TM1 Security question

Post Reply
arulvarman
Posts: 8
Joined: Mon Apr 01, 2013 5:31 pm
OLAP Product: Cognos
Version: 10.1.1
Excel Version: 2007

TM1 Security question

Post by arulvarman »

I am working on defining TM1 security and I run in to an issue. We use integrated security mode 4 . During testing I deleted user ‘John Doe’ from client list and refreshed security.
But then when John Doe tried to log in using Architect, he was still able to log in and was automatically added as a client.
We tried couple of times deleting him but once he uses Architect, he is automatically back in as client. Any idea what we are missing.
Thanks for your help
tomok
MVP
Posts: 2831
Joined: Tue Feb 16, 2010 2:39 pm
OLAP Product: TM1, Palo
Version: Beginning of time thru 10.2
Excel Version: 2003-2007-2010-2013
Location: Atlanta, GA
Contact:

Re: TM1 Security question

Post by tomok »

arulvarman wrote:During testing I deleted user ‘John Doe’ from client list and refreshed security.
How? Did you use the User and Group Maintenance interface or just remove from }Clients dimension manually? If manually, then you'll have to recycle the TM1 Server service. Sorry, "refreshing security" won't do it.
Tom O'Kelley - Manager Finance Systems
American Tower
http://www.onlinecourtreservations.com/
arulvarman
Posts: 8
Joined: Mon Apr 01, 2013 5:31 pm
OLAP Product: Cognos
Version: 10.1.1
Excel Version: 2007

Re: TM1 Security question

Post by arulvarman »

Thanks for the reply Tom. I used Clients/Group interface to remove the client.
EvgenyT
Community Contributor
Posts: 324
Joined: Mon Jul 02, 2012 9:39 pm
OLAP Product: TM1
Version: PAL 2.0.8
Excel Version: 2016
Location: Sydney, Australia

Re: TM1 Security question

Post by EvgenyT »

Isnt the user automatically validated against the existing group and created on the fly, given it's a mode 4?
I would have thought procedures would be as followed:
Run RemoveClientFromGroup, then remove the user from the group in CAM
arulvarman
Posts: 8
Joined: Mon Apr 01, 2013 5:31 pm
OLAP Product: Cognos
Version: 10.1.1
Excel Version: 2007

Re: TM1 Security question

Post by arulvarman »

This is new installation. I haven't imported any CAM Group yet. I added couple of CAM users and then tried to remove one user. But he is added as client automatically every time he tries architect. Object Security prevents him from doing anything in TM1,but the fact that he is able to log in to TM1 bothers me.
Or is it normal behavior, any CAM user can log in to TM1 and I have to secure the objects by object security?
EvgenyT
Community Contributor
Posts: 324
Joined: Mon Jul 02, 2012 9:39 pm
OLAP Product: TM1
Version: PAL 2.0.8
Excel Version: 2016
Location: Sydney, Australia

Re: TM1 Security question

Post by EvgenyT »

I haven't imported any CAM Group yet. I added couple of CAM users and then tried to remove one user.
Sorry, that's a little contradicting. You can either add a CAM user to a CAM group or any of the three TM1 admin groups under security mode 4
lotsaram
MVP
Posts: 3651
Joined: Fri Mar 13, 2009 11:14 am
OLAP Product: TableManager1
Version: PA 2.0.x
Excel Version: Office 365
Location: Switzerland

Re: TM1 Security question

Post by lotsaram »

arulvarman wrote:This is new installation. I haven't imported any CAM Group yet. I added couple of CAM users and then tried to remove one user. But he is added as client automatically every time he tries architect. Object Security prevents him from doing anything in TM1,but the fact that he is able to log in to TM1 bothers me.
Or is it normal behavior, any CAM user can log in to TM1 and I have to secure the objects by object security?
RTM. If you are using security mode 4 or 5 then this is expected behaviour. Users are created upon logging in. This is the default behaviour.

As of I think FP5 or FP6 there is a new config parameter which disables this default behaviour and enforces users being added manually or via TI as opposed to on the fly on first login if the default behaviour is not what you want.
Please place all requests for help in a public thread. I will not answer PMs requesting assistance.
EvgenyT
Community Contributor
Posts: 324
Joined: Mon Jul 02, 2012 9:39 pm
OLAP Product: TM1
Version: PAL 2.0.8
Excel Version: 2016
Location: Sydney, Australia

Re: TM1 Security question

Post by EvgenyT »

As of I think FP5 or FP6 there is a new config parameter which disables this default behaviour and enforces users being added manually or via TI as opposed to on the fly on first login if the default behaviour is not what you want.
Interesting info. Haven't been able to locate any documentation on that however.
Andy Key
MVP
Posts: 351
Joined: Wed May 14, 2008 1:37 pm
OLAP Product: TM1
Version: 2.5 to PA
Excel Version: Lots
Location: Sydney
Contact:

Re: TM1 Security question

Post by Andy Key »

EvgenyT wrote:Interesting info. Haven't been able to locate any documentation on that however.
Try this for size.
Andy Key
EvgenyT
Community Contributor
Posts: 324
Joined: Mon Jul 02, 2012 9:39 pm
OLAP Product: TM1
Version: PAL 2.0.8
Excel Version: 2016
Location: Sydney, Australia

Re: TM1 Security question

Post by EvgenyT »

Hah, nice one Andy! ( Didnt look very hard, did I ) :roll: :roll: :roll: :roll:
Andy Key
MVP
Posts: 351
Joined: Wed May 14, 2008 1:37 pm
OLAP Product: TM1
Version: 2.5 to PA
Excel Version: Lots
Location: Sydney
Contact:

Re: TM1 Security question

Post by Andy Key »

Nope. First guess at the search terms, fifth item on the list..!
Andy Key
arulvarman
Posts: 8
Joined: Mon Apr 01, 2013 5:31 pm
OLAP Product: Cognos
Version: 10.1.1
Excel Version: 2007

Re: TM1 Security question

Post by arulvarman »

Thanks everyone, it is good to know that I can control it with config change.
Post Reply