TM1 Forum

Hi,

I have had look around but because the terms are so generic not finding anything without having to peruse a lot of irrelevant posts - Maybe it is my search term (TM1 determine client connection type).

I am essentially trying work out when a client makes a connection what client software are they using to connect to the TM1 server (i.e. Perspectives, Contributor, TM1web or BI components).

If anyone has any ideas any help would be appreciated.

Version is 10.1.1

Thanks

Jan

I could of course be wrong but I would very much doubt if this is possible as one of the hallmarks of TM1 is that the server is client agnostic and doesn't care one way or the other which client a user is connecting with.

Lotsaram is most likely correct, but I'm confused about the question.

From where are you trying to determine the connection type? The only code you can run on a TM1 Server are TI and rules, and I can't imagine a reason for needing to know from where a TI was kicked off, or the connection type of the user in a rule calculated value?

Can you elaborate on what you're trying to do?

Hi Lazarus

If I can determine the software connection type, I could set different security rules.

Working at a large organisation that is trying to discourage the use of Excel customised reporting i.e. the preference is to use the BI tools over TM1. A few bad apples have managed to secure Perspectives on their machines. We are trying to limit their Excel connections onto our TM1 Server but would still need to give them access via the BI tools (AD single signon). If i can determine the software they are using I can potentially set a dynamic security rule of None vs Read.

Hope this makes sense.

Regards,

Jan

sypkens wrote:A few bad apples have managed to secure Perspectives on their machines. We are trying to limit their Excel connections onto our TM1 Server but would still need to give them access via the BI tools (AD single signon).

Those darn users!!!! Why do they always want to actually make use of all the data we provide them and not use the reports we're trying to cram down throats? Jeez. If you it weren't for the users working in IT would be sooo much easier.

Seriously though, you are out of luck on this one.

tomok wrote:Those darn users!!!! Why do they always want to actually make use of all the data we provide them and not use the reports we're trying to cram down throats? Jeez. If you it weren't for the users working in IT would be sooo much easier.

(Like.)

This is on IBM's radar. You might want to make inquiries with IBM as to whether the }Capabilities cube is operational in 10.1 and can be used to restrict access to server explorer. If not then if your intention is for TM1 data to be consumed only via "controlled interfaces" then your simplest option surely is to keep the admin host secret then users will not be able to log in with Perspectives. If users insist on access with perspectives you could also create a dedicated server (with separate admin host that they can access) with a separate security model for this purpose.

Also along the lines of Tomok's point, if you rule out access via Excel then you are severely limiting the power of TM1 to help create a self-service model where business users really are in charge of their own reporting without IT involvement in the reports themselves. Of course the Excel interface has some risks of performance issues with poorly trained users given free reign over report creation and I have certainly seen a few basket cases in my time due to poorly managed roll outs and poorly trained end user community. But on balance it is worth it for users and for IT to have direct slice & dice access via Excel. Certainly for the power user community anyway.

Tomok,

I am in violent agreement. However in this company's case they have purchased the Analytical Applications, Adaptive Warehouse and business viewpoint from IBM and hence have "canned reports" and centralised hierarchies with a direct feed from the ERP. The company has a history where business units have driven the reporting definitions creating many inconsistencies in the overall group reporting figures - hence the reason for the central approach (but still providing self service) and trying to move away from excel reporting. TM1 will certainly form part of the overall architecture. Perspectives unfortunately is not included in that vision due to the fact that it can undermine the strategy.

Thanks all for your thoughts. Will look into the capabilities option as mentioned by lotsaram.

Thanks again.

Jan

Look into IBM Cafe Add In for Excel. While I understand your concern, trying to stop the business from using the data in excel is naive. If you only allow BI reports, they will simply run them in excel format and paste them into excel and perpetuate the data inconsistency. Rather than block them from the tools that they like I would suggest helping them to succeed with them. I'm speaking from my own experience here but we fight this on almost a daily basis and in no way has limiting people to canned BI reports helped more than the self service capabilities of the tools such as perspectives or Cafe etc.

That being said, you could limit them to the BI tools however as I mentioned above, if they want the data in excel they'll get the data into excel.

Now after all that, you might be able to look into port blocking. I believe perspectives connects directly to the admin server itself vs going through the web. Blocking the admin server port to all machines except the web server might allow you to keep perspectives users from accessing TM1. I've never tried this but it might be possible.

Hi PlanningDev

We have realised that the BI interface will export to excel and are quite comfortable with it. We are looking at watermarking the canned reports. The excel export still restricts the user to a defined format - which ultimately will not stop them from using the data - it just means they will have to explain their numbers if used elsewhere.

As you mention invest in the staff we are planning the same stratgey. If persspectives is to be used (we can actually see the need for experienced modellers to use it) we would ultimately want the development to be controlled so that we can ensure there is concistency in design, have the ability to migrate between environments without significant rework and that general things like defined hierarchies are ignored and new "excel" calculations appear.

The reason I asked the question originally was to be able to control security i.e. if you can determine the connection type you control the way the security model works, ensure these users are up to scratch and follow standards and you get the best of both worlds.

Thanks for the port suggestion - did not think of that.

Jan

Let me know if the port thing works if you test it.

Also, you still may want to look into Cafe. Its an IBM product that allows users to pull BI data into Excel. ALl BI data, not just TM1. It would force users to stick with your pre modeled data and hierarchies etc. but still allow them the excel interface.

sypkens wrote:If persspectives is to be used (we can actually see the need for experienced modellers to use it) we would ultimately want the development to be controlled so that we can ensure there is concistency in design, have the ability to migrate between environments without significant rework and that general things like defined hierarchies are ignored and new "excel" calculations appear.

Good luck with that. If the aim is to control the use of Excel with TM1 then you are just setting yourself up for failure. If control is of the utmost importance then you'll have to take it away and rely on BI or TM1Web. Trying to clamp down on Perspectives is a bit like trying to herd cats.

Hi

As a follow up to the original question, we have found a way to limit the running of explorer on end users machines via the Capability Assignments -> Access to Server Explorer. By Setting it to Deny for certain user groups we can limit the access they can have via Server Explorer but still provide all the usual functionality via TM1 Web.

Thanks to all the suggestions and thoughts.

Regards,

Jan

sypkens wrote:As a follow up to the original question, we have found a way to limit the running of explorer on end users machines via the Capability Assignments -> Access to Server Explorer. By Setting it to Deny for certain user groups we can limit the access they can have via Server Explorer but still provide all the usual functionality via TM1 Web.

Thanks for the follow-up. Out of curiousty, can you let us know what the function of the Perspectives install is if the Capability Assignment is set to 'Deny'? Can a user still open Excel, go into Server Explorer, and do limited stuff?

Hi

It is a large organisation and there are various TM1 instances in other sections of the business. From our perspective we wish to ensure specific development standards in our instance of TM1. Some of the other areas are less worried about it and hence have released Perspectives to their (untrained) user base.

In short yes they can do limited stuff in the perspectives toolbar. One thing we have seen for instance that is possible is getting admin to create a report and email it around. by using the connect button you can then log on to the instance and refresh the report although I would argue that you could do the same with tm1 web without any of the hassle.

You just can't use Server Explorer to browse the instance.

Regards,

Jan

sypkens wrote:It is a large organisation and there are various TM1 instances in other sections of the business. From our perspective we wish to ensure specific development standards in our instance of TM1. Some of the other areas are less worried about it and hence have released Perspectives to their (untrained) user base.

Interesting - do you mean report-writing standards? It is good to find a balance between giving latitude to new report developers so they can learn from mistakes and enforcing standards to make sure that system performance and corporate consistency are properly implemented. Otherwise, having the user base do development, well it just sounds like you have untrained developers

sypkens wrote:In short yes they can do limited stuff in the perspectives toolbar. One thing we have seen for instance that is possible is getting admin to create a report and email it around. by using the connect button you can then log on to the instance and refresh the report although I would argue that you could do the same with tm1 web without any of the hassle.

Exactly - TM1 Web has 'snapshot' functionality that gets a copy of the original report into Excel without the TM1 formulas. It seems like a large maintenance overhead for IT and simply a bother for the user to log-in to a tool that they basically can't use! I guess IBM have been asked to supply this functionality so they did...

Hmmm I'd be interested to know if ISB is still functional even if server explorer isn't. Ad this would seem a way to sidestep the "deny" capability.

Hi Lotsa

Found today that ISB is working and yes it is a feature.

Robin

It is a combination of predominantly not enough trained users and in a small minority some users who are just plain dangerous e.g. MDX, crashing servers etc. i.e. they need a little bit of education to do it properly.

We also run multiple environments i.e. DEV, TEST, PROD with controlled migration tools and hence would like to develop anything (including reports) that are environment agnostic and can be migrated - which we have done very successfully so far.

Lastly I sit in a Group Finance Systems area responsible for budgeting and finance reporting systems and hence we would like to apply standards to minimize the admin overhead. We also have business viewpoint tied to TM1 and giving the business the ability to control their hierarchies and dimensions.

The idea is that between them controlling hierarchies and us enforcing standards we can make it work and it is a slow journey but seems to be getting through. We are absolutely open to making perspective available as it will limit the overhead but we wish to do it in a controlled gated process to ensure consistency and happy days for all.

Regards,

Jan