Product:
Planning Analytics 2.0.3 (Tm1)
Cognos Analytics 11.0.9 (Cognos BI)
Microsoft Windows 2012 R2 Server
Issue:
When a user is added to a AD group, that then is added to Cognos group, and the Cognos Group is added in the TM1 application as a group. And that group is given access to cubes and dimensions inside TM1. When user login to TM1WEB, he can not see the cubes.
If you look inside TM1 Architect, there is no X for him under the Cognos\group. So Cognos have not understand that he belongs to a AD group.
Solution:
IBM Cognos service run as local system in Windows server.
The Active Directory is setup to allow user to login but not to see other users details, like groups.
You need to at Namespace – Resource Properties – Binding credentials enter the name and password of a user that have the rights to READ the Active Directory and see what groups a user belongs to.
When you right click on namespace in cognos configuration and select test, you will first validate the user and there after try to get a list of the groups the user belongs to.
You need the binding credentials if AD is not configured to allow anonymous bind.
In TM1 you can add the Cognos group or the AD group direct into TM1 Architect under security – client/groups. Click on Groups and Add New Group. Click on your namespace and search for the group you want to add. When it is added it will look similar, as in the picture above.
If a user is successful to login and belongs to a group, there will be a X under that group for that user. User AD/roger can we see belongs to the Cognos group “TM1 users”.
Then you have to, inside your TM1 application, give the groups the access they need to the different cubes and dimensions.
More Information:
https://www.ibm.com/support/knowledgecenter/SSEP7J_10.2.2/com.ibm.swg.ba.cognos.inst_cr_winux.10.2.2.doc/t_inst_activedirectoryserver_process.html