TM1 Forum

Hello All,

I am encountering an issue when updating security rights within TM1 Contributor (TM1 10.1).

The Problem
There is a TI process that creates new elements (N Level) which are used within the Approval Hierarchy (Department-Jobs). Within the application all administrators can see the new elements in the contributor workflow hierarchy, but for all non-admin users the new elements are not visible (note: all users have View rights to the whole hierarchy)?

So, I went to the Cognos Web Portal (Managing Rights) and saved the rights….even though I didn't change any of the application rights for users. This didn't work.

Following on I had a look at the security cubes ( }elementsSecurity..... & }CellSecurity_}tp_application_permissions....) and the new elements were blank whereas they should have been set to “Read” (as their parent nodes were set to read).

I then tested 1 user by changing the rights from View Depth all to 20. This then updated the security cubes populating the new elements with “Read” access for that user making them visible in the Contributor workflow Hierarchy.

One thing to note (not sure if it makes a difference) there 3770 elements in the Approval Hierarchy.

Questions
1. Does anyone else have this issue?
2. How can I avoid having to manually update user rights (for each user) every time a new element is created….which can be quite frequent?
3. Does anyone know how security control cubes for TM1 applications get populated or at least know where I could find some documentation on the process?

I am going to get IBM on the case too but thought I would post it on the forum first.

As always, thanks for any feedback

Lance

You could set up a second TI that cycles through the security cubes in question and updates them with what the parent elements have (you could narrow down the source by passing parameters for the new elements added). Remember to put a security refresh at the end and have it executed in the epilog of your TI that adds elements.

Note that I'm not sure about how this interaction will work with contributor but its worth a try (in dev).

Thanks for the suggestion. I was thinking along those lines but when I started to investigate it seems there are quite a few system TI processes that are kicked off. I am going to keep troubleshooting and hopefully IBM will have a solution otherwise I will go with your suggestion.