Product:
Planning Analytics 2.0.8
Microsoft Windows 2016 server

Problem:
What is the requirements for the windows service account to run TM1 servers?

Solution (from IBM web):

User accounts for running TM1 services on Windows

https://www.ibm.com/support/knowledgecenter/en/SSD29G_2.0.0/com.ibm.swg.ba.cognos.tm1_inst.2.0.0.doc/c_tm1serviceaccount_n701df.html

The account must have the following privileges on the local computer:

Act as part of the operating system

Bypass traverse checking

Increase quotas (Adjust memory quotas for a process)

Replace a process level token

Log on as a service

Have read and write privileges on the Windows Registry item

If you use “local system” you will not be able to use Kerberos, or have access to read csv files from external file shares.

https://www.ibm.com/support/knowledgecenter/SSD29G_2.0.0/com.ibm.swg.ba.cognos.tm1_inst.2.0.0.doc/c_integratedlogin_nc0007.html#IntegratedLogin_NC0007

In integrated login mode (security mode 3), TM1 authentication compares the user’s domain-qualified Microsoft Windows login name to the contents of the UniqueID element of the }ClientProperties cube.

If there is a match, the user is authenticated to TM1. If Active Directory groups have been imported into the TM1 Server, Active Directory group memberships are honored.

If no match is found, TM1 displays an error message stating that the client name does not exist. TM1 Server does not prompt for login information.

Users who want to access TM1 data in a server that is configured for integrated login must authenticate to Microsoft Windows first and then use TM1 clients to access the TM1 Server.

https://www.ibm.com/support/knowledgecenter/SSD29G_2.0.0/com.ibm.swg.ba.cognos.tm1_inst.2.0.0.doc/t_settingupintegratedloginmanually_nc0644.html

 

1. Run ETLDAP and import the user and group information from your LDAP server, as described in Running ETLDAP. Or update the }ClientProperties cube with other TI scripts.
   
2. Shut down the TM1 Server.
3. Edit the following parameters in the tm1s.cfg file located in your TM1 Server data directory:
   • Set the IntegratedSecurityMode parameter to 3.
   • Set the SecurityPackageName parameter to the security protocol you use for integrated login.

   In the following example, the server is configured to use Kerberos.

   [TM1S]
   SecurityPackagename=Kerberos
   IntegratedSecurityMode=3
   Servername=myserver
   DatabaseDirectory=datafiles

4. Save and close the tm1s.cfg file.
5. Restart the TM1 Server.
6. Optional: Configure the TM1 clients to use integrated login by setting the Use Integrated Login option in the associated user interface.

Follow the directions from IBM knowledge articles for most accurate information.

https://www.ibm.com/support/knowledgecenter/SSD29G_2.0.0/com.ibm.swg.ba.cognos.tm1_inst.2.0.0.doc/c_parametersinthetm1s.cfgfile_n1503fe.html

More Information:

Enabling Cognos single signon to use Kerberos authentication with constrained delegation

https://www.ibm.com/support/knowledgecenter/en/SSEP7J_11.0.0/com.ibm.swg.ba.cognos.inst_cr_winux.doc/t_inst_sso_active_drctry_constrained_del.html

You must configure the constrained delegation in the Active Directory Users and Computers administration tool. On the Delegation tab for all users (IISUser, CognosCMUser, and CognosATCUser), you must select Trust this user for delegation to specified services only and Use Kerberos only to use Kerberos with constrained delegation. Select Trust this user for delegation to specified services only and Use any authentication protocol if you are using the S4U Kerberos extension.