Product:
Cognos BI 10.2.2
Microsoft Windows 2012 R2 Server
Problem:
In a Active Directory Domain and Forrest, when we try to add AD groups to the internal Cognos groups in Cognos Connection – Administration – Security, we can not see all groups.
Solution:
AD Domain Local Groups can only be seen if they are in the same sub-domain as the Cognos Content Manager server. If the Cognos CM server is in a different domain than the DLGroup, it is not visible.

You should create a Cognos security group for your function, then to that Cognos group add AD groups from the different namespace you have created to allow users of different forest have access to the Cognos solution.

When you configure an authentication namespace for IBM® Cognos®, users from only one domain can log in. By using the Advanced properties for Active Directory Server, users from related (parent-child) domains and unrelated domain trees within the same forest can also log in. There is no cross-forest support; there must be a namespace for each forest.
If you set a parameter named chaseReferrals to true, users in the original authenticated domain and all child domains of the domain tree can log in to IBM Cognos. Users from a parent domain of the original authenticated domain or in a different domain tree cannot log in.
If you set a parameter named MultiDomainTrees to true, users in all domain trees in the forest can log in to IBM Cognos.
https://www.ibm.com/support/knowledgecenter/SSEP7J_11.0.0/com.ibm.swg.ba.cognos.inst_cr_winux.doc/t_includedomainsusingadvancedproperties.html#IncludeDomainsUsingAdvancedProperties

If you specify Binding Credentials (i.e. if you fill in this section), then:
• (in some environments) it can lead to performance problems. This is because it causes Cognos to ‘unbind’ its original user and re-bind as the ‘specified’ user
• You must ensure that the password (of the user that you choose) does not change/expire

=> Therefore, only fill in the ‘Binding credentials’ section if your “test” (see later) fails. If authentication fails, specify a Windows user ID and password for the Binding credentials property.
• Use the credentials of a Windows user who has at least ‘search’ and ‘read’ privileges for that server.
• This should be a domain user who can ‘see’ the folders inside the AD where the users are located.

http://www-01.ibm.com/support/docview.wss?uid=swg21380097

In order to setup SSO in a multi-domain Active Directory environment, follow these steps:

1. Launch “Cognos Configuration”
2, Create a new namespace
3. Make sure that this is set to “Active Directory” (not LDAP)
4. Use the root domain as the hostname
5. Locate “Advanced properties” and click edit/modify button
6. Enable either ‘ChaseReferrals’ or ‘MultiDomainTrees’.

TIP:

• ChaseReferrals – This will allow users from ‘child’ domains (i.e. domains below the domain that your namespace is connected to) to logon
  • This is often the best choice (for performance reasons).
• MultiDomainTrees – Allows users from ALL domains (inside the forest) to logon
  • If you are unsure where your users will be located, ‘MultiDomainTrees’ can be the best option (to ensure that all users are able to logon, wherever they are located).
  • However, this means that searches will traverse the entire forest, leading to performance slowdowns.

Once you have chosen, add one of the following entries:

• chaseReferrals: True
• multiDomainTrees: True

6. Decide on whether to use NTLM (“REMOTE_USER”) or KERBEROS authentication.
If you want to use NTLM/REMOTE_USER, then also add the following entry:

• singleSignOnOption: IdentityMapping

Do not use this entry if you want to use Kerberos (which is the preferred option for many environments).
7. Perform a test on this namespace to make sure a connection can be made
8. Restart the service

From the web:
– universal group membership is replicated to all Global Catalogs (i.e. it has forest-wide replication scope). This can be beneficial (since it provides efficient way to retrieve group members) – but has its drawbacks (it increases volume of replication traffic).
– domain local groups do not have any limitations regarding their membership – i.e. they can contain accounts the same domain/forest or any trusted domain/forest. This does not apply to  domain global groups (they can contain only accounts from the same domain) or universal groups (they can contain only accounts from the same forest).
– universal group is a security or distribution group that contains users, groups, and computers from any domain in its forest as members. You can give universal security groups rights and permissions on resources in any domain in the forest.
– global group is a group that can be used in its own domain, in member servers and in workstations of the domain, and in trusting domains. In all those locations, you can give a global group rights and permissions and the global group can become a member of local groups. However, a global group can contain user accounts that are only from its own domain.
– domain local group is a security or distribution group that can contain universal groups, global groups, other domain local groups from its own domain, and accounts from any domain in the forest. You can give domain local security groups rights and permissions on resources that reside only in the same domain where the domain local group is located.

More information:
http://www-01.ibm.com/support/docview.wss?uid=swg21598533

https://www.ibm.com/support/knowledgecenter/en/SSEP7J_10.2.2/com.ibm.swg.ba.cognos.c8pp_inst.10.2.2.doc/c_enabling_single_signon_between_actdirsrv_and_cog_comp.html

http://www-01.ibm.com/support/docview.wss?uid=swg21341889

http://www-01.ibm.com/support/docview.wss?uid=swg21340833

Product:
Cognos BI 10.2.2
Microsoft Windows 2012 R2 Server
Problem:
What files should I save in a backup folder, before I apply a fix pack or do a upgrade of a Cognos BI 10.2.x installation?
Solution:
If you have done advance tuning to the Cognos functions then this files are maybe updated;
…\c10_64\configuration\CQEConfig.xml
…\c10_64\configuration\cclWinSEHConfig.xml
…\c10_64\configuration\rsvpproperties.xml
…\c10_64\webapps\p2pd\WEB-INF\p2pd_deploy_defaults.properties
…\c10_64\webapps\p2pd\WEB-INF\xts.properties
…\c10_64\tomcat\conf\server.xml
…\c10_64\webapps\p2pd\WEB-INF\services\reportservice.xml
…\c10_64\webapps\p2pd\WEB-INF\services\batchreportservice.xml
…\c10_64\webapps\p2pd\WEB-INF\classes\vierwerconfig.properties
…\c10_64\templates\ps\portal\system.xml

You should keep a copy of the original file you change with the ending .org like system.xml.org. Then you should copy your updated file with a ending like .ibm – then if the fix pack overwrites your system.xml file you have a copy of the file in system.xml.ibm, that you can copy back after the updated.

If you have done report customization then there is this files you need to make a copy off;

They are in this folders

Then you also may backup this files if you made changes there:
<c10_install>\webcontent\schemas\GlobalReportStyles_10.css.
<c10_install>\webcontent\pat\res\templates.xml.
<c10_install>\webcontent\pat\res\Resources.xml.
<c10_install>\webcontent\pat\res\reportstudio_en.xml.
<c10_install>\webcontent\pat\res\TableStyles.xml.
<c10_install>\webcontent\pat\res\ChartTemplates.xml.
<c10_install>\webcontent\pat\res\ReportPresets.xml.

You should also export a unencrypted cogstartup.xml file from each servers Cognos Configuration. Save this file in a separate folder like d:\temp\cogstartup backup 20171124.xml

Include the date, when you saved the file, in the filename.

More information:

https://www.ibm.com/support/knowledgecenter/en/SSEP7J_10.2.2/com.ibm.swg.ba.cognos.c8pp_inst.10.2.2.doc/t_installfixpacksunix.html

https://www.ibm.com/developerworks/library/ba-pp-infrastructure-cognos_specific_page702/index.html

Product:
Cognos BI 10.2.2
Microsoft Windows 2012 R2 Server
Problem:
How update the toolbar with links?
Solution: (copied from ibm website) http://www-01.ibm.com/support/docview.wss?uid=swg21694761

You need to update the system.xml file. This is found in folder C:\Program Files\ibm\cognos\c10_64\templates\ps\portal\system.xml on the Cognos BI report (dispatcher) server and on the Content manager server. It is the Cognos Presentation service that create the web-page, so where this is running (true) there the files will be read. Best  is to update it on all Cognos instances.

More information on customization of reports from here
https://www.ibm.com/developerworks/library/ba-pp-infrastructure-cognos_specific_page702/index.html

As shown in picture, the style of a Cognos report or report object can be affected by many sources such as:

Properties
Global Cognos style sheet such as GlobalReportStyles_10.xml
Templates
Local Classes
Layout Component References
TableStyles.xml
ChartTemplates.xml
RAVE visualizations
ReportPresets.xml

If we want to create and modify classes that apply to all reports, we can modify the global Cognos style sheet. This is a useful strategy if we only have one corporate style for all reports.

There are four versions of the global Cognos style sheet as shown in Table below.

 Four versions of the global Cognos style sheet

The exact CSS file used will be chosen based on how the report style is set for a given report. The default setting for IBM Cognos BI 10 is 10.x styles, as shown in Figure 8. You can open this dialog by selecting Report Properties from the File menu in IBM Cognos Report Studio.

Report Properties dialog above.

Each of the four CSS files identified above is installed by Cognos in four different locations, as shown in Table below.

Files are on both gateway and dispatcher (app) servers.

Update the file GlobalReportStyles_10.css in all above folders.

In the following example we will modify the IBM Cognos 10 BI global style sheet GlobalReportStyles_10.css. This style sheet is used by Cognos Viewer for HTML output.

The following steps are a simple modification where we will modify GlobalReportStyles_10.css to increase the font size.

1. On your IBM Cognos BI 10 server, find the file named <c10_install>\webcontent\schemas\GlobalReportStyles_10.css.
2. Copy this file and save it as GlobalReportStyles_10_BU.css.
3. Open the original GlobalReportStyles_10.css in a text editor.
4. Find the text .ls /* list */.
5. Scroll down to font-size: 8pt; and change it to font-size: 28pt;.
6. Save the file and close it.
7. Clear your browser’s cache and restart Report Studio.
8. Create a new List report with any data source.Select the List object and view its properties. You will notice that the Font property is empty.
9. Click the Run Report toolbar button to preview the HTML output in Cognos Viewer. It will pick up the new 28pt font size at runtime.

More information:

http://www-01.ibm.com/support/docview.wss?uid=swg21339054

http://www-01.ibm.com/support/docview.wss?uid=swg21694761

Product:
Cognos BI 10.2.2 fix pack 7
Microsoft Windows 2012 R2 Server
Issue:
When a user from a different domain than the servers are in, try to login to Cognos Connection, they get this error message.
Error:
CAM-AAA-0064
The function ‘bindToBestGCServer’ failed.
Solution:
There are two Microsoft Windows domains, Domain A and Domain B, that have a forest trust. In Cognos Configuration you have setup two namespace – one for Domain A and one for Domain B. The Cognos servers are in Domain A.
On the Microsoft Windows server IIS manager you have set Windows authentication on the CGI-BIN folder for the Cognos Gateway.
The user selects the namespace he want to login to first when he reach the cognos connection webpage.
Inside Cognos Configuration you only need:
+ In the Value – Advanced properties window, click Add.
+ In the Name column, type singleSignonOption (Case sensitive)
+ In the Value column, type IdentityMapping (Case sensitive)
+ Click OK.
+ Save configuration and restart Service for the setting to take effect

…to make the login work.
If you have also enter multiDomainTree=true you get above error.
If you only have ONE namespace setup in Cognos, then if all domains are the same Active Directory Forest, you need to add this values
chaseReferrals = True
MultiDomainTrees = True

Solution is very depending one your network infrastructure setup, you need to test different configurations.

Authentication in One Domain Tree
If you set a parameter named chaseReferrals to true, users in the original authenticated domain and all child domains of the domain tree can log in to Cognos. Users above the original authenticated domain or in a different domain tree cannot log in.

Authentication in All Domain Trees in the ‘Forest’
If you set a parameter named MultiDomainTrees to true, users in all domain trees in the forest can log in to Cognos.

More information
http://www-01.ibm.com/support/docview.wss?uid=swg21341889

https://www.ibm.com/support/knowledgecenter/en/SSEP7J_10.2.2/com.ibm.swg.ba.cognos.c8pp_inst.10.2.2.doc/c_enabling_single_signon_between_actdirsrv_and_cog_comp.html#stp_SSO_active_drctry
http://www-01.ibm.com/support/docview.wss?uid=swg21339641

Product:
Cognos Business Intelligence

Problem:
How to determine the Service Pack of the Cognos Business Intelligence product installed?

Solution (copied from IBM website before it is removed):
The component list cmplst.txt file displayed a full list of installed components. It is found on any server with a full or partial installation of Cognos Business Intelligence.
The table below maps the various build numbers to their more commonly referenced release names:
The build number indicates the MR (Maintenance Release) version, as per the following table:

IBM Cognos ReportNet
Build 1.1.316.16 is MR1
Build 1.1.413.8 is MR2
Build 1.1.510.0 is MR3
Build 1.1.610 is MR4

IBM Cognos 8 BI 8.1
8.1.108.33 is MR1
8.1.209.25 is MR2

IBM Cognos 8 BI 8.2
8.2.43.128 is the initial release
8.2.44 is SP1
8.2.45 is SP2
8.2.46 is SP3

IBM Cognos 8 BI 8.3
8.3.81.20 is the initial RTM
8.3.82 is SP1
8.3.83 is SP2
8.3.84 is SP3
8.3.85 is FP4
8.3.86 is FP5

IBM Cognos 8 BI 8.4
8.4.27.78 is the RTM or GA
8.4.28.15 is FP1
8.4.29.13 is FP2

IBM Cognos 8 BI 8.4.1
8.4.102.18-0 GA
8.4.103.16-0 FP1
8.4.104.13-0 FP2
8.4.105.14-0 FP3
8.4.106.12 FP4

IBM Cognos 10.1
10.1.4707.544-0 GA
10.1.4801.29-0 FP1

IBM Cognos 10.1.1
10.1.6235.152 – 10.1.1 GA
10.1.6301.14 – 10.1.1 FP1
10.1.6303.12 – 10.1.1 FP2
10.1.6304.10 – 10.1.1 FP3
10.1.6305.14 – 10.1.1 FP4
10.1.6306.40 – 10.1.1 FP5

IBM Cognos 10.2
10.2.1003.159 – 10.2 GA
10.2.1101.19 – 10.2 FP1
10. 2.1102.54 – 10.2 FP2
10. 2.1103.29 – 10.2 FP3
10. 2.1104.98 – 10.2 FP4
10.2.1105.45 – 10.2 FP5

IBM Cognos 10.2.1
10.2.5000.275 – 10.2.1 GA
10.2.5001.156 – 10.2.1 FP1
10.2.5002.78 – 10.2.1 FP2
10.2.5003.113 – 10.2.1 FP3
10.2.5004.54 – 10.2.1 FP4 (build 10.2.5004.53 may be found in versions prior to Aug 15, 2014)
10.2.5005.78 – 10.2.1 FP5
10.2.5006.79 – 10.2.1 FP6
10.2.5007.30 – 10.2.1 FP7
10.2.5008.29 – 10.2.1 FP8
10.2.5009.33 – 10.2.1 FP9
10.2.5010.46 – 10.2.1. FP10 (build 10.2.5004.43 indicates the withdrawn Fix Pack 10)
10.2.5011.54 – 10.2.1 FP11
10.2.5012.26 – 10.2.1 FP12
10.2.5013.81 – 10.2.1 FP13

IBM Cognos 10.2.2
10.2.6100.235 – 10.2.2 GA
10.2.6101.79 – 10.2.2 FP1
10.2.6102.54 – 10.2.2 FP2
10.2.6103.26 – 10.2.2 FP3
10.2.6104.43 – 10.2.2 FP4
10.2.6105.506 – 10.2.2 FP5 (build 10.2.6105.50 indicates the withdrawn Fix Pack 5)
10.2.6106.48 – 10.2.2 FP6
10.2.6107.28 – 10.2.2 FP7
10.2.6108.34 – 10.2.2 FP8
10.2.6109.59 – 10.2.2 FP9

Steps:
Within the Cognos BI install folder, look for a file called cmplst.txt. The default installation location is c:\program files\cognos\
Within this file, look for [Product Update Information]. If this section is missing or blank, then you have the RTM (first release) installed. If the section is populated, reference the table above to determine the service pack installed.

If you do not have access to the component list file (cmplst.txt):
Hit Ctrl-F3 within Cognos Configuration to bring up a Properties menu
On the Installed Components tab, the build numbers will also be displayed

http://www-01.ibm.com/support/docview.wss?uid=swg21343355

For Cognos Analytics
Name                            Release                                  Build Number
Cognos Analytics 11 GA 11.0.0.0                          11.0.0.15121723
Cognos Analytics 11 R1 11.0.1.0                           11.0.1.16031813
Cognos Analytics 11 R2 11.0.2.0                           11.0.2.16042816
Cognos Analytics 11 R3 11.0.3.0                           11.0.3.16062807
Cognos Analytics 11 R4 Initial 11.0.4.0                11.0.4.16090915
Cognos Analytics 11 R4 Refresh 11.0.4.0            11.0.4.16092813
Cognos Analytics R5 11.0.5.0                                11.0.5.16112119
Cognos Analytics R6 11.0.6.0                                11.0.6.17031315
Cognos Analytics R7 11.0.7.0                                11.0.7.17082211
Cognos Analytics R8 11.0.8.0                                11.0.8.17103116

http://www-01.ibm.com/support/docview.wss?uid=swg21990189
and for TM1 you can find the version here
http://www-01.ibm.com/support/docview.wss?uid=swg21964134

Product:
Cognos Business Intelligence (BI) 10.2.2 Fix pack 6
Microsoft Windows 2012 R2 server
Issue:
When adding a new domain to the list of namespaces in Cognos BI, during test or startup it give a error message.
New domain have in our example the name ExtAD
Error message:
[‘ExtAD’]
[ ERROR ] CAM-AAA-0146 The namespace ‘ExtAD’ is not available.
[ ERROR ] CAM-AAA-0064 The function ‘Configure’ failed.
[ ERROR ] CAM-AAA-0089 The provider is not initialized.
[ ERROR ] CAM-AAA-0036 Unable to authenticate because the credentials are invalid.
[ ERROR ] ADSI Error:
8009030C: LdapErr: DSID-0C09053E, comment: AcceptSecurityContext error, data 52e, v1db1
System Error:
The user name or password is incorrect.
Possible Solution:
The user logged into the Windows server where you have Cognos Configuration, does not have a account (or trust) in the new domain, so the test fail and the new Active Directory namespace is not shown.
Start Cognos Configuration and update the new namespace values
Enter a windows service account in the Bindings Credentials row in Cognos Configuration for the new namespace.
Enter in the format: domain.com\username
and the password (because it is a service account the password will never change).
Save the changes and restart the Cognos BI service where the content manager are.
Test to surf to the gateway again.

If Cognos 8 is running on the machine in the same forest as the configured domain/forest, you do not need to specifically set the bind credentials. However, if you run cross forest, then, you must provide the bind credentials

You would also need the binding credentials if AD is not configured to allow anonymous bind

More Information:
If the password is correct:
-2146893044 => 8009030C: LdapErr: DSID-0C0903A9, comment: AcceptSecurityContext error, data 775, v1db1 (account locked out)

If the pwd is incorrect returns:
-2146893044 => 8009030C: LdapErr: DSID-0C0903A9, comment: AcceptSecurityContext error, data 52e, v1db1 (unknown username or bad password)

https://social.technet.microsoft.com/Forums/lync/en-US/c1d8d706-a506-4973-9542-1e88a2a66ac0/ad-lds-and-locked-out-accounts-response-codes?forum=winserverDS

http://www-01.ibm.com/support/docview.wss?uid=swg21428900
http://www-01.ibm.com/support/docview.wss?uid=swg21432574

http://www-01.ibm.com/support/docview.wss?uid=swg21335624
https://www.ibm.com/support/knowledgecenter/SSEP7J_10.2.0/com.ibm.swg.ba.cognos.inst_cr_winux.10.2.0.doc/t_ap_active_dir_srvr.html