Product:
Cognos TM1 10.2.2
Windows 2008 R2 Server
TM1 Architect

Problem:
The TI process does not work when added another TI process.

Possible Solution:
You have by mistake used the same name for the subsets that are in use by the different TI processes. Recommendation to use unique subset name for each process and cube.
This can be made by using this naming convention:

sDim = ‘S2.Valuta’;
sName = ‘$.’| GetProcessName();
sSubSet = sName|sDim;

Create above in prolog for each dimension that you need to use in the TI process.

Then in the epilog enter this, for each created subset of that dimension;

sDim = ‘S2.Valuta’;
sName = ‘$.’| GetProcessName();
sSubSet = sName|sDim;
SubSetDestroy (sDim, sSubSet);

This should make the subset only visible when the process is run, and they will only be around if the TI process crash. Then you have to delete the subset and re-run the TI process.

Product:
Cognos TM1 10.2.2
Cognos BI 10.2.1
Windows 2012 server

Symptom:
Can not login to TM1 Architect when changed to CAM security.

Error message:
SystemServerClientNotFound

Cause:
The firewall on the Cognos BI server is not letting port 9300 though.

Check the value ServerCAMURI=http://servername.domain.com:9300/p2pd/servlet/dispatch
in TM1S.CFG file on the Cognos TM1 server.
Copy the value http://servername.domain.com:9300/p2pd/servlet/dispatch
and paste it into Internet Explorer to try to surf from TM1 server to BI server.

If it does not work, check the local firewall settings on the BI server.

Go to Control Panel\All Control Panel Items\Administrative Tools
select Windows Firewall with Advance Security.
Select Inbound Rules.
If there does not exist a Cognos TM1 rule, create one.
On local port set 9300, and on remote port set All ports.
Save the Rule.
Test again to surf to BI server from TM1 server.

This are the most common ports you need open for Cognos BI and TM1;
25, 5495, 5498, 9300, 9510,12345, 49152-65535

You get also the same error if you misspell the server name in ServerCAMURI

More information:
http://www-01.ibm.com/support/docview.wss?uid=swg21459257
https://www-304.ibm.com/support/knowledgecenter/SSEP7J_10.2.2/com.ibm.swg.ba.cognos.inst_cr_winux.10.2.2.doc/c_reviewthedefaultsettings.html%23ReviewtheDefaultSettings

Product:
IBM Cognos TM1 10.2.2
Microsoft Windows 2012 Server

Symptom:
Get error when surf to TM1WEB on a new installation

Error message:
The webpage cannot be found
Most likely causes:
• There might be a typing error in the address.
• If you clicked on a link, it may be out of date.
What you can try:

Retype the address.

Solution:
Surf to tm1web instead of TM1WEB, the new web server in TM1 10.2.2 is case sensitive.

Use http://servername.domain.com:9510/tm1web instead of
HTTP://SERVERNAME.DOMAIN.COM:9510/TM1WEB

Capital letters does not work.

Product:

IBM Cognos Tm1 10.2.2 fix pack 4

Issue:

Try to create a subset and get an error when run the TM1 TI process.

Process will set READ on selected DIMENSIONS for a defined AD group.

Error message:

Error: Prolog procedure line (67): Unable to register subset

 

Possible solution:

Missing last parameter in function, which should add all dimensions that start with S2 in name to subset.

SubsetCreatebyMDX ( sSubset , ‘{TM1FILTERBYPATTERN( {TM1SubsetALL( [ ‘| sDim |’ ]  )},   “S2.*” )}’ ,1);

Was missing last 1.

The function add the values that should be part of the subset

SubsetElementInsert(DimName, SubName, ElName, Position);

 

The variables are declared before with

sDim=’}Dimensions’;

sName = ‘$.’| GetProcessName();

sSubset=sName|sDim;

 

More info ( full prolog ):

 

#****Begin: Generated Statements***

#****End: Generated Statements****

 

 

sSecurityCube =  ‘}DimensionSecurity’;

#———————————————————————————–

# to add ” in the string you need a variable

#  more info: http://www.robelle.com/smugbook/ascii.html

#———————————————————————————–

q=char(34);

 

#—————————————————————————————–

# create the view as a static public view: CUBESEC

#—————————————————————————————

pFromCube = sSecurityCube;

SourceView= pFromCube | ‘CUBESEC’;

#——————————————————————

#    Create views

#———————————————————————

 

if(ViewExists(pFromCube, SourceView)=1);

viewDestroy(pFromCube, SourceView);

endif;

viewCreate(pFromCube, SourceView);

 

#——————————————————————

#    Define variables

#———————————————————————

sBIgroup = ‘CAMID(“:LDAP:Cognos_FAP_Users”)’;

sSecutiryAction = ‘READ’;

sDim=’}Dimensions’;

sName = ‘$.’| GetProcessName();

sSubset=sName|sDim;

 

#———————————————————————————–

# If subset exist then it is destroyed before created

#———————————————————————————-

if(subsetExists(sDim,sSubset)= 1);

subsetDeleteAllElements(sDim, sSubset);

else;

subsetCreate(sDim, sSubset);

endif;

 

#——————————————————————————————————————

# add the values that should be part of the subset

# SubsetElementInsert(DimName, SubName, ElName, Position);

# should be all dim that start with S2, so a MDX look like this

#   {TM1FILTERBYPATTERN( {TM1SubsetBasis()}, “S2.*”)}

#———————————————————————————————–

 

SubsetCreatebyMDX ( sSubset , ‘{TM1FILTERBYPATTERN( {TM1SubsetALL( [ ‘| sDim |’ ]  )},   “S2.*” )}’ ,1);

 

#——————————————————

# add subset to view

#——————————————————-

ViewSubsetAssign(pFromCube, SourceView, sDim, sSubset);

 

#——————————————————————————-

#       Set source   – we only use subset in dim

#——————————————————————————–

DataSourceType=’SUBSET’;

DataSourceNameForServer=  sDim;

DatasourceDimensionSubset=   sSubSet  ;

 

 

#————————————————————————————————–

 

i=1;

G2 = SubsetGetSize( sDim, sSubSet);

while (i <= G2);

G1= ( SubsetGetElementName  ( sDim, sSubSet, I));

cellputs  (  sSecutiryAction , sSecurityCube, G1  , sBIgroup );

i=i+1;

end;

 

#—————————————————————————–

# end of code

#—————————————————————————–

 

 

Epilog should have some clean up code like this:

if (ViewExists(pFromCube, SourceView)=1);

viewDestroy(pFromCube, SourceView);

endif;

 

#———————————————

# destroy temp subset

#———————————————

sDim=’}Cubes’;

sName = ‘$.’| GetProcessName();

sSubset=sName|sDim;

subsetDestroy(sDim, sSubset);

 

Product:
Cognos Controller 10.2.1 Fix Pack 2
Microsoft Windows 2012 Server

Problem:
After installation of Cognos Controller 10.2.1 Fix Pack 2 on a existing Cognos Controller 10.2.1 installation the Windows services are missing:
IBM Cognos Controller Java Proxy
IBM Cognos Controller User Manager

Maybe because the service is set to use a windows account different from the person logged in to the server doing the installation – can caused this error.

Error in log file isconfig-UPDATER_CNTRL-20151124_1249.log:

Error: Failed to retrieve environment variable “JAVA_HOME”.
==== Component: ccrconfigappserver ====
Setup File: ‘C:\Program Files\ibm\cognos\ccr_64\bin\wct\ccrconfigappserver.xml’
Macro Definition: ‘InstallDir’ = ‘C:\Program Files\ibm\cognos\ccr_64’

Solution:
1. Reboot the Controller application server.

If this fails to solve the problem, go to step 2.

2. Logon to the Controller application server as a Windows administrator
3. Launch a command prompt (START – RUN – “CMD” )
4. Type the following command:

sc create frLicServer binpath= “C:\Program Files\ibm\cognos\ccr_64\server\FrLicServer.exe” DisplayName= “IBM Cognos Controller User Manager” depend= RpcSs start= auto

5. Type the following command:

sc create “IBM Cognos Controller Java Proxy” binpath=”C:\Program Files\ibm\cognos\ccr_64\server\CCRProxy.exe” DisplayName=”IBM Cognos Controller Java Proxy” depend=RpcSs start=auto

More Information
http://www-01.ibm.com/support/docview.wss?uid=swg24041193
http://www-01.ibm.com/support/docview.wss?uid=swg21680788
http://www-01.ibm.com/support/docview.wss?uid=swg21602419

Product:
Cognos Controller 10.2.1 Fix Pack 2
Microsoft Windows 2012 Server

Problem:
After installation of Cognos Controller 10.2.1 Fix Pack 2 on a existing Cognos Controller 10.2.1 installation, the FAP program give error when you login to the FAP client.

Because you have forgotten to upgrade the FAP database to the new version 9.
Error:
Microsoft NET Framework
Unhandled exception has occurred in your application.

Invalid Length for a Base-64 char array.

Solution:
1. Go to the Controller Configuration
2. Go to the Database settings
3. Create a new connection to the FAP database
4. Save and test it
5. Click on RUN to go to the DBCONV program
6. Select FAP
7. Click Connect
8. Click Upgrade
9. Click Close
Try again to start the Financial Analytics Publisher client and login.

More information
http://www-01.ibm.com/support/docview.wss?uid=swg21602419
http://www-01.ibm.com/support/knowledgecenter/SS9S6B_10.2.1/com.ibm.swg.ba.cognos.ctrl_inst.10.2.1.doc/c_win_ctrl_installfap.html%23win_ctrl_InstallFAP

Product:
Cognos TM1 10.2.2

Issue:
When surf to http://servername:9510/tm1web/contributor get a error message

Message:
HTTP Status 404 – /tm1web/contributor
——————————————————————————–
type Status report
message /tm1web/contributor
description The requested resource is not available.
——————————————————————————–
Apache Tomcat/6.0.44
Solution:
Surf to http://servername:9510/pmpsvc instead.
You need to surf to TM1 Application web to then start the application and the TM1 contributor client. You cannot surf direct to the TM1 Contributor client. The TM1 Application is the new Contributor.
http://www-01.ibm.com/support/docview.wss?uid=swg21669190

Product:
Cognos TM1 10.2.2
Issue:
When publish a TM1 application to the TM1 Application Web you get a error message.
Error message:
IBM Cognos TM1 Applications are not supported when the TM1 server is using Cognos Security mode 4. Specify IntegratedSecurityMode=5 instead.

Solution:
Open TM1S.CFG in notepad and change to 5
The new version only supports mode 1 or 5.
Change
IntegratedSecurityMode=4
To
IntegratedSecurityMode=5
Save the file.
Then from Windows services, stop and start your TM1 instance.
Start Performance modeler again and test again.
More Information:
https://www-01.ibm.com/support/knowledgecenter/SS9RXT_10.2.2/com.ibm.swg.ba.cognos.tm1_inst.10.2.2.doc/t_tm1_inst_app_cfg_app_webjv.html

Product:
Cognos TM1 10.2.2
Microsoft Windows 2008 R2 Server

 

Issue:
How to merge two text files that are created with a Turbo Integrator process? ASCIIOUTPUT will overwrite a file if called in a different tab of the same process in TI editor in TM1 Architect program.

 

Possible solution:
Merge the files after the TI process with a MS DOS command. Here a suggestion, the variables are filled with values earlier in TI code with CellGetS or from the cubeview that is read.

 

In PROLOG create the file name for the output, static or from a SYSTEM cube.

#————————————————–

# define file name to be used by combination a lot of variables or prompts.

#—————————————————-

sFileName = ‘RESULTAT_’| pTarget |’_SaldoHB_’| pHuvudbokstyp |’_’| paCompany |’_’|  pPeriod  |’_’| vTime |’.csv’;

 

#—————————————————————————-

#   save the filename in the system cube

#   to make it possible to use the file later

#—————————————————————————

if (LONG (pFileStorage) = 0);

pFileStorage= ‘File1’;

endif;

CellPutS ( sFilename, ‘Sys.Settings’, pFileStorage , ‘Value’ );

 

In METADATA create a unique file name for the file

#——————————————

# create the output in own file in meta tab

#——————————————

sFilename2 = sfilename | ‘_meta.csv’;#——————————————

# create the file from the list of variables

#——————————————

q=char(73);

Asciioutput( sPath | ‘\’ | sFilename2,

 

sBASE_DT ,

sHUVUDBOKSTYP ,

sFORETAG ,

sKONTO ,

sREDOVISNINGSPRODUKT ,

sVALUTA ,

sURSPRUNGSVALUTA ,

sINTERNMOTPART_FORETAG ,

sLANDSKOD,

sCOUNTRY  ,

sSALDO

);

 

In the DATA tab you fill with new data to file with unique name

#—————————————————————–

#  create data in own filename

#————————————————————————–

sFilename3 = sfilename | ‘_data.csv’;

 

#—————————————————————–

#  output the data in variables from data to a own file

#————————————————————————–

q=char(73);

Asciioutput( sPath | ‘\’ | sFilename3,

 

sBASE_DT ,

sHUVUDBOKSTYP ,

sFORETAG ,

sKONTO ,

sREDOVISNINGSPRODUKT ,

sVALUTA ,

sURSPRUNGSVALUTA ,

sINTERNMOTPART_FORETAG ,

sLANDSKOD,

sCOUNTRY  ,

sSALDO

);

 

In EPILOG you create the DOS command and do the concatenation of the files.

#———————————-

#  merge the two files to one

#———————————-

sFileA = sPath | ‘\’ | sFilename2;

sFileB = sPath | ‘\’ | sFilename3;

sFileC = sPath | ‘\’ | sFilename;

 

Executecommand ( ‘CMD /c copy ‘| sFileA |’  +  ‘| sFileB |’  ‘| sFileC |’  ‘, 1);

 

#———————————————————-

# erase the temp files from the folder

#———————————————————–

Executecommand ( ‘CMD /c DEL ‘| sFileA |’   ‘, 1);

Executecommand ( ‘CMD /c DEL ‘| sFileB |’   ‘, 1);

 

But above code have a error, it gives a file with a line-return last, so to get rid of the the last empty line in the final file you need to use the TYPE command instead of COPY. This copy the FileA to the FileB, so FileB will contain both files content.

Executecommand ( ‘CMD /c   TYPE ‘| sFileA |’  >>  ‘| sFileB |’    ‘, 1);

Then you need to adjust above code to create that sFileB variable contain the name of the file you finally want it to be.

Note, that below will not work because RENAME does not support paths in name.

Executecommand ( ‘CMD /c  REN ‘| sFileB |’    ‘| sFileC |’    ‘, 1);

 

Product:
Cognos TM1 10.2.2
Cognos Controller 10.2.1
Windows 2012 R2 Server
Microsoft SQL database server

Problem:
How to setup SSO against Active Directory with TM1 and CAM security?

Possible Solution:
This describe the steps to setup for SSO in the Cognos BI and TM1 world.

Install the IIS on the Windows 2012 server to support Windows authentication.
Start server manager – go to local server – scroll down to roles and features, select add roles and features. Click next until you can expand Web Server – Security and select Windows Authentication.

Next you need to setup a connection to Active Directory inside Cognos Configuration.
Go to Security – authentication and right click new resource – namespace.
Enter name same as your domain e.g. AD and select type Active Directory.
Enter Namespace ID to same as domain, e.g. AD, keep all letters the same, this field is case sensitive.
Enter host and port to a DC server in your domain, e.g. domain.com:389
if you enter only the domain, the BI server will random contact on DC server and talk to for validate the user login.

At advance properties , for your namespace , you enter the key singleSignOnOption with the value IdentityMapping.
More information at http://www.ibm.com/developerworks/data/library/cognos/page64.html

Set authentication inside Cognos Configuration to not allow anonymous login. Save and restart Bi server.
If you are using Cognos Controller then you need to add users to the groups Controller Administrator and Controller users inside Cognos Connection. Click on “more” and “set members”.

Then in Cognos Controller configuration you need to switch security to CAM authentication from Native.
Restart Cognos Controller server, and let only the ADMIN person login first and add the other users from inside Cognos Controller client.

On the TM1 server there is a file you need to copy to your BI or Cognos Controller server. Check folder C:\Program Files\IBM\cognos\tm1_64\bi_interop for the new bi_interop.zip file.
Extract and merge the content of the bi_interop.zip file into the root directory of your existing Cognos BI installation: For example: C:\Program Files\IBM\cognos\c10_64\
Note: The bi_interop.zip file contains a directory structure that merges files into the \templates and \webcontent subdirectories.

Follow these steps to configure IBM® Cognos® TM1® Web to use IBM Cognos authentication security:
You need to copy and unzip the files from c:\Program Files\ibm\cognos\tm1_64\webapps\tm1web\bi_files folder on the TM1 server, to the BI server.
The unzipped templates directory must be copied into the root of each Cognos BI Server application tier install. Merge with the existing ..\c10_64\templates directory.
The unzipped webcontent directory must be copied into the root of each Cognos BI gateway install. Merge with the existing ..\c10_64\webcontent directory.

Unzip ..tm1_64\webapps\tm1web\bi_files\tm1web_gateway.zip in the TM1 install directory. This file should unzip into a templates and webcontent directory.
In newer versions of Cognos TM1 the above 3 steps may not be needed. The last step is needed if there is a Cognos Controller 10.2.1 installation of Cognos BI.
variables_TM1.xml.sample
This file is contained inside the compressed file tm1web_app.zip.
tm1web.html.new
This file is contained inside the compressed file tm1web_gateway.zip.
Rename the variables_TM1.xml.sample file to variables_TM1.xml.
Rename the tm1web.html.new file to tm1web.html.

Copy variables_TM1.xml file to \templates\ps\portal on your Cognos BI system.
The variables_TM1.xml file should not be edit as of TM1 version 10.2.2

Copy tm1web.html file to \webcontent\tm1\web on your Cognos BI system.
Edit the tm1web.html file to point to the server where Cognos TM1 Web is running.
var tm1webServices = [“http://SystemName:PortNumber”];
// Update the following to point to the location of the TM1Web service(s)
var tm1webServices = [“http://localhost:8080″,”http://localhost:9510”];
change to var tm1webServices = [“http://tm1server.domain.com:9510”];

These files are also installed with newer Cognos BI installations. If the files exist on your Cognos BI server, then you only need to edit them.
Open the C:\Program Files\ibm\cognos\ccr_64\webcontent\planning.html file and locate the following lines:
// Update the following to point to the location of the planning service(s)
var planningServices = [“http://machine.company.com:9510”];
Replace web_server_address with the fully qualified domain name (FQDN) for the computer where the Cognos TM1 Application Server is running. For example, myhost.example.com
var planningServices = [“http://web_server_address:9510”];

To ensure that Cognos TM1 Applications can properly detect a CAM session termination, set the pmpsvc session timeout to a value higher than the CAM session timeout.
The pmpsvc session timeout is the number of minutes of inactivity after which Cognos TM1 Applications terminates a user session. The default value is 60 minutes (1 hour).
The CAM session timeout is the number of seconds of inactivity after which Cognos security terminates a user session. The default value is 3600 seconds (1 hour).
When Cognos TM1 Applications is deployed with the Apache Tomcat that is provided with the Cognos TM1 installation, the fpmsvc_config.xml file is here:
C:\Program Files\ibm\cognos\tm1_64\webapps\pmpsvc\WEB-INF\configuration
open the fpmsvc_config.xml file in notepad to edit it.
Enter a value for the timeout attribute of the service / session element.
Use the format for the service / session / timeout attribute as defined in the XML schema definition file fpmsvc_config.xsd located in the same directory.

<session timeout=”65″/>

On your Cognos BI system, configure the CAM session timeout using IBM Cognos Configuration.
Leave the value to 3600 in the Inactivity timeout in seconds field in the Security/Authentication section of Cognos Configuration.

Configure Cognos TM1 Applications with values for the IBM Cognos Gateway URI and IBM Cognos Dispatcher URI . Open Cognos TM1 Applications using the format of the following link:
http://tm1servername.domain.com:9510/pmpsvc
Log in and open the Cognos TM1 Applications Configuration page:
If you are running Cognos TM1 Applications for the first time, the Configuration page opens after you log in.

If you already configured Cognos TM1 Applications, open the Configuration page by clicking the Administer IBM Cognos TM1 Applications (the icon to the right) on the toolbar of the TM1 Applications portal page.

In some case you do not see the fields, this can be because we have already used a TM1 application with Native security, this has to be removed first before you can add a TM1 application with CAM security and setup this values.
To make a TM1 application use CAM security, you need to update there TM1S.CFG file with this values.
IntegratedSecurityMode=5
ServerCAMURI=http://biservername:9300/p2pd/servlet/dispatch
ClientCAMURI=http://biservername/ibmcognos/cgi-bin/cognosisapi.dll
ClientPingCAMPassport=900

Save tm1s.cfg and restart the TM1 instance.
You need to add users to the TM1 instance from inside TM1 Architect.

Open IBM Cognos Configuration for TM1 and check that the Environment properties for Gateway URI and Content Manager URI point to the BI server.
If you are using Cognos Controller FAP, then you need to change that to also use CAM security.
Open C:\Program Files\ibm\cognos\ccr_64\Server\FAP\FAPservice.properties in notepad and unmark the clientcamuri value, update it to point to the Cognos BI Gateway URL.

Save and restart the FAP service. Then you need to update the login values inside Controller FAP manager for the TM1 data mart to be using AD\username instead of the native logins used before.

On the Cognos BI Gateway installation, that you point out in Cognos Analysis for Excel installation, navigate to Cognos_root\templates\ps\portal\ folder, where Cognos_root is the directory that Cognos Controller BI has been installed to.
Open the file C:\Program Files\ibm\cognos\ccr_64\templates\ps\portal\variables_plan.xml.
Verify that the ../pmhub.html tag exists below ../planning.html. The following text is an example of the variables_plan.xml file:

<?xml version=”1.0″ encoding=”UTF-8″?>

    <CRNenv>

    <urls>

    <url>../planning.html</url>

    <url>../pmhub.html</url>

    </urls>

    <cookies>

    <param name=”cam_passport”/>

    <param name=”CRN”/>

    </cookies>

    </CRNenv>

Close the file.
Open C:\Program Files\ibm\cognos\ccr_64\webcontent\pmhub.html in notepad to edit it.
Edit this file to include all possible pmhub locations to the pmhubURL variable (see line 51). This enables SSO to operate.
// Update the following to point to the location of the pmhub service(s)
var pmhubURLs = [“http://mypmhubserver1:9510″,”http://mypmhubserver1.domain.com:9510”];

Make sure that the user account that is running the web server has permission to access pmhub.html. If you cannot access the pmhub.html in a web browser, check the pmhub.html file properties.
Edit the PMHub configuration screen.
In Internet Explorer, enter http://servername:port number/pmhub/pm/admin to open the configuration screen.
For example: http://tm1servername.domain.com:9510/pmhub/pm/admin
Expand the node for configurations > com.ibm.ba.pm.resource.security.dictionary and enter values for the following properties (you find the values to use inside Cognos Configuration):
CAMBIURL = http://biservername.domain.com:9300/p2pd/servlet/dispatch
CAMGatewayURL = http://biservername.domain.com:80/ibmcognos/cgi-bin/cognosisapi.dll

The values in PMHUB is saved automatic after a few seconds.
Then you need to test and ensure that Cognos Controller and Tm1web and FAP are working after this changes.
If you see the error “The planning service parameter was not specified or is not one of the configured locations”, review your settings for the planningServices parameter in the planning.html file on the Cognos BI server.

Error “The TM1Web service parameter was not specified” then;
Edit the file TM1Web.html located in the BI server to use the FQDN TM1 server name.

Example: var tm1webServices = [“http://servername.domain.com:9510”];
Note: If the file is set to use either IP or short server name you may face the error above.

More information:

http://www-01.ibm.com/support/docview.wss?uid=swg21661585

http://www-01.ibm.com/support/docview.wss?uid=swg21958925
http://www-01.ibm.com/support/knowledgecenter/SS9RXT_10.2.2/com.ibm.swg.ba.cognos.tm1_inst.10.2.2.doc/t_tm1_inst_tm1web_cogsecurity.html?lang=nl
https://www-304.ibm.com/support/knowledgecenter/SS9RXT_10.2.2/com.ibm.swg.ba.cognos.tm1_inst.10.2.2.doc/t_tm1_inst_sso_cafe.html%23t_tm1_inst_sso_cafe?lang=sv

https://www-304.ibm.com/support/knowledgecenter/SS9RXT_10.2.2/com.ibm.swg.ba.cognos.tm1_inst.10.2.2.doc/t_config_tm1_cont.html%23config_tm1_cont?lang=sv
https://www-304.ibm.com/support/knowledgecenter/SS9RXT_10.2.2/com.ibm.swg.ba.cognos.tm1_inst.10.2.2.doc/c_tm1_inst_new_10_2_2_bi_interop_kit_removed.html

http://www-01.ibm.com/support/docview.wss?uid=swg21341889
http://www-01.ibm.com/support/knowledgecenter/SSMR4U_10.2.2/com.ibm.swg.ba.cognos.express_migration.10.2.2.doc/t_express_inst_mig_install_configure_add_ad_user.html
http://www-01.ibm.com/support/docview.wss?uid=swg21882701

To get CAFÉ to work you need to do this;
https://www.ibm.com/support/knowledgecenter/SS9RXT_10.2.2/com.ibm.swg.ba.cognos.tm1_inst.10.2.2.doc/t_tm1_inst_sso_cafe.html