Product:
Cognos TM1 10.2.2
Cognos Controller 10.2.1
Windows 2012 R2 Server
Microsoft SQL database server

Problem:
How to setup SSO against Active Directory with TM1 and CAM security?

Possible Solution:
This describe the steps to setup for SSO in the Cognos BI and TM1 world.

Install the IIS on the Windows 2012 server to support Windows authentication.
Start server manager – go to local server – scroll down to roles and features, select add roles and features. Click next until you can expand Web Server – Security and select Windows Authentication.

Next you need to setup a connection to Active Directory inside Cognos Configuration.
Go to Security – authentication and right click new resource – namespace.
Enter name same as your domain e.g. AD and select type Active Directory.
Enter Namespace ID to same as domain, e.g. AD, keep all letters the same, this field is case sensitive.
Enter host and port to a DC server in your domain, e.g. domain.com:389
if you enter only the domain, the BI server will random contact on DC server and talk to for validate the user login.

At advance properties , for your namespace , you enter the key singleSignOnOption with the value IdentityMapping.
More information at http://www.ibm.com/developerworks/data/library/cognos/page64.html

Set authentication inside Cognos Configuration to not allow anonymous login. Save and restart Bi server.
If you are using Cognos Controller then you need to add users to the groups Controller Administrator and Controller users inside Cognos Connection. Click on “more” and “set members”.

Then in Cognos Controller configuration you need to switch security to CAM authentication from Native.
Restart Cognos Controller server, and let only the ADMIN person login first and add the other users from inside Cognos Controller client.

On the TM1 server there is a file you need to copy to your BI or Cognos Controller server. Check folder C:\Program Files\IBM\cognos\tm1_64\bi_interop for the new bi_interop.zip file.
Extract and merge the content of the bi_interop.zip file into the root directory of your existing Cognos BI installation: For example: C:\Program Files\IBM\cognos\c10_64\
Note: The bi_interop.zip file contains a directory structure that merges files into the \templates and \webcontent subdirectories.

Follow these steps to configure IBM® Cognos® TM1® Web to use IBM Cognos authentication security:
You need to copy and unzip the files from c:\Program Files\ibm\cognos\tm1_64\webapps\tm1web\bi_files folder on the TM1 server, to the BI server.
The unzipped templates directory must be copied into the root of each Cognos BI Server application tier install. Merge with the existing ..\c10_64\templates directory.
The unzipped webcontent directory must be copied into the root of each Cognos BI gateway install. Merge with the existing ..\c10_64\webcontent directory.

Unzip ..tm1_64\webapps\tm1web\bi_files\tm1web_gateway.zip in the TM1 install directory. This file should unzip into a templates and webcontent directory.
In newer versions of Cognos TM1 the above 3 steps may not be needed. The last step is needed if there is a Cognos Controller 10.2.1 installation of Cognos BI.
variables_TM1.xml.sample
This file is contained inside the compressed file tm1web_app.zip.
tm1web.html.new
This file is contained inside the compressed file tm1web_gateway.zip.
Rename the variables_TM1.xml.sample file to variables_TM1.xml.
Rename the tm1web.html.new file to tm1web.html.

Copy variables_TM1.xml file to \templates\ps\portal on your Cognos BI system.
The variables_TM1.xml file should not be edit as of TM1 version 10.2.2

Copy tm1web.html file to \webcontent\tm1\web on your Cognos BI system.
Edit the tm1web.html file to point to the server where Cognos TM1 Web is running.
var tm1webServices = [“http://SystemName:PortNumber”];
// Update the following to point to the location of the TM1Web service(s)
var tm1webServices = [“http://localhost:8080″,”http://localhost:9510”];
change to var tm1webServices = [“http://tm1server.domain.com:9510”];

These files are also installed with newer Cognos BI installations. If the files exist on your Cognos BI server, then you only need to edit them.
Open the C:\Program Files\ibm\cognos\ccr_64\webcontent\planning.html file and locate the following lines:
// Update the following to point to the location of the planning service(s)
var planningServices = [“http://machine.company.com:9510”];
Replace web_server_address with the fully qualified domain name (FQDN) for the computer where the Cognos TM1 Application Server is running. For example, myhost.example.com
var planningServices = [“http://web_server_address:9510”];

To ensure that Cognos TM1 Applications can properly detect a CAM session termination, set the pmpsvc session timeout to a value higher than the CAM session timeout.
The pmpsvc session timeout is the number of minutes of inactivity after which Cognos TM1 Applications terminates a user session. The default value is 60 minutes (1 hour).
The CAM session timeout is the number of seconds of inactivity after which Cognos security terminates a user session. The default value is 3600 seconds (1 hour).
When Cognos TM1 Applications is deployed with the Apache Tomcat that is provided with the Cognos TM1 installation, the fpmsvc_config.xml file is here:
C:\Program Files\ibm\cognos\tm1_64\webapps\pmpsvc\WEB-INF\configuration
open the fpmsvc_config.xml file in notepad to edit it.
Enter a value for the timeout attribute of the service / session element.
Use the format for the service / session / timeout attribute as defined in the XML schema definition file fpmsvc_config.xsd located in the same directory.

<session timeout=”65″/>

On your Cognos BI system, configure the CAM session timeout using IBM Cognos Configuration.
Leave the value to 3600 in the Inactivity timeout in seconds field in the Security/Authentication section of Cognos Configuration.

Configure Cognos TM1 Applications with values for the IBM Cognos Gateway URI and IBM Cognos Dispatcher URI . Open Cognos TM1 Applications using the format of the following link:
http://tm1servername.domain.com:9510/pmpsvc
Log in and open the Cognos TM1 Applications Configuration page:
If you are running Cognos TM1 Applications for the first time, the Configuration page opens after you log in.

If you already configured Cognos TM1 Applications, open the Configuration page by clicking the Administer IBM Cognos TM1 Applications (the icon to the right) on the toolbar of the TM1 Applications portal page.

In some case you do not see the fields, this can be because we have already used a TM1 application with Native security, this has to be removed first before you can add a TM1 application with CAM security and setup this values.
To make a TM1 application use CAM security, you need to update there TM1S.CFG file with this values.
IntegratedSecurityMode=5
ServerCAMURI=http://biservername:9300/p2pd/servlet/dispatch
ClientCAMURI=http://biservername/ibmcognos/cgi-bin/cognosisapi.dll
ClientPingCAMPassport=900

Save tm1s.cfg and restart the TM1 instance.
You need to add users to the TM1 instance from inside TM1 Architect.

Open IBM Cognos Configuration for TM1 and check that the Environment properties for Gateway URI and Content Manager URI point to the BI server.
If you are using Cognos Controller FAP, then you need to change that to also use CAM security.
Open C:\Program Files\ibm\cognos\ccr_64\Server\FAP\FAPservice.properties in notepad and unmark the clientcamuri value, update it to point to the Cognos BI Gateway URL.

Save and restart the FAP service. Then you need to update the login values inside Controller FAP manager for the TM1 data mart to be using AD\username instead of the native logins used before.

On the Cognos BI Gateway installation, that you point out in Cognos Analysis for Excel installation, navigate to Cognos_root\templates\ps\portal\ folder, where Cognos_root is the directory that Cognos Controller BI has been installed to.
Open the file C:\Program Files\ibm\cognos\ccr_64\templates\ps\portal\variables_plan.xml.
Verify that the ../pmhub.html tag exists below ../planning.html. The following text is an example of the variables_plan.xml file:

<?xml version=”1.0″ encoding=”UTF-8″?>

    <CRNenv>

    <urls>

    <url>../planning.html</url>

    <url>../pmhub.html</url>

    </urls>

    <cookies>

    <param name=”cam_passport”/>

    <param name=”CRN”/>

    </cookies>

    </CRNenv>

Close the file.
Open C:\Program Files\ibm\cognos\ccr_64\webcontent\pmhub.html in notepad to edit it.
Edit this file to include all possible pmhub locations to the pmhubURL variable (see line 51). This enables SSO to operate.
// Update the following to point to the location of the pmhub service(s)
var pmhubURLs = [“http://mypmhubserver1:9510″,”http://mypmhubserver1.domain.com:9510”];

Make sure that the user account that is running the web server has permission to access pmhub.html. If you cannot access the pmhub.html in a web browser, check the pmhub.html file properties.
Edit the PMHub configuration screen.
In Internet Explorer, enter http://servername:port number/pmhub/pm/admin to open the configuration screen.
For example: http://tm1servername.domain.com:9510/pmhub/pm/admin
Expand the node for configurations > com.ibm.ba.pm.resource.security.dictionary and enter values for the following properties (you find the values to use inside Cognos Configuration):
CAMBIURL = http://biservername.domain.com:9300/p2pd/servlet/dispatch
CAMGatewayURL = http://biservername.domain.com:80/ibmcognos/cgi-bin/cognosisapi.dll

The values in PMHUB is saved automatic after a few seconds.
Then you need to test and ensure that Cognos Controller and Tm1web and FAP are working after this changes.
If you see the error “The planning service parameter was not specified or is not one of the configured locations”, review your settings for the planningServices parameter in the planning.html file on the Cognos BI server.

Error “The TM1Web service parameter was not specified” then;
Edit the file TM1Web.html located in the BI server to use the FQDN TM1 server name.

Example: var tm1webServices = [“http://servername.domain.com:9510”];
Note: If the file is set to use either IP or short server name you may face the error above.

More information:

http://www-01.ibm.com/support/docview.wss?uid=swg21661585

http://www-01.ibm.com/support/docview.wss?uid=swg21958925
http://www-01.ibm.com/support/knowledgecenter/SS9RXT_10.2.2/com.ibm.swg.ba.cognos.tm1_inst.10.2.2.doc/t_tm1_inst_tm1web_cogsecurity.html?lang=nl
https://www-304.ibm.com/support/knowledgecenter/SS9RXT_10.2.2/com.ibm.swg.ba.cognos.tm1_inst.10.2.2.doc/t_tm1_inst_sso_cafe.html%23t_tm1_inst_sso_cafe?lang=sv

https://www-304.ibm.com/support/knowledgecenter/SS9RXT_10.2.2/com.ibm.swg.ba.cognos.tm1_inst.10.2.2.doc/t_config_tm1_cont.html%23config_tm1_cont?lang=sv
https://www-304.ibm.com/support/knowledgecenter/SS9RXT_10.2.2/com.ibm.swg.ba.cognos.tm1_inst.10.2.2.doc/c_tm1_inst_new_10_2_2_bi_interop_kit_removed.html

http://www-01.ibm.com/support/docview.wss?uid=swg21341889
http://www-01.ibm.com/support/knowledgecenter/SSMR4U_10.2.2/com.ibm.swg.ba.cognos.express_migration.10.2.2.doc/t_express_inst_mig_install_configure_add_ad_user.html
http://www-01.ibm.com/support/docview.wss?uid=swg21882701

To get CAFÉ to work you need to do this;
https://www.ibm.com/support/knowledgecenter/SS9RXT_10.2.2/com.ibm.swg.ba.cognos.tm1_inst.10.2.2.doc/t_tm1_inst_sso_cafe.html

Product:
Cognos TM1 10.2.2 Fix Pack 6
Cognos BI 10.1.x or Cognos BI 10.2.x
Microsoft Windows 2012 R2 Server

Symptom:
When try to create a data source connection to a new setup TM1 10.2.2 server (with fix pack 6) from an old Cognos BI server. You get an error.

Error message:
DPR-ERR-2072 Unable to load balance a request with absolute affinity, most likely due to a failure to connect to the remote dispatcher. See the remote dispatcher detailed logs for more information. Check the health status of the installed system by using the dispatcher diagnostics URIs.

Or
Failed
XQE-DS-0006 Unable to logon to the data source.

Solution:
Then it can be that the TM1 instance is configured to use the CAM login from a different Cognos BI installation than the one that you are creating the request from.
You need to ensure that the CAM connection in TM1S.CFG point to the same Cognos BI server as the one you run the Cognos BI report on TM1 data from.

If TM1 authenticate to Cognos BI server A ,and you try to connect from a different Cognos BI environment Cognos BI server B (that have it own content store) you can get errors like above.

Change the values for CAM and restart the TM1 instance.
ServerCAMURI=http://serverB:9300/p2pd/servlet/dispatch
ClientCAMURI=http://serverB/ibmcognos/cgi-bin/cognosisapi.dll

Also make sure that the Windows Firewall has the needed ports open:
5495, 5498, 9300, 9510, 12345, 12346

The last ports are for the TM1 application (planning sample) you need to add your ports in for your TM1 instance. Check in the TM1S.CFG file for each TM1 applications port number used.
PortNumber=12345

If you enter a ADMINHOST=TM1serverC or not does not matter.
ClientMessagePortNumber= are in most cases not needed, but is recommend and then needed to be added to the list of open ports in the firewall.

More info:
http://www-01.ibm.com/support/docview.wss?uid=swg21586113

Product:
Cognos TM1 10.2.2 Fix Pack 6
Cognos BI 10.1.x
Microsoft Windows 2012 R2 Server

Symptom:
When try to create a data source connection to a new setup TM1 10.2.2 server (with fix pack 6) from an old Cognos BI 10.1 server. You get a error.

Error message:
XMD-CON-0001 Connect failed with error message: TM1-ERR-0070 The TM1 server srv100/planning sample cannot be found.

Solution:
Add this parameter to the TM1S.CFG file for the TM1 instance (planning sample)
SupportPreTLSv12Clients=T
And restart the service.

You also need to set TRUE on Support pre-TLS v1.2 clients
In the Cognos TM1 configuration, like this

To allow TM1 clients and TM1 servers prior to 10.2.2 FP6 to connect to a 10.2.2 FP6 TM1 Admin Server:
1. Click Start > IBM Cognos TM1 > IBM Cognos Configuration.
2. Click TM1 Admin Server on the Explorer tree in Cognos Configuration.
3. Set the Support pre-TLS v1.2 clients property to True.
4. Click File > Save.
5. Click File > Exit.
6. Click Yes if prompted to restart the TM1 Admin Server.

More info
http://www-01.ibm.com/support/docview.wss?uid=swg27048181

Product:
Cognos TM1 10.2.2
Microsoft Windows 2012 R2 Server
Microsoft Excel 2010

Problem:
The Web sheet becomes too wide on the TM1WEB so you need to scroll to the right.
You have marked the columns in the Excel workbook sheet and select delete columns.
But it has not helped.
If you press CTRL+END you still end up all the way to RV column.

Solution:
Mark the columns on the right side that you do not want to see.
Then select HIDE from the right-click menu.

Save the excel sheet.
Update the excel sheet to TM1WEB, with Perspective toolbar.

Product:

Cognos Tm1 10.2.2 fix pack 4

Microsoft Windows 2012 R2 server

Cognos TM1 SSL certificate expiration Interim Fix

How to upgrade the cert with the new cert files from Cognos Support. This doc will show the steps for one version of Cognos, in your environment other steps and paths are maybe needed.

This post is only valid a few days, until IBM comes with a Fix Pack that solves the issue. It looks like the Fix Pack 7 contains this certificate. So instead of all this, you can try to install TM1 10.2.2 fix pack 7 on a new install of TM1 10.2.2 – it will not update certs for a running tm1 server, then you need to do below steps. Download fix pack 7 from here:

http://www-01.ibm.com/support/docview.wss?uid=swg24043388

 

Download the updated TM1 SSL Certificates from the following location: http://www.ibm.com/support/fixcentral/quickorder?product=ibm%2FInformation+Management%2FCognos+TM1&fixids=BA-CTM1-SSL-ZIP-IF001

Extract the downloaded file/archive and extract it to any directory. For the purpose of this document, our files will be extracted in to <tm1_client_install_dir>\tm1_64\NewSSLCerts\

Here you get the latest instructions:

http://www-01.ibm.com/support/docview.wss?uid=swg21991653

You need to check version of TM1 to define the route to go. Check your CMPLST file here

C:\Program Files\IBM\cognos\tm1_64. In it check below [Product Update Information] for

PLANANALYTICS_Update_version=PLANANALYTICS-AW64-ML-RTM-10.2.5240.167-0

PLANANALYTICS_Update_name=IBM Cognos TM1

Above is Cognos TM1 10.2.2 fix pack 4. Below steps are for this version of TM1.

There is different steps to perform depending on the version of TM1 10.2.2 you have installed.

Text is copied from this site:  http://www.ibm.com/support/docview.wss?uid=swg21991546

How to update the server:

Stop all IBM Cognos TM1 Services in the environment you are updating

Extract the downloaded file/archive and extract it to any directory. For the purpose of this document, our files will be extracted in to <tm1_install_dir>\tm1_64\NewSSLCerts\

After extracting the files, look inside of your extracted folder <tm1_install_dir>\tm1_64\NewSSLCerts\ . The following files should be present.

applixca.der

applixca.pem

applixcacrl.p7b

applixcacrl.pem

tm1admsvrcert.pem

tm1store

tm1svrcert.pem

Back up the following directories in your <tm1_install_dir>

<tm1_install_dir>\tm1_64\bin\ssl

<tm1_install_dir>\tm1_64\bin64\ssl

<tm1_install_dir>\tm1_64\webapps\pmpsvc\WEB-INF\bin64\ssl

Create a separate folder for each folder and copy the files to these new folders so you have a backup.

Copy the contents of the folder you extracted earlier <tm1_install_dir>\tm1_64\NewSSLCerts\ , and place them inside of the 3 directories listed above in Step 4. During this process, you will be required to REPLACE all conflicting files as we must replace the old certificate files with new ones.

Above after the replacement of files.

After all files have been copied successfully, navigate to <tm1_install_dir>\tm1_64\bin64\ssl\

You can start a DOS prompt by right click on the start icon in the left corner of Windows 2012.

 Select Command Prompt (admin).

Then move to the correct folder <tm1_install_dir>\tm1_64\bin64\ssl\

Execute the uninstallSSL.bat file, to uninstall old keys from the Windows Keystore

Execute the importsslcert.exe file, to install the new keys in to the Windows Keystore

Open and run Windows Command Prompt as an Administrator. Navigate to <tm1_install_dir>\tm1_64\bin64\jre\7.0\bin . Execute the following command:

        keytool -delete -alias applixca -keystore ..\lib\security\cacerts -storepass changeit

keytool -keystore ..\lib\security\cacerts -alias applixca -import -file “C:\Program Files\IBM\cognos\tm1_64\bin64\ssl\applixca.der” -storepass changeit –noprompt

Copy all of folder C:\Program Files\IBM\cognos\tm1_64\bin64 to a backup folder like d:\temp\bin64.

Navigate to and copy all NGTM1*.dll files from your <tm1_install_dir>\webapps\pmpsvc\WEB-INF\bin64\ directory, and paste in to your <tm1_install_dir>\bin64\ directory. If prompted, REPLACE/OVERWRITE any conflicting files (specifically the NGTM1API.DLL file). This can be done by a COPY command in DOS.

Enter below string in CMD to copy the files

copy /B  “C:\Program Files\IBM\cognos\tm1_64\webapps\pmpsvc\WEB-INF\bin64\NGTM1*.DLL” “C:\Program Files\IBM\cognos\tm1_64\bin64\*.*”

Navigate to <tm1_install_dir>\bin64\ and open/edit the service_pmpsvc.bat file

Find the line beginning with ‘set BASE_JVM_OPTIONS’

Append the following to the end of the string:

        ;-Dcom.ibm.cognos.tm1.bin=%PMPSVC_ROOT%\bin64

Save your changes and close the open service_pmpsvc.bat file

If that does not work, then you need to save it to the Desktop.

And from there (desktop) copy it to the right folder.

Press CONTINUE on above dialog. Then the file is copied over.

You can do this with a BAT script – ensure the path are correct, and the ” are correct:

d:
REM new cert files should be in the D:\NewSSLCerts folder
copy /B /Y D:\NewSSLCerts\*.* “D:\Program Files\ibm\cognos\tm1_64\webapps\pmpsvc\WEB-INF\bin64\ssl\*.*”
copy /B /Y D:\NewSSLCerts\*.* “D:\Program Files\ibm\cognos\tm1_64\bin\ssl\*.*”
copy /B /Y D:\NewSSLCerts\*.* “D:\Program Files\ibm\cognos\tm1_64\bin64\ssl\*.*”
cd “D:\Program Files\ibm\cognos\tm1_64\bin64\ssl”
importsslcert.exe -remove
importsslcert.exe
cd “D:\Program Files\ibm\cognos\tm1_64\bin64\jre\7.0\bin”
keytool -delete -alias applixca -keystore ..\lib\security\cacerts -storepass changeit
keytool -keystore ..\lib\security\cacerts -alias applixca -import -file “d:\Program Files\IBM\cognos\tm1_64\bin64\ssl\applixca.der” -storepass changeit –noprompt
cd “D:\Program Files\ibm\cognos\tm1_64\bin64”
copy /B  “d:\Program Files\IBM\cognos\tm1_64\webapps\pmpsvc\WEB-INF\bin64\NGTM1*.DLL” “d:\Program Files\IBM\cognos\tm1_64\bin64\*.*”
REM now you need to update the service_pmpsvc.bat file – as shown before.

Open Windows Command Prompt as an Administrator, and navigate to <tm1_install_dir>\tm1_64\bin64\

Execute the following commands in the sequence below.

If your TM1 Services were configured to run as a service account, be sure to update the service to include the service account again – as it will likely be lost with this step.  Adding > d:\temp\stop.txt will create a text file in folder d:\temp\ that you can open in notepad, to check the result of the task.

        service_pmpsvc stop > d:\temp\stop.txt

After each command the DOS prompt is closed so you need to start it again as an administrator.

service_pmpsvc uninstall  >  d:\temp\uninstall.txt

This removes the services IBM Cognos TM1 Application Server from the list of installed services in Microsoft Windows.

service_pmpsvc install  >  d:\temp\install.txt

Start your IBM Cognos TM1 Services, from Windows services.

You can maybe create your own BAT file to run above 3 commands in an instance.

Use the d:\temp\install.txt file to check if the process was a success, you should not get any errors in the txt file.

Using JVM:              C:\Program Files\ibm\cognos\tm1_64\bin64\jre\7.0\bin\j9vm\jvm.dll
More help is available by typing NET HELPMSG 2185.
Installing the service “pmpsvc” …
Using CATALINA_HOME:    C:\Program Files\ibm\cognos\tm1_64\tomcat
Using CATALINA_BASE:    C:\Program Files\ibm\cognos\tm1_64\tomcat
Using JAVA_HOME:
1 file(s) copied.
keytool error: java.lang.Exception: Certificate not imported, alias <applixca> already exists
keytool error: java.lang.Exception: Certificate not imported, alias <tm1ca_v2> already exists
The service “pmpsvc” has been installed.
errorlevel 0 exit 0

Above is an example of a correct install.txt log file.

Looks like the PMHUB and Operations Console will work direct on server after this updates, no need to update them further.

 

Below steps to update clients, are the same for all versions of Cognos TM1 10.2.2

How to Update Your TM1 Architect / TM1 Perspectives Client Installations – ALL VERSIONS

To update your IBM Cognos TM1 Architect or Perspectives Client, the below steps can be followed:

Back up the following directories in your <tm1_client_install_dir>

<tm1_client_install_dir>\tm1_64\bin\ssl

<tm1_client_install_dir>\tm1_64\bin64\ssl

If you have installed 32 Bit TM1 Perspective, then it should be this folder;

Copy the contents of the folder you extracted earlier <tm1_client_install_dir>\tm1_64\NewSSLCerts\ , and place them inside of the 2 directories listed above. During this process, you will be required to REPLACE all conflicting files as we must replace the old certificate files with new ones. This can be done with a COMMAND like this;

copy /B “C:\Program Files\IBM\cognos\tm1_64\NewSSLCerts\*.*” “C:\Program Files (x86)\ibm\cognos\tm1\bin\ssl\*.*”

You need to enter Y to all replace file requests.

After all files have been copied successfully, navigate to <tm1_client_install_dir>\tm1_64\bin\ssl\

Execute the uninstallSSL.bat file, to uninstall old keys from the Windows Keystore

Execute the importsslcert.exe file, to install the new keys in to the Windows Keystore

Above step is not needed if your TM1 client tools are installed on the same server as TM1 server, but on your developer laptop you need to do above two steps.

At this stage, (and assuming your IBM Cognos TM1 Server components have been set up correctly and are running) – you should be able to confirm that you are able to successfully connect to your TM1 Server via IBM Cognos TM1 Architect or IBM Cognos TM1 Perspectives.

Above message do you get if you connect to TM1 server from TM1 perspective without having replaced the cert files locally on your laptop.

A simpler way to do the install on clients are to unzip the files to folder C:\arbete\newSSLcerts

And then create a BAT file with this content:

copy /B /Y “C:\arbete\NewSSLCerts\*.*” “C:\Program Files (x86)\ibm\cognos\tm1\bin\ssl\*.*”

copy /B /Y “C:\arbete\NewSSLCerts\*.*” “C:\Program Files (x86)\ibm\cognos\tm1\bin64\ssl\*.*”

copy /B /Y “C:\arbete\NewSSLCerts\*.*” “C:\Program Files\ibm\cognos\tm1_64\bin\ssl\*.*”

copy /B /Y “C:\arbete\NewSSLCerts\*.*” “C:\Program Files\ibm\cognos\tm1_64\bin64\ssl\*.*”

cd c:

cd “C:\Program Files\ibm\cognos\tm1_64\bin\ssl\”

importsslcert.exe -remove

importsslcert.exe

This file will work if you have admin rights on your PC, and is not blocked by any group policy.

How to Update Your Performance Modeler / Cognos Insight Client Installations – ALL VERSIONS

Above will show when you connect if you have not updated the files for Performance Modeler.

There is a updater kit – that each user of Performance Modeler on a Citrix server need to run – to update the certificates for that user. You run the file RcpSslUpdater64.exe from a DOS prompt as Administrator. More info here: http://www-01.ibm.com/support/docview.wss?uid=swg21991797

To update your IBM Cognos TM1 Performance Modeler / IBM Cognos Insight installation, the below steps can be followed:

In your Windows Start menu, find and right-click you’re IBM Cognos TM1 Performance Modeler / Cognos Insight shortcut and click ‘Open File Location’, this can be different place depending on how it was installed. If they are installed on the TM1 10.2.2 server, then your path may be like below;

This can be your folder; C:\Program Files\IBM\cognos\tm1_64\perfmodeler\bins\bin_10.2.5240.84\tm1\bin\ssl\

And in most cases you have a different folder for the versions you have installed

C:\Program Files\IBM\cognos\tm1_64\perfmodeler\bins\bin_10.2.5200.145\tm1\bin\ssl\

Both above folders need to be updated, plus some more shown below.

Back up one of the SSL Folders to ensure that you have the original keys, just in case.

Copy the contents of the folder you extracted earlier C:\NewSSLCerts\ , and place them inside of ALL \ssl\ folder found in your Performance Modeler or Cognos Insight installation directory. During this process, you will be required to REPLACE all conflicting files as we must replace the old certificate files with new ones.

You need to update the files in all SSL folders found, including this;

C:\Program Files\IBM\cognos\tm1_64\perfmodeler\bins\bin_10.2.5200.145\tm1\bin\tm1api101\ssl

C:\Program Files\IBM\cognos\tm1_64\perfmodeler\bins\bin_10.2.5200.145\tm1\bin\tm1api102\ssl

C:\Program Files\IBM\cognos\tm1_64\perfmodeler\bins\bin_10.2.5240.84\tm1\bin\tm1api101\ssl

C:\Program Files\IBM\cognos\tm1_64\perfmodeler\bins\bin_10.2.5240.84\tm1\bin\tm1api102\ssl

Plus some more folders, best is to search for SSL folders.

So in total for Cognos TM1 Performance Modeler you need to copy the new certificate files to 12 different directory’s on one Server. Then it will work.

If you are using IBM Cognos TM1 10.1.0 or TM1 10.1.1 Performance Modeler / Cognos Insight, they do not contain shortcuts in the Start menu by default. If you are not sure where Performance Modeler/Cognos Insight had been installed, you will need to launch Performance Modeler and then open Task Manager on your computer. With Task Manager open, look for the ModelingMDT process – on the Processes tab. Right click the ModelingMDT process and select ‘Open File Location’

‘C:\Users\username\AppData\Roaming\IBM\Cognos Performance Modeler\’ directory.

From within the directory just opened, use the Windows Search utility to find all folders named ‘ssl’

Depending on your installation, you may have MULTIPLE directories. For example, if you have two versions of TM1 you use in your environment – you will likely have two unique versions of Performance Modeler that will require SSL file updates

An example SSL folder location would look like the following: C:\Users\username\AppData\Local\Programs\IBM\Cognos TM1 Performance Modeler\bins\bin_10.2.5240.84\tm1\bin\ssl

 

Above error is when you have not update the files for Cognos Insight.

Check where the program is for Cognos Insight by right click on the icon, it may be this path:

“C:\Program Files\IBM\cognos\tm1_64\coginsight\cognosrcp.exe”

Below that folder are these folders that we also need to copy the SSL files too;

C:\Program Files\IBM\cognos\tm1_64\coginsight\bins\bin_10.2.5200.148\tm1\bin\ssl

C:\Program Files\IBM\cognos\tm1_64\coginsight\bins\bin_10.2.5200.148\tm1\bin\tm1api101\ssl

C:\Program Files\IBM\cognos\tm1_64\coginsight\bins\bin_10.2.5200.148\tm1\bin\tm1api102\ssl

C:\Program Files\IBM\cognos\tm1_64\coginsight\bins\bin_10.2.5240.82\tm1\bin\ssl

C:\Program Files\IBM\cognos\tm1_64\coginsight\bins\bin_10.2.5240.82\tm1\bin\tm1api101\ssl

C:\Program Files\IBM\cognos\tm1_64\coginsight\bins\bin_10.2.5240.82\tm1\bin\tm1api102\ssl

After above folders have been updated, and you have MODIFY rights to folder C:\Program Files\IBM\cognos\tm1_64\coginsight, then Cognos Insight works with the new certificates.

At this stage, (and assuming your IBM Cognos TM1 Server components have been set up correctly and are running) – you should be able to confirm that you are able to successfully use IBM Cognos TM1 Performance Modeler and/or Cognos Insight.

How to update the BI client:

On most Cognos BI servers, there is a TM1 client installed, this need to be updated.

Stop your IBM Cognos BI services in Windows.

Back up the following directories in your <tm1_client_install_directory>

<tm1_client_install_directory>\bin\ssl

<tm1_client_install_directory>\bin64\ssl

Copy the contents of the folder you extracted earlier <cognos_bi_install_dir>\NewSSLCerts\, and place them inside of the 2 directories listed above. During this process, you will be required to REPLACE all conflicting files as we must replace the old certificate files with new ones.

After all files have been copied successfully, start a dos prompt and navigate to <tm1_client_install_dir>\tm1_64\bin\ssl\ folder.
run importsslcert.exe -remove from Command Line
and after that run importsslcert.exe, to install the new keys in to the Windows Keystore.

Start your IBM Cognos BI services.

It can be different on your version of Cognos BI Server.

How to update Cognos controller:

After you change the certificate files on the TM1 10.2.2 server, the FAP service will work, normally you do not need to do anything.

In CMPLST.TXT can you see your version of Cognos Controller FAP client.

CONTRL_UPDATE_version=CCR-AW64-ML-RTM-10.2.5130.108-0

CONTRL_UPDATE_name=IBM Cognos Controller Update

You need to restart the FAP service, and do a IP.

Stop the Cognos Controller FAP service.

Erase the log file in the folder C:\Program Files\IBM\cognos\ccr_64\Server\FAP\. This to make it easier to read the errors in the file.

Start the Cognos Controller FAP service if it is on the same server as the TM1 server.

Login to the FAP client and start an Initial Publish.

If FAP services and client is installed on other computer than the TM1 server, then you need to update the local TM1 client installation. Follow the steps for TM1 architect, that should work fine. http://www-01.ibm.com/support/docview.wss?uid=swg21991657

If this does not work, or If you have an older version of Cognos Controller FAP you may need to contact Cognos Support to get more instructions.

More information can be found here:   https://www.ibm.com/developerworks/community/forums/html/topic?id=26c0d643-7018-4c23-a74c-76ebdcc9c94f&ps=25

 

How to update CDM:

IBM Cognos Disclosure Management (CDM) will not be able to contact the TM1 server after the certificates are changed on the TM1 server.

You need to go to the CDM windows server and find the installation of TM1 perspective.

Copy the new Cert zip file to your CDM server.

Extracting the files, to a folder like this <tm1_client_install_dir>\tm1_64\NewSSLCerts\ .

Back up the following directories in your <tm1_client_install_dir>

<tm1_client_install_dir>\tm1_64\bin\ssl

<tm1_client_install_dir>\tm1_64\bin64\ssl

Copy the contents of the folder you extracted earlier <tm1_client_install_dir>\tm1_64\NewSSLCerts\ , and place them inside of the 2 directories listed above. During this process, you will be required to REPLACE all conflicting files as we must replace the old certificate files with new ones.

If the folder is F:\Program Files\ibm\cognos\tm1_64\bin64\ssl then a script like this:

copy /B /Y “F:\Program Files\ibm\cognos\tm1_64\NewSSLCerts\*.*”  “F:\Program Files\ibm\cognos\tm1_64\bin64\ssl\*.*”

will copy the files there.

At this stage, (and assuming your IBM Cognos TM1 Server components have been set up correctly and are running) – you should be able to confirm that you are able to successfully connect to your TM1 Server via IBM Cognos CDM.

You may also need to;

Execute the uninstallSSL.bat file, to uninstall old keys from the Windows Keystore
Execute the importsslcert.exe file, to install the new keys in to the Windows Keystore

Check that the certificate is correct in the Windows Keystore

On the TM1 server or the TM1 client computer, go to Windows Control panel, and select Internet Options.

Click on tab Content.

Click on button Certificates.

Click on Trusted Root Certification… to see a list of Certificates.

Double click on the Applix certificate.  It should only be One line for Applix.

It should show that it is valid from 2016-06-17 to 2026-06-15.  Then it is the correct cert.

Above steps are only suggestions, the best way to update is to follow the guidelines at

http://www-01.ibm.com/support/docview.wss?uid=swg21991653

Please do a test change in your test/development environment first.

Product:
Cognos TM1 10.3 on the cloud
Microsoft Windows 2012 R2

Problem:
How update a cell in cube with added values from file?

Solution:
You can use a formula in the TI process Data tab where you get the value in the cell and then add the new value and put it back. Will be a long line something like this;

CellPutN(CellGetN( sCube ,vDim1,vDim2,vDim3,vDim4,vDim5,vDim6,’Gross Order Intake’)+vGrossOrder, sCube ,vDim1,vDim2,vDim3,vDim4,vDim5,vDim6,’Gross Order Intake’);

In newer version you can use incremental update with this kind of line;

if(cellisupdateable(sCube, Dim1, Dim2, Dim3, Dim4, Dim5, Dim6, measure)=1);
cellincrementn(units, sCube, Dim1, Dim2, Dim3, Dim4, Dim5, Dim6, measure);
endif;

The CellIsUpdateable function allows us to test if a cell in a cube can be written to. If true, the function returns a 1, if false a 0.

CellIncrementN inserts a number into a specific intersection of a cube, adding onto any value that is already there. It does not overwrite that value, rather it increases it.

CellIncrementN can be used in TM1 Turbo Integrator Processes only.

More Information:

CellIsUpdateable

CellIncrementN TM1 Function: Use and Syntax

Product:
Cognos TM1 10.3 in the cloud
Microsoft Windows 2012 R2 Server

Symptom:
When user run a TI process from a button on a web sheet (TM1WEB) there is a error “Process Fail”, but if a ADMIN user run’s it then it works.
There is no error in log files.

Cause:
The user does not have READ rights on the TI process.

Solution:
Login to TM1 Architect as ADMIN
Right Click on Processes and select Security Assignments
Go down to the line for your TI process.
In column Cognos\Everyone_CAMID(_Everyone)
Set READ
Click OK

By setting READ people in that Security Group can run the process.

More Information:
http://www.ibm.com/support/knowledgecenter/SS9RXT_10.3.0/com.ibm.swg.ba.cognos.tm1_dg_dvlpr.10.3.0.doc/c_tm1_dev_datares_modes.html

With the later TM1 10.2.x versions you have a function called
Data Reservation modes
Data Reservation modes allow you to configure the Data Reservation feature depending on how you want to control write-access to your data. When you enable the Data Reservation feature for a cube, you choose one of the available Data Reservation modes.

The available Data Reservation modes include:

Off (OFF)
Required (REQUIRED)
Required Shared (REQUIREDSHARED)
Allowed (ALLOWED)

You can create a TI process with this value in PROLOG to set the value to blank for your Cube:

sValue = ”;

cellputs ( sValue, ‘}CubeProperties’, ‘Demand Plan’, ‘DataReservationMode’);

Change ‘demand plan’ to the name of your Cube in the TM1 application.