can update.

Thanks.
But, I'm struggling to find out how to set 'admin' access to user groups? We have a user group called 'Planners' containing the names of all the Users (Planner role) maintained in the 'Clients/Groups' grid.
Yes, Users need to be given access to upload the data as they are responsible to input the 'planned' figures. Manually trying to input all these figures may eat up their time and hence trying to upload them via TI.

deepu_sree wrote:Thanks.
But, I'm struggling to find out how to set 'admin' access to user groups? We have a user group called 'Planners' containing the names of all the Users (Planner role) maintained in the 'Clients/Groups' grid.
Yes, Users need to be given access to upload the data as they are responsible to input the 'planned' figures. Manually trying to input all these figures may eat up their time and hence trying to upload them via TI.

Me thinks you're being a little thick headed here. Users don't need anthing other than READ access to a TurboIntegrator process in order to run it, regardless of what that process does. ADMIN rights to a TI process means the user can change the code behind the process. I would NEVER give this out.

To be fair the documentation is less than clear on this (at least the "Security Processes" section of the Developer Guide tells you how to open the security dialog box but doesn't explain what the settings are).

NONEmeans you cannot see or execute the TI process

READ means the user can see and execute the TI process. When the process runs it will run as an administrator. This means that it can update the cubes and dimensions regardless of what level of access the user who ran the process has. The user does not need to be able to edit the TI process in order to be able to write to the cubes/dimensions that the process is updates.

With read you can also view the process, meaning you can open it up and edit the code. However when you try to save it you get an error registering the object. This is where you are getting your issue that you outlined in your thread title.

ADMIN In order to edit the process you must be a member of an administrative group. As tomok says, you really shouldn't let this out to anyone but administrators.

If users really do need to be able to define things when the run the process (e.g. which scenario or cost centre to update) you should do this with parameters. Users should not be editing TI processes.

HTH,
Martin

Also if you have 'DataAdmin' users and your Admin has applied the right click Security Access on a process then they cannot modify the process as they now have 'READ' access rather than 'ADMIN'. Then the DataAdmin users will get the error "Error registering object" until removed by securityadmin or admin from cognos website

The TM1 Security Access option controls whether a process is allowed to modify security data in the script of the process. Only members of the ADMIN and SecurityAdmin groups are allowed to set this option. This option is set on a process-by-process basis from the Process menu in Server Explorer.

When the Security Access option is enabled for a process:

Members of the DataAdmin group are not allowed to edit the process since it may contain scripts that could modify TM1 security.

Only members in the full ADMIN group can edit a process after the Security Access option has been enabled.

Members of the SecurityAdmin group can view processes and turn this option on and off, but are never allowed to edit the contents of a process.