map the new font to the physical font name, if required
When you install Cognos 8 components, the installation uses default configuration settings. If you have any reason not to use these default values, such as a port is being used by another process, use Cognos Configuration to change the value.
If you change the value of a property, you must save the configuration and then restart the Cognos 8 service to apply the new settings to your computer.
For distributed installations, ensure that you configured all computers where you installed Content Manager before you change default configuration settings on other Cognos computers. For example you can
After you change the default behavior of Cognos 8 to better suit your Cognos environment, you can configure Portal Services, configure an authentication provider, or test the installation and configuration.
For Cognos 8, you can install and configure Framework Manager. For Metric Studio, you can install and configure Metric Designer.
If you install Cognos Content Database, the default database that is created is given a user ID and password. We recommend that you change this user ID and password.
Administration tasks for Cognos Content Database are performed using a utility named ij. For information about this utility, see the Apache Derby documentation. The documentation is available in the c8_location\derby10.1.2.1\docs directory where you installed Cognos Content Database.
On the computer where you installed Cognos Content Database, go to the c8_location\derby10.1.2.1\bin directory.
Start the ij utility using the ij.bat or ij.ksh script file.
The ij utility is a command line utility for creating and managing Cognos Content Database.
Connect to the default database by typing the following ij utility command:
connect 'jdbc:derby://localhost:1527/cm;user=cognos;password=cognos';
If you changed the port number from the default 1527, use the correct port number for your Cognos Content Database.
The default database is named cm. The database name is case sensitive.
Change the default password for the cognos user by typing the following ij utility command:
CALL SYSCS_UTIL.SYSCS_SET_DATABASE_PROPERTY('derby.user.cognos', 'NewPassword');
The new password must be used for the next connection to the database.
Close the ij utility by typing the following command:
disconnect;
On the computer where you installed Cognos Content Database, go to the c8_location\derby10.1.2.1\bin directory.
Start the ij utility using the ij.bat or ij.ksh script file.
Connect to the default database by typing the following ij utility command:
connect 'jdbc:derby://localhost:1527/cm;user=cognos;password=cognos';
If you changed the port number from the default 1527, use the correct port number for your Cognos Content Database.
The default database is named cm. The database name is case sensitive.
Create a new user by typing the following ij utility command:
CALL SYSCS_UTIL.SYSCS_SET_DATABASE_PROPERTY('derby.user.NewUser', 'NewUserPassword');
Give the new user full access to the database by typing the following ij utility command:
CALL SYSCS_UTIL.SYSCS_SET_DATABASE_PROPERTY ('derby.database.fullAccessUsers’,’cognos, NewUser');
The property that you are changing, the list of users, is a comma-delimited field. In this step, you are including the new user in the list of users with full access. The default user, cognos, is still part of the list of users with full access. You can remove the cognos user.
Close the ij utility by typing the following command:
disconnect;
On the computer where you installed Cognos Content Database, go to the c8_location\derby10.1.2.1\bin directory.
Start the ij utility using the ij.bat or ij.ksh script file.
Connect to the default database by typing the following ij utility command:
connect 'jdbc:derby://localhost:1527/cm;user=NewUser; password=NewUserPassword';
Choose the kind of user that you want to remove:
To remove a user from the list of users with full access, type the following ij utility command:
CALL SYSCS_UTIL.SYSCS_SET_DATABASE_PROPERTY ('derby.database.fullAccessUsers', 'NewUser');
You omit the user name from the list of users with full access. For example, the above command removes the default cognos user and keeps the new user that you just created.
To remove a user from the database, type the following ij utility command and omit the user password:
CALL SYSCS_UTIL.SYSCS_SET_DATABASE_PROPERTY('derby.user.cognos', '');
This command removes the password for the default cognos user, which also removes the user from the database.
Close the ij utility by typing the following command:
disconnect;
You can change certain elements in a URI depending on your environment. A Cognos URI contains the following elements:
For a Content Manager URI, Dispatcher URI for external applications, or dispatcher URI
protocol://host_name_or_IP:port/context_root/alias_path
For a Gateway URI or a Web content URI
protocol://host_name_or_IP:port/virtual_directory/gateway_application
OR
protocol://host_name_or_IP:port/context_root/alias_path
Element | Examples | Description |
protocol | http or https | Specifies the protocol used to request and transmit information, either Hyper Text Transfer Protocol or Hyper Text Transfer Protocol (Secure). |
host name or IP | localhost or 192.168.0.1 | Specifies the identity of the host on the network. You can use an IP address, a computer name, or a fully qualified domain name. In a distributed installation, you must change the localhost element of a URI. In a mixed environment of UNIX and Windows servers, ensure that host names can be resolved to IP addresses by all servers in the environment. |
port | 9300 or 80 | Specifies the port on which the host system listens for requests. The default port for Tomcat is 9300. The default port for a Web server is 80. |
context root | p2pd | Used by Tomcat or an application server to determine the context of the application so that the request can be routed to the correct Web application for processing. |
alias path | servlet/dispatch | Used by the application server to route a request to the correct component within a Web application. The alias path must not be modified or Cognos 8 components will not function properly. |
virtual directory | cognos8/ | Used by the Web server to map a virtual directory or alias to a physical location. For example, in the default Gateway URI of http://localhost:80/cognos8/cgi-bin/cognos.cgi, the virtual directory is cognos8/cgi-bin. |
gateway application | cognos.cgi | Specifies the name of the Cognos gateway application that is used. For example, if you are accessing Cognos 8 components using a Common Gateway Interface (CGI), then the default gateway application would be cognos.cgi. |
Start Cognos Configuration.
In the Explorer window click the appropriate group or component:
To change an element for the dispatcher, click Environment.
To change an element for the local log server, under Environment, click Logging.
In the Properties window, click the Value box next to the URI property that you want to change.
Select the element and type the new information.
Tip: To change the port used by the local dispatcher, change the value of the Internal dispatcher URI property. Because the change affects all the URIs that are based on the local dispatcher, you must change the URIs of all local components.
Tip: If you change the dispatcher port in the dispatcher URI, ensure that you specify the new port number when you configure remote computers that use the dispatcher, Content Manager, or SDK services on this system.
From the File menu, click Save.
Cognos 8 components require a cryptographic provider; otherwise they will not run. If you delete the default cryptographic provider, you must configure another provider to replace it.
You can configure cryptographic provider settings, including the following:
advanced algorithms
These include signing and digest algorithms.
common symmetric key store (CSK) properties
The CSK is used by Cognos 8 to encrypt and decrypt data.
signing key store properties
The signing key pair includes the private key used to generate the digital signature and the public key used to verify authenticity.
encryption key store properties
The encryption key pair includes the private key used to encrypt data and the public key used to decrypt data.
The default cryptographic provider uses keys up to 56 bits in length for data encryption and secure sockets layer (SSL) protocol. You can configure other cryptographic providers which use key sizes greater than 56 bits, such as the Enhanced Encryption Module for OpenSSL or the Enhanced Encryption Module for Entrust, available from Cognos. For more information, see the Enhanced Encryption Module for OpenSSL Installation and Configuration Guide or the Enhanced Encryption Module for Entrust Installation and Configuration Guide.
Important: In a distributed installation, Cognos computers communicate with Content Manager to establish trust and obtain some cryptographic keys from Content Manager. If you change the cryptographic keys in Content Manager, such as by changing application servers or reinstalling Content Manager, you must delete the cryptographic keys on the other Cognos computers. You must then save the configuration on each computer so that they obtain the new cryptographic keys from Content Manager. In addition, all Cognos 8 components in a distributed installation must be configured with the same cryptographic provider settings.
Also, in a distributed environment, the symmetric key should only be stored on computers where Content Manager has been installed.
Start Cognos Configuration.
In the Explorer window, under Security, click Cryptography.
In the Properties window, change the default values by clicking the Value box and then selecting the appropriate value:
On computers that do not contain Content Manager, if you do not want to store the CSKs locally, under CSK settings, change Store symmetric key locally to False.
When Store symmetric key locally is False, the key is retrieved from Content Manager when required. The Common symmetric key store location property is ignored.
If you want the computers at both ends of a transmission to prove their identity, under SSL Settings, change Use mutual authentication to True.
We recommend that you do not change the Use confidentiality setting.
If you want to change the digest algorithm, for the Digest algorithm property, select another value.
From the File menu, click Save.
Test the cryptographic provider on a gateway computer only. In the Explorer window, right-click Cryptography and click Test.
Cognos 8 components check the availability of the symmetric key.
After you configure the cryptographic provider, passwords in your configuration and any data you create are encrypted.
Start Cognos Configuration.
In the Explorer window, under Security, Cryptography, click Cognos.
If you want to change the location of the signing keys, under Signing key settings, change the Signing key store location property to the new location.
If you want to change the location of the encryption keys, under Encryption key settings, change Encryption key store location to the new location.
If you want to use a third-party certificate authority, under Certificate Authority settings, change Use third party CA to True.
You must also ensure that you use the same values for the -k parameter as you used for the Signing key store location and Encryption key store location properties.
For more information, see Configuring Cognos 8 Components to Use a Third-party Certificate Authority.
Important: The Confidentiality algorithm value determines how data is encrypted by Cognos 8 components. For example, database passwords entered in Cognos Configuration are encrypted when you save the configuration. The algorithm selected when the data is encrypted must also be available for the data to be decrypted at a later date.
The availability of confidentiality algorithms can change if there are changes to your environment. For example, if your Java Runtime Environment (JRE) has changed or if you have installed third-party cryptographic software on the computer. If you have made changes to a computer, such as upgraded the JRE or installed software that has upgraded the JRE, this may affect the availability of confidentiality algorithms. You must ensure that the Confidentiality algorithm that was selected when the data was encrypted is also available when you want to access the data.
From the File menu, click Save.
If you use a third-party Certificate Authority (CA) server, you must now configure Cognos 8 components to use the CA.
Cognos Application Firewall analyzes and validates HTTP and XML requests before they are processed by Cognos servers. Cognos Application Firewall may modify these HTTP and XML requests.
Cognos Application Firewall protects Cognos Web products from malicious data. The most common forms of malicious data are buffer overflows and cross-site scripting (XSS) attacks, either through script injection in valid pages or redirection to another Web site.
Using Cognos Configuration, you can change settings for third-party XSS tool support, and you can add host and domain names to the Cognos list of valid names.
You can track firewall activity by checking the log file, which contains rejected requests. By default, log messages are stored in the c8_location\logs\cogserver.log file.
Important: All CAF settings must be the same for all computers where Cognos 8 Application Tier Components are installed within a distributed environment. For example, if CAF is disabled on some computers and enabled on others, unexpected behavior and product errors may result.
On each computer where Cognos 8 Application Tier Components have been installed, start Cognos Configuration.
In the Explorer window, under Security, click Cognos Application Firewall.
In the Properties window, for the Enable CAF validation property, set the appropriate values.
By default, Cognos Application Firewall is enabled.
Important: The Cognos Application Firewall is an essential component of Cognos security, helping to provide protection against penetration vulnerabilities. Disabling the Cognos Application Firewall will remove this protection. Under normal circumstances we recommend that you not disable the Cognos Application Firewall.
If you are using a third-party XSS tool that checks for specific characters in GET request parameters, in the Properties window, do the following:
For the Is third party XSS checking enabled property, change the value to True.
For the Third party XSS characters property, add any additional characters that are prohibited by the third-party XSS tool. The default characters are >, <, and ’.
Add host and domain names to the Cognos list of valid names:
For the Valid domains and hosts property, click the value and then click the edit button.
In the Value - Valid domains or hosts dialog box, click Add.
You must include the domains from all hyperlinks that are added in Cognos Connection. For more information, see the topic about creating a URL in the Administration and Security Guide.
Tip: If you are using drill-through from Cognos Series 7 to reports in Cognos 8, add the hostnames of the Cognos Series 7 gateway servers to the list.
In the blank row of the table, click and then type the host or domain name.
Repeat the previous two bulleted steps for each name to be added.
Click OK.
Cognos Application Firewall validates domain and host names to protect URLs that are created. By default, Cognos Application Firewall considers domain names derived from the environment configuration properties to be safe domain names. Adding names to the list of valid names and hosts is useful when you need to redirect requests to non-Cognos computers using the Back or Cancel functions or when using drill-through to different Cognos product installations.
Save the configuration.
Restart the services.
You can change the location where Cognos 8 components store recently viewed reports, and you can choose to encrypt their content. By default, Cognos 8 components store temporary files in the c8_location\temp directory and the files are not encrypted.
We recommend that all access be denied to the temp directory, except for the service account used to start the Cognos 8 service. Read and write permissions are required for the service account.
Start Cognos Configuration.
In the Explorer window, click Environment.
In the Properties window, for the Temporary files location property, specify the new location.
If you require the content of temporary files to be encrypted, set the Encrypt temporary files property to True.
Ensure that the user account under which Cognos 8 components run have the appropriate privileges to the temporary files location. For example:
on Windows, full control privileges
on UNIX or Linux, read-write privileges
If Cognos 8 components use multiple namespaces or if anonymous access is enabled and Cognos 8 components use one namespace, you can configure the gateway to connect to one namespace. Users logged onto the Web server where the gateway is located are not prompted to choose an authentication source.
For example, if you have two Web servers, you can configure each Web server to use a different namespace.
On the computer where the gateway is located, start Cognos Configuration.
In the Explorer window, click Environment.
In the Properties window, in the Value box next to the Gateway namespace property, type the Namespace ID of the namespace you want to use.
From the File menu, click Save.
Restart your Web server.
In a distributed installation, you can send certain types of requests to specific computers by enabling or disabling the installed services.
For example, to dedicate a computer to running and distributing reports, you can disable the presentation service on a report server computer. To dedicate a computer in a distributed installation to processing Metric Studio application requests, disable the Data Integration Service on the computer.
Note: The default values for dispatcher service and presentation service are false on computers that have the Content Manager only installed. On all other types of installations, the default values are true.
If you installed all components on several computers, you can disable appropriate services on each computer to get the distributed configuration you require. Requests are sent only to dispatchers where a given service is enabled.
Disabling a service prevents the service from loading into memory. When disabled, services do not start and therefore do not consume resources. The service does not run until you enable it.
If you disable the dispatcher service, all services that run under that dispatcher are also disabled. Only dispatcher services that are enabled can process requests.
Start Cognos Configuration.
In the Explorer window, under Environment, click Cognos 8 service.
In the Properties window, click the Value next to the service that you want to disable or enable.
By default, all services are enabled.
Click the appropriate state for the services:
To disable the service, click False.
To enable the service, click True.
From the File menu, click Save.
To improve performance in a distributed environment, you can change the amount of resources that the Cognos 8 service uses by choosing a configuration template.
By default, the Cognos 8 service is configured to use minimal memory resources to optimize startup time.
The configuration template settings apply only to Tomcat, the application server that Cognos 8 uses by default. If you want to configure Cognos 8 to run on another application server, do not use Cognos Configuration to configure the resources. Instead, configure the resources within that application server environment. For more information, see Configuring Cognos 8 for a Third-Party Application Server.
The Cognos 8 service is available only on the computers where you installed Content Manager or the Application Tier Components.
Start Cognos Configuration.
In the Explorer window, under Environment, Cognos 8 service, right-click Cognos 8, and click Delete.
This deletes the default configuration template for the service.
Right-click Cognos 8 service, and click New resource, Configuration.
Type a name for the service.
In Windows, the name you choose is used to register the service. You will see this name in the list of services running on your computer.
In the Type box, click the configuration template to use:
If you previously changed the default setting and now want to reduce the startup time, memory footprint, and resources used, click Small configuration.
If you want a balance between fast startup time and quick operating speeds, click Medium configuration.
If you want to maximize operating speeds and if performance is more important than fast startup time, and if your computer has a lot of resources, click Large configuration.
In the Properties window, edit the properties so that they are appropriate for your environment.
From the File menu, click Save.
Cognos 8 components use fonts to render PDF reports on the Cognos server. Cognos 8 components also use fonts to render charts used in PDF and HTML reports.
To show output correctly, fonts must be available where the report or chart is rendered. In the case of charts and PDF reports, the fonts must be installed on the Cognos server. If a requested font is not available, Cognos 8 components substitute a different font.
Because HTML reports are rendered on a browser, the required fonts must be installed on the computer of each Cognos user who will read the HTML report. If a requested font is not available, the browser substitutes a different font.
If you want to use a new font in your reports, you must
| | add the font to the list of supported fonts |
| | specify the file location of the new font |
| | map the new font to the physical font name, if required |
You can add fonts to the list of supported fonts in your Cognos environment if you want to generate reports that use fonts that are currently not available. You can also remove fonts.
By default, Cognos 8 components use a set of global fonts, which are available on all Cognos server computers.
On each Content Manager computer, start Cognos Configuration.
From the Actions menu, click Edit Global Configuration.
Click the Fonts tab.
Click Add.
Tip: To remove a font from the list of supported fonts, click the box next to the font name and then click Remove.
In the Supported Font Name box, type the font name and then click OK.
From the File menu, click Save.
All global fonts, including new fonts that you add, must be installed on all Cognos computers in your environment.
If a global font is not installed on all Cognos computers, you must map the global font to an installed, physical font.
You must specify the installation location of all fonts, including fonts that you add to the list of supported fonts.
By default, the list of fonts consists of fonts installed in the c8_location\bin\fonts directory of the Cognos computer. If Cognos 8 components are installed on a Windows computer, they also use the fonts installed in the Windows font directory.
You specify the font location on all computers where Application Tier Components are installed.
On each Application Tier Components computer, start Cognos Configuration.
In the Explorer window, click Environment.
In the Properties window, for the Physical fonts locations property, specify the location of the fonts.
If there are multiple font paths, separate each path by a semicolon (;).
If you are using an application server other than Tomcat, type the fully qualified path to the font location. For example: c8_location/bin/fonts.
From the File menu, click Save.
You can substitute global fonts, which are not installed on the computer, for physical fonts.
You map fonts on each computer where the report server is installed.
For example, you add a font to the list of supported fonts that is not installed on the Cognos computer. You can specify which font to use as a substitute.
If you want to print reports faster by using the built-in PDF fonts, you can map a global font such as Arial to one of the built-in PDF fonts, such as Helvetica-PDF, by following the steps below. You can also select one of the built-in PDF fonts for a text object in Report Studio or Query Studio. For more information, see the Query Studio User Guide or the Report Studio Professional Authoring User Guide.
No mapping is required if you add a font to the supported font list that is installed on Cognos computers. However, you must specify the location of the font.
On each Application Tier Components computer, start Cognos Configuration.
In the Explorer window, click Environment.
In the Properties window, click the Value box next to the Physical fonts map property, and then click the edit button.
The Value - Physical fonts map dialog box appears.
Click Add.
Tip: To remove a font, select the check box next to the font and click Remove.
In the Global Font Name box, type the name of the font you added to the supported font list.
Click the Physical Font Name box.
If you know the physical font name, type it. Otherwise, click the edit button. In the Physical Font Name dialog box, click Search Now and then click a font name from the results.
Repeat steps 4 to 7 for each global font that requires mapping.
Click OK.
From the File menu, click Save.
Now, if required, you must specify the installation location of the fonts.
You can change the default font that Cognos 8 components use for PDF reports. You see this default font when you open a report.
You change the default font on the computer where Content Manager is installed. After you make the change, the font becomes the default for all computers in your installation. You change the font used for PDF reports using Cognos Configuration.
Ensure that the default font is installed on all computers in your Cognos installation.
On each Content Manager computer, start Cognos Configuration.
From the Actions menu, click Edit Global Configuration.
Click the General tab.
In the Value box, for Default font, type the font you want to use as the default for reports.
Click OK.
From the File menu, click Save.
On all Application Tier Components computers, ensure that the installation location of the default font is specified in the Physical fonts locations property (under Environment in the Explorer window) or that the font is in the Windows font directory.
When a PDF report opens in Adobe Reader, all the fonts used in that report must be available. Fonts must be either embedded in the report or installed on the user’s computer. If a font is not available in either of these locations, Adobe Reader tries to substitute an appropriate font. This substitution may cause changes in the presentation of the report or some characters may not be displayed.
To ensure that PDF reports appear correctly in Adobe Reader, Cognos 8 embeds required fonts in reports by default. To minimize the file size, Cognos 8 embeds only the characters (also called glyphs) used in the report rather than all characters in the font set. Cognos 8 embeds fonts only if they are licensed for embedding. The license information is stored in the font itself and is read by Cognos 8.
If you are confident that the fonts used in reports are available on users’ computers, you can limit or eliminate embedded fonts to reduce the size of PDF reports. When limiting fonts, you specify whether a font is always or never embedded, using an embedded fonts list in Cognos Configuration.
On the Content Manager computer, start Cognos Configuration.
In the Explorer window, click Environment.
In the Properties window, under Font Settings, click the value for Fonts to embed (Batch report service) or Fonts to embed (Report service), and then click the edit button.
If you are not using the default fonts directory or if you want to add a path to an additional directory, in the Fonts to Embed in PDF Reports dialog box, specify the new path in the font paths box.
Tip: Click Search Now to get a list of the available fonts in the specified path or paths.
For a font that will always be available on users’ computers, scroll to the font name, and click the Never check box.
Cognos 8 does not embed the font with any reports. Adobe Reader picks up the font from the user’s computer when the report is opened.
For a font that may not always be available on the users’ computers, scroll to the font name and click the Always check box.
Cognos 8 embeds the font with all reports that use it. Adobe Reader uses the embedded font when the report is opened.
Click OK.
By default, report output files are saved in the content store. You have the option of saving a copy of the report output in another file location that is outside or inside Cognos 8. If you use this option, a descriptor file with an _descr extension is also saved. Saved files are not managed by Cognos 8.
If you configure a file system location that is outside of Cognos 8, you can then share the report output with external applications or people who don’t have Cognos 8. This is how most report output files are saved.
To use this feature, you must first configure a root directory in Cognos Configuration. An administrator must then set the file location in Cognos Administration. For more information, see the topic about setting a file location for report output saved outside of Cognos 8, in the Administration and Security Guide.
Create a directory for your file system.
Tip: Ensure that the directory is accessible to users and separate from the installation directory. For example, in a distributed installation, an archive folder such as \\servername\directory could be used.
On the Content Manager computer, start Cognos Configuration.
From the Actions menu, click Edit Global Configuration.
In the Global Configuration window, click the General tab.
For Archive Location File System Root, type a URI using the format
file://directory
where directory is the directory that you created in step 1.
The file:// portion of the URI is required. Windows UNC names, such as \\servername\directory, can be used. If so, the URI must be formatted as follows:
file://\\servername\directory
To confirm that the correct location will be used, click Test.
Click OK.
From the File menu, click Save.
The administrator must now configure the file location. For information, see the topic about setting a file location for report output saved outside of Cognos 8, in the Administration and Security Guide.
If you configure a file system location that is inside Cognos 8, you can then use the report output again. This may also be useful for archive purposes, because files that are saved in the Content Store may be deleted regularly due to retention rules.
To use this feature, you must first enable the Save report outputs to a file system property in Cognos Configuration. An administrator must then configure the file location using the CM.OutPutLocation parameter in Cognos Administration. For more information, see the topic about setting a file location for report output saved inside Cognos 8, in the Administration and Security Guide.
Create a directory for your file system.
Tip: Ensure that the directory is accessible to authorized users only.
On the Content Manager computer, start Cognos Configuration.
In the Explorer window, click Data Access, Content Manager.
For the Save report outputs to a file system property, click True.
To test the connection to the report output directory, from the Actions menu, click Test.
From the File menu, click Save.
The administrator must now configure the file location using the CM.OutPutLocation parameter. For information, see the topic about setting a file location for report output saved inside Cognos 8, in the Administration and Security Guide.
Cognos 8 comes with a set of sample map charts that you can use in Report Studio. By default, the map charts are stored in the c8_location\maps directory on the Application Tier Components computer. You can change the location of the map charts by using Cognos Configuration.
For more information about using map charts, see the Report Studio User Guide.
For information about using custom maps from third-party sources, see the Map Manager Installation and User Guide.
On the Application Tier Components computer, start Cognos Configuration.
In the Explorer window, click Environment.
In the Properties window, click the value for Map files location.
Click the edit button.
In the Select Folder window, navigate to the directory you want and then click Select.
From the File menu, click Save.
