Cognos 8 provides support for accessing secured Cognos cubes as data sources. These cubes include PowerCubes generated by Transformer 7.3 and later, Cognos Finance multi-dimensional cubes, and Cognos Planning - Contributor cubes. To access a Cognos cube that is secured to a Series 7 namespace, you must first log into the Series 7 namespace.

Transformer 8.3 supports Cognos 8 security, including the Series 7 namespace. You can also transition custom views to the Cognos 8 namespace. When you connect to a Cognos cube that is secured with Cognos 8 security, you must be logged into the namespace the cube was designed with before accessing the cube.

For information about integrating Cognos Finance multi-dimensional cubes in your Cognos 8 environment, see the Cognos Finance User Guide. For information about connecting to the Cognos Planning - Contributor unpublished (real-time) data, see the Cognos Planning Installation Guide.

Cognos supports the deployment of Cognos 8.3 PowerCubes in production environments that are secured against a single namespace. PowerCubes that are secured against multiple namespaces are not supported in production environments. For this reason, when you deploy cubes for use in production, ensure that they are secured against one namespace. To do this, select the option Restrict PowerCube authentication to a single namespace in the Signon properties. For more information, see the Transformer User Guide.

For PowerCubes, the connection information in Cognos Connection provides both a Windows and UNIX path to a cube file. If all of your report servers are installed on Windows computers, you need only use the Windows path in Cognos Connection. Similarly, if all of your report servers are installed on UNIX computers, then you need only use the UNIX path in Cognos Connection.

Note: If you are using Framework Manager, the Windows path to the PowerCube is required.

If you have report servers installed on both Windows and UNIX computers and you want the report server running the request to have access to the PowerCube in both environments, you can use both the Windows and UNIX paths in Cognos Connection. To ensure that the same data is returned regardless of the environment in which the report server accesses the cube, the same cube file must be saved in the locations specified by the Windows and UNIX paths in Cognos Connection.

PowerCubes can only be created in the Linux environment if you are using Transformer 8.3 and a Cognos 8 security provider. However, you can deploy secured Series 7 PowerCubes to Linux computers running as report servers in the Cognos 8 environment. The Content Manager computer must be running on a Series 7-compliant platform.

Tips

• If you are testing the migration of your Series 7 PowerCubes to Cognos 8, you can select the authenticate with All applicable namespaces method.

• If a PowerCube that you have already created a connection for has to be updated, you can update the connection in Cognos 8 without affecting users who may be currently accessing the original PowerCube.

• When you use Series 7 PowerCubes as data sources, we recommend that you optimize them for Cognos 8. Optimized PowerCubes provide faster data retrieval at runtime. You optimize PowerCubes using a command line utility named pcoptimizer, which is supplied with Cognos 8. For more information about optimizing PowerCubes, see the Troubleshooting section in this guide.

• If a cube contains security views and you are logged on as Anonymous, you will receive an error message. This is because Cognos 8 cannot validate the user "Anonymous" against the Cognos 8 namespace user credentials. To avoid this situation, log on to the Cognos 8 namespace with a user ID and password, and then publish the cube.

If a cube has secured its data using user classes from a Series 7 namespace, you will have to select the namespace to be used for authentication. If the options are disabled or the namespace is not listed, see "Configuring Cognos 8 Components to Use Cognos Series 7" in the Cognos 8 Installation and Configuration Guide for how to identify a Series 7 namespace to your Cognos 8 environment.

Tip: If a PowerCube has been rebuilt, you can update the connection information without affecting current users. For information about updating existing data source connections, see the Cognos 8 Administration and Security Guide.

Depending on the types of Microsoft SQL Server data sources you are using, there are considerations you should keep in mind when defining some types of authentication.

Authentication Using Cognos 8 Service Credentials

When connecting to Microsoft SQL Server using OLE DB, you can select Cognos 8 Service Credentials as the signon type for the data source connection. This property instructs Cognos 8 to log on to the SQL Server database using the logon specified for the Cognos 8 service. Users do not require individual database signons. However, all users will authenticate to the database with the same credentials and will have the same view of the data. For production environments, individual database signons are generally more appropriate.

You should not use a Windows local system account for the Cognos 8 server logon with a Microsoft SQL Server OLE DB data source.

Authentication Using an External Namespace

You can configure Cognos 8 to use a Microsoft Active Directory namespace, where users are prompted for credentials as part of the Cognos 8 logon process. You can configure Cognos 8 to use these same credentials automatically when accessing the Microsoft SQL Server data source. The data source connection for Microsoft SQL Server must be configured for An External Namespace and that namespace must be the Active Directory namespace.

You can configure Cognos 8 to use a Microsoft Active Directory namespace and to authenticate users for Cognos 8 using Kerberos authentication and delegation. You can configure Cognos 8 to automatically authenticate the user when accessing the Microsoft SQL Server data source. The following configuration is required:

• The Cognos 8 gateway must be installed on an IIS Web server that is configured for Windows Integrated Authentication.

• Content Manager must be installed on a Windows 2003 or Windows XP server.

• Content Manager, the report server (Application Tier Components), IIS Web server, and the data source server (Microsoft SQL Server) must belong to the same Active Directory domain.

• The data source connection for Microsoft SQL Server must be configured for An External Namespace and that namespace must be the Active Directory namespace.

• The report servers are trusted for delegation.

For more information about installation options for the gateway and Content Manager, as well as configuring the namespace and delegating trust, see the Cognos 8 Installation and Configuration Guide.

Named sets are imported and stored as read-only calculations in the Framework Manager model. The calculation has a flag that identifies it as a named set, and a property that contains the dimension name.

When creating a connection to a Microsoft Analysis Services data source, you must specify a language. By default, the language is set to that of your computer’s regional setting. You can have only one language selection for a connection. For more information, search the Microsoft Web site (http://www.microsoft.com) or Microsoft Support Web site knowledge base (http://support.microsoft.com) for "locale identifier property".

If you want to publish a Framework Manager model that uses a different locale setting than a previously published model, you must first restart the Cognos 8 service.

Cognos 8 and PowerPlay Enterprise Server support connectivity to Microsoft Analysis Services only from a Windows platform, and both require the Microsoft Pivot Table client libraries. The following configuration is required:

• Cognos 8 Service must run as a domain account, and this domain account must be trusted for delegation and impersonation because it will present the user’s credentials to Microsoft Analysis Services.

• The domain account should be added in local security settings in your Windows operating system administration tools.

  Note: You must restart your server after changing this property.

• The domain account should be a member of the OLAP Administrators group on the Microsoft Analysis Services computer.

• The OLE database for OLAP (ODBO) client must be installed. This is included in the Microsoft Analysis Services installation files.

Authentication to an External Namespace

You can configure Cognos 8 to use a Microsoft Active Directory namespace, where users are prompted for credentials as part of the Cognos 8 logon process. You can configure Cognos 8 to use these same credentials automatically when accessing the Microsoft Analysis Services data source. You must configure the data source connection for Microsoft Analysis Server for An External Namespace and that namespace must be the Active Directory namespace.

You can configure Cognos 8 to use a Microsoft Active Directory namespace and to authenticate users for Cognos 8 using Kerberos authentication and delegation. You can configure Cognos 8 to automatically authenticate the user when accessing the Microsoft Analysis Services data source. The following configuration is required:

• The Cognos 8 gateway must be installed on an IIS Web server that is configured for Windows Integrated Authentication.

• Content Manager must be installed on a Windows 2003 or Windows XP server.

• Content Manager, the report server (Application Tier Components), IIS Web server, and the data source server (Microsoft Analysis Server) must belong to the same Active Directory domain.

• The data source connection for Microsoft SQL Server must be configured for An External Namespace and that namespace must be the Active Directory namespace.

• The report servers are trusted for delegation.

For more information about installation options for the gateway and Content Manager, as well as configuring the namespace and delegating trust, see the Cognos 8 Installation and Configuration Guide.

Named sets are imported and stored as read-only calculations in the Framework Manager model. The calculation has a flag that identifies it as a named set, and a property that contains the dimension name.

If you are connecting to an ODBC data source that has been set up as a user DSN, ensure that the service using the connection is running as the user who created the data source. System DSNs are not restricted to the user who created the data source.

Note: In order to create and test reports with user DSN data sources, you must set up the Cognos8 service with a user account. User DSN data sources are invisible under a system account.

When you create connections to ODBC data sources, select the vendor-specific data source type, such as Microsoft SQL Server (ODBC), from the Type menu in the New Connection wizard.

Select ODBC to connect to an ODBC data source type that does not appear in the menu.

Simple Outline

Use simple outline if you primarily run simple queries and use numerous cubes. If you use this option for large cubes, your queries may take a long time to run. Large temporary files may also be created as Essbase builds the necessary grid. After the grid is created, these queries typically run faster and do not increase network traffic. However, more memory is consumed.

This option is the default behavior in the Cognos environment.

Query Outline

Use query outline if you run numerous, complex, or advanced queries that use Cognos 8 features such as nested filtering or sorting.

To enable this option, edit the qfs_config.xml file in the cognos 8 location\configuration directory. Type the following line at the end of the <parameters> subsection of the DB2OlapODP provider section:

 <parameter name="UseSecondOutline" value="true"/>

If you create an XML data source, you must use XML as the type of connection and specify the location of the XML document in the connection string.

You can specify the connection string for an XML data source as:

• an HTTP URL that identifies the content store required to connect to the XML document.

  An example is HTTP://xmltestserver.cognos.com/XML/country.xml.

  Ensure that you create a Web alias for the directory that contains the XML file and that you enable directory browsing.

• a file path

  A Windows file path example is \\servername\XML\country.xml.

  A UNIX file path example is /mount name/XML/country.xml.

• a local file

  An example is C:\XML\country.xml;VALIDATE=ON.

To access a local file, use a file path that uses platform-specific syntax.

To test an XML connection string, you must type the following code at the end of the string:

;VALIDATE=ON

The text of this code is not case sensitive.

Parameterized XML Connection Strings

In an HTTP URL connection string for an XML data source, you can use parameters to send additional information. You can embed a prompt definition string in the parameter component.

If the prompt definition is specified in the report, that value is used. Otherwise, the user is prompted to supply a value. Prompting is not supported for other types of connection strings.

An example of a URL component is addressing_scheme://network_location/path;parameters?query#fragment_identifier

Encode the parameter component with the definition string in between two sets of question marks. A prompt cannot cross a component boundary.

An example of a parameterized XML string is http://My_Network_Location/My_Path/myxml.asp?countrysid=??CanadaPrompt??

Parameterized XML connection strings have these restrictions:

• When a URL component is a prompt, it cannot contain other data.

• Prompts embedded in XML connection strings do not work in Framework Manager. You cannot import data from a parameterized XML connection string.

• When you set up a parameterized XML connection string in Cognos Connection, the Test button does not work.

• Validation of the query specification in Report Studio does not work if you are connected to a parameterized XML connection string.