Exporting and importing users and groups for security

[Wim Gielis]

Hello all,

I am in the last steps of a migration from an on-premise TM1 model to the IBM cloud.
The majority of my time was spent changing TI process data sources of Cognos Framework Manager packages to plain text files.
"Thank you" IBM for removing the good old TM1 Package Connector

TLDR;
The new TI process generates TI statements to import selected users/groups/assignments/attributes in a target TM1 model.


Anyway, I needed to migrate 200 users as well. First 5 users for UAT testing, then the remaining users.
I did not migrate the }Clients dimension when going to the cloud, as usernames will be different anyway.
Therefore the }Clients dimension in the cloud is almost empty, except my IBM ID with ADMIN privileges.
I did migrate the }Groups dimension when going to the cloud.

What are the options to migrate users and settings ?

• TM1 REST API: yes, possible. But not for me: the customer is on TM1 10.2.2 FP4 on-premise

• TM1py: yes, possible. But not for me: same as above

• manual work with copy/paste: yes, possible. But my time is worth more.

• custom TI process: yes, possible. See below.

Here is a TI process to help.
You can export for all clients or a selection.
The process will generate 2 processes: 1 file with TI statements for a Prolog tab, 1 file with TI statements for an Epilog tab. Copy/paste the file contents in a new process in the TARGET TM1 model, run it, and you should be good. Make adjustments to the generated code if needed.

You can do smart things as follows:
The parameter 'pAttribute_Include_Client_New_Name' can contain the name of an attribute on the }Clients dimension. If this parameter is used (not empty) and the attribute exists, only the clients with a non-empty value for the attribute will be considered in the export. Also, group names will only be exported if the group contains at least 1 client that is considered to be needed (client with a non-empty attribute value).

What you put in the attribute values for the SELECTED clients is the new username. It could contain the email address if it is the IBM cloud to which you migrate. The tool could be used for any migration, though.

So I used the above first for the 5 users, then some time later, for 195 users.

The statements in the output allow us to:

• import users

• import groups

• assign group memberships

• create and update attributes

• update some client settings

Sample output:

EXAMPLE PROLOG TAB CODE:

Code: Select all

### Add groups
If( ElementIndex( '}Groups', '}Groups', 'Controller' ) = 0 );
   AddGroup( 'ADMIN' );
EndIf;

### Add clients
If( ElementIndex( '}Clients', '}Clients', 'CAMID("pans:u:wgielis@aexis.com")' ) = 0 );
   AddClient( 'CAMID("pans:u:wgielis@aexis.com")' );
EndIf;

### Add group attributes
If( ElementIndex( '}ElementAttributes_}Groups', '}ElementAttributes_}Groups', '}TM1_DefaultDisplayValue' ) = 0 );
   AttrInsert( '}Groups', '', '}TM1_DefaultDisplayValue', 'A' );
EndIf;

### Add client attributes
If( ElementIndex( '}ElementAttributes_}Clients', '}ElementAttributes_}Clients', 'Email address' ) = 0 );
   AttrInsert( '}Clients', '', 'Email address', 'S' );
EndIf;
If( ElementIndex( '}ElementAttributes_}Clients', '}ElementAttributes_}Clients', '}TM1_DefaultDisplayValue' ) = 0 );
   AttrInsert( '}Clients', '', '}TM1_DefaultDisplayValue', 'A' );
EndIf;

EXAMPLE EPILOG TAB CODE:

Code: Select all

### Add group assignments

# For user: CAMID("pans:u:wgielis@aexis.com")
If( ElementIndex( '}Groups', '}Groups', 'Controller' ) > 0 & ElementIndex( '}Clients', '}Clients', 'CAMID("pans:u:wgielis@aexis.com")' ) > 0 );
   AssignClientToGroup( 'CAMID("pans:u:wgielis@aexis.com")', 'Controller' );
EndIf;

### Add group attribute values
CellPutS( '', '}ElementAttributes_}Groups', 'Controller', '}TM1_DefaultDisplayValue' );

### Add client attribute values
CellPutS( 'wgielis@aexis.com', '}ElementAttributes_}Clients', 'CAMID("pans:u:wgielis@aexis.com")', 'Email address' );
CellPutS( 'Planning Analytics/Wim Gielis', '}ElementAttributes_}Clients', 'CAMID("pans:u:wgielis@aexis.com")', '}TM1_DefaultDisplayValue' );

### Add client settings values
CellPutS( 'test', '}ClientSettings', 'CAMID("pans:u:wgielis@aexis.com")', 'Web Home Page Object Description' );

### Add client properties values
CellPutN( 50, '}ClientProperties', 'CAMID("pans:u:wgielis@aexis.com")', 'MaximumPorts' );

Download the process here:

WG_WRITE_CODE_security_clients_groups.pro

(21.83 KiB) Downloaded 76 times

You can imagine that this process saves you a lot of time. Enjoy the weekend.