Built-in Cognos Security administration is quite awkward (compared to so long gone Access Manager, sigh), so questions like above are so frequent. There are 3 main solutions:

1) Buy an externally developed tool from BSP or Motio. I had a chance to look at BSP MetaManager recently and it does a whole lot of stuff to make your administration life easy. Bit of an overkill to just ask “who’s there”, but totally worth it if you’re going big scale \ long term.

2) Buy an SDK license and use the sample script from IBM as a base and extend it just for this task and then use SDK left and right to do anything you want in Cognos. If you have an SDK license through some global license deal — the sample script maybe just what you need to get the job done.

3) Write SQL queries to Content Store database to return just this info. It’s an unsupported (I’ll even stress this) unsupported way of doing it, but if you just want to have a quick look or are happy to loose it at some upgrade point (although it works on both 8.4 and 10.1, CS database schema isn’t changing that much), here are the scripts for both MS SQL Server and Oracle.

I used the script from this SQL.RU topic as a base and added group nesting unwrapping with Connect By in Oracle and CTE’s in SQL Server. You can turn this SQL into FM query subject and have a nifty report.

Oracle

SELECT DISTINCT parent_group_id,
                  group_info.name group_name,
                  user_info.ldap_id,
                  user_info.last_name,
                  user_info.first_name,
                  user_info.email,
                  user_info.user_id
                  FROM
    ( --unwrapping groups and roles hierarchy, by recursively connecting all child roles or groups to parent
    SELECT rel.cmid parent_group_id, grp.cmid child_group_id  FROM
    cmreford1 rel, cmobjects grp
    WHERE
    rel.refcmid = grp.cmid
   AND grp.classid IN (26, 54) -- groups and roles
    CONNECT BY PRIOR  rel.cmid = grp.cmid
    -- adding groups that just have users directly without any parent groups
    UNION ALL
    SELECT rel.cmid parent_group_id, rel.cmid child_group_id  FROM
    cmreford1 rel, cmobjects grp
    WHERE
    rel.refcmid = grp.cmid
    -- users
   AND grp.classid IN (5)
   -- no parents
   AND rel.cmid NOT IN
   (
    SELECT rel.refcmid child_group_id  FROM
    cmreford1 rel
   )
    ) grp_unwrapped,
    cmreford1 user_group_relation,
    ( -- user information
    SELECT c33.cmid user_id, c33.NAME AS ldap_id,
                     c1.surname last_name, c1.givenname first_name,
                     c1.email email, c1.objid
               FROM cmobjprops1 c1
               LEFT JOIN cmobjprops33 c33 ON c33.cmid = c1.cmid
               UNION
               SELECT cmobjprops1.cmid user_id, cmobjprops33.NAME AS ldap_id,
                      cmobjprops1.surname last_name,
                      cmobjprops1.givenname first_name, cmobjprops1.email,
                      cmobjprops1.objid
                 FROM cmobjprops1, cmobjprops33
                 WHERE cmobjprops1.cmid = cmobjprops33.cmid
             ) user_info,
    ( -- group_information
      SELECT cmobjnames.cmid cmid, cmobjnames.NAME AS NAME,
                    cmobjects.created created, cmobjects.modified modified,
                    cmobjects.disabled disabled,
                    cmobjects.classid
               FROM cmobjects, cmobjnames
               WHERE cmobjects.cmid = cmobjnames.cmid
                    AND cmobjects.classid IN (26, 54)
                     --search in english groupnames only, remove this filter to search any language
                     AND  cmobjnames.mapdlocaleid = 24
    ) group_info
  WHERE (1=1)
  AND user_group_relation.cmid = grp_unwrapped.child_group_id
  AND user_group_relation.refcmid = user_info.user_id
  AND group_info.cmid = grp_unwrapped.parent_group_id
 
-- add your filters here
-- search by group name like
 
AND group_info.name LIKE '%Planning%Users%'
 
-- or search by user name like
 -- and user_info.ldap_id like '%Jack%Smith%'

MS SQL Server

WITH groups_unwrapped (parent_group_id, child_group_id, lvl)
AS
(
SELECT rel.cmid parent_group_id, grp.cmid child_group_id, 0 lvl FROM
cmreford1 rel, cmobjects grp
WHERE
rel.refcmid = grp.cmid
AND grp.classid IN (26, 54)
-- highest ranking groups, without any parents for anchor expression
AND rel.cmid NOT IN
(SELECT grp.cmid child_group_id FROM
cmreford1 rel, cmobjects grp
WHERE
rel.refcmid = grp.cmid
AND grp.classid IN (26, 54)
)
UNION ALL
SELECT rel.cmid parent_group_id, grp.cmid child_group_id, lvl + 1 FROM
cmreford1 rel, cmobjects grp, groups_unwrapped unwp
WHERE
rel.refcmid = grp.cmid
AND grp.classid IN (26, 54)
AND rel.CMID = unwp.child_group_id
)
SELECT DISTINCT parent_group_id,
group_info.name group_name,
user_info.ldap_id,
user_info.last_name,
user_info.first_name,
user_info.email,
user_info.user_id
FROM
(
SELECT * FROM groups_unwrapped
-- adding just groups with users, without parents
UNION ALL
SELECT rel.cmid parent_group_id, rel.cmid child_group_id, 0 lvl FROM
 cmreford1 rel, cmobjects grp
 WHERE
 rel.refcmid = grp.cmid
 -- users
 AND grp.classid IN (5)
 -- without any parent groups
 AND rel.cmid NOT IN
 (SELECT rel.refcmid child_group_id FROM
 cmreford1 rel
 )
)
grp_unwrapped,
cmreford1 user_group_relation,
( -- user information
SELECT c33.cmid user_id, c33.NAME AS ldap_id,
c1.surname last_name, c1.givenname first_name,
c1.email email, c1.objid
FROM cmobjprops1 c1
LEFT JOIN cmobjprops33 c33 ON c33.cmid = c1.cmid
UNION
SELECT cmobjprops1.cmid user_id, cmobjprops33.NAME AS ldap_id,
cmobjprops1.surname last_name,
cmobjprops1.givenname first_name, cmobjprops1.email,
cmobjprops1.objid
FROM cmobjprops1, cmobjprops33
WHERE cmobjprops1.cmid = cmobjprops33.cmid
) user_info,
( -- group_information
SELECT cmobjnames.cmid cmid, cmobjnames.NAME AS NAME,
cmobjects.created created, cmobjects.modified modified,
cmobjects.disabled disabled,
cmobjects.classid
FROM cmobjects, cmobjnames
WHERE cmobjects.cmid = cmobjnames.cmid
AND cmobjects.classid IN (26, 54)
--search in english groupnames only, remove this filter to search any language
AND cmobjnames.mapdlocaleid = 24
) group_info
WHERE (1=1)
AND user_group_relation.cmid = grp_unwrapped.child_group_id
AND user_group_relation.refcmid = user_info.user_id
AND group_info.cmid = grp_unwrapped.parent_group_id
 
-- add your filters here
-- search by group name like
 
AND group_info.name LIKE '%Consumer%'
 
-- or search by user name like
-- and user_info.ldap_id like '%Jack%'

Well, the biggest change was trivial: I’ve forgot everything

But that turned out to be good news, since version 8.3 to version 10 changes are huge. I remember reading SDK Developer Guide overnight for 8.3, but now it’s 3,500+ pages long! As it turns out, you can still read all the needed stuff in a short time period, but understanding what to read is a challenge.

So it’s best to start with this proven practice article, providing some kind of helicopter view of what can be achieved by what parts of SDK.

From there, I suggest you dive into sdk\samples folder and look through the code provided there. However complicated it may look, it’s actually way more integrated than any Knowledge Base\Technote code sample you can download, since extending those turns into rewriting the built-in samples functionality. Trust me on this, I’ve spent half a day doing exactly that before giving up and building upon existing samples.

Where to look when you’re stuck trying to understand a code piece or function? I used javadoc generated documentation instead of Developer Guide, because it’s Java-specific. I used Developer Guide just like an overall Class&Methods reference.

Some more SDK sample links:

Cognoise SDK for Cognos 8 forum

Cognoise SDK for Cognos 10 forum

IBM SDK-related articles and Technotes

PS: It’s funny, I’ve wrote both TM1 Java API code and BI 10 SDK in last three months ) Can’t think about any combined methods that’d be useful. Any ideas?

Just a quick Cognos BI hint: you can use session variables to store project-level constant values.

1) Add a session variable to your Framework project, write your required constant value there. Like ‘servername’ = ‘awesomebi’

2) Use it in Report Studio, just type

#sq($variable_name)#

in expression editor. sq encloses string in single quotes.

It seems that the easiest way to gain full article list is to filter by cognos_business_intelligence tag. This reminds of one of my former bosses who inquired Oracle, whether they had special training on how to find content on their site.

I ended throwing RSS-feed for this search in my reader, so I hope not to miss any updates.

Comments:

1. You can separate all components (Gateway, Application Server, Content Manager) into separate machines
2. There can be only one Content Manager service active in cluster at a time
3. There may be multiple gateway servers, as I was corrected. What I originally meant was close to something like ‘if you give user a cognos url, that url points to one specific gateway server’, so you have to do clustered web-server and application server installation for gateway fault-tolerance.
4. There may be multiple active dispatchers in cluster
5. Each dispatcher consists of multiple services, that may be turned off or on for a specific server in cluster.
6. Most dispatcher services are processed in application server (Tomcat by default and almost any other of your choice), which can use either 32 or 64 bit java machine
7. Reports (interactive and batch) are processed by a special process ‘BIBus’, which is a C++ 32 bit application (hence the 2Gb cap for each process and CCLOutOfMemory errors). Number of such processes depends on Dispatcher service settings, load on each process depends on affinity connection settings.
8. BIBus processes generate temporary files if they require significant amount of local processing (hence UDA files problems)
9. Each BIBus process can occupy up to 2Gb RAM and 1 CPU Core

Basic rules for capacity planning I use (your mileage may vary greatly, it depends on reports design, size and calculation complexity in first hand):

1. Estimate number of concurrent users
2. There should be a BIBus process for each couple concurrent users
3. There should be at least 1 or 2 cores for all other dispatcher services
4. There should be at least 1-2 Gb of RAM for Application Server
5. There should be at least 2-3 Gb for Operation System (it depends on operation system greatly)
6. There should be a separate database instance for Content Store and Audit database

For example, if we’re talking about 20 concurrent users (mind that it’s 2000 named users by basic IBM metrics), we’ll need:

• 10 BIBus processes, each will take 1 Core and 2 GB Ram
• 2 cores and 2 Gb ram for dispatcher and application server (for each dispatcher server, if there going to be a cluster environment)
• 3 Gb for operating system (for each dispatcher server, if there going to be a cluster environment)

And it gives us 16 cores, 32 Gb RAM for a single server.

Suggested reading:

– Architecture and Deployment Guide )

– these threads on DeveloperWorks, where Phil W. describes all this way better than I’ll ever do:

http://www.ibm.com/developerworks/forums/thread.jspa?messageID=14233120

Really, there is a Speed = True parameter in Transformer MDL.  I adore developer’s sense of humour )

PS: There’s so much going on lately — hold on for some interesting news & posts.

And there’s an absolute must-read article about new TM1 9.5.2 Parallel Interaction feature.
I’m actually asonished to see an article of such depth in support knowledge base. It contains detailed explanation:
- of how things worked before, common problems and workarounds
- what has changed in server engine
- how will this change affect current systems
It’s actually terrific, I’d kill to get more of such articles on tools I work with, not just ‘try reinstalling ones’.

On an unrelated note: I’ve uploaded updated versions of tm1 stress testing tool (with more input parameters) and tm1 model comparison tool (just some bug fixing).

And on another unrelated note: I was nominated an IBM Information Champion again. Thank you all for reading this blog )

Given all of the above, powerplay is a nice single-user tool with friendly modeling gui or an OLAP-server in ‘small-data’ enviroment. As a single user tool it will be replaced by PowerPivot and as an OLAP-server it will be replaced by TM1 (which I’m not happy with — see following posts) or Microsoft Analysis Services.