How to make system appear "offline" - TM1Web login unavailable

Post Reply
jed
Posts: 55
Joined: Wed Sep 02, 2009 11:33 am
OLAP Product: TM1
Version: 10.2.2
Excel Version: 2016
Location: Australia

How to make system appear "offline" - TM1Web login unavailable

Post by jed » Fri Aug 23, 2019 12:37 am

What methods do people use for taking their system "offline" such that non admin users cannot login via TM1Web (or perspectives)?

At certain times we want to take the system offline while TM1 Administrators perform certain tasks and at present even though we lock the system and advise the users it is unavailable they will still try to login so long as they can access the login page (or perspectives)....

I've been thinking about various ways to make the system appear offline and wondering what approaches others have used?

User avatar
macsir
Community Contributor
Posts: 639
Joined: Wed May 30, 2012 6:50 am
OLAP Product: TM1, SSAS
Version: 9.5 - 10.2
Excel Version: 97 - 2013
Contact:

Re: How to make system appear "offline" - TM1Web login unavailable

Post by macsir » Fri Aug 23, 2019 2:19 am

In TM1,the answer is always yes though sometimes with a but....
http://tm1sir.blogspot.com.au/

jed
Posts: 55
Joined: Wed Sep 02, 2009 11:33 am
OLAP Product: TM1
Version: 10.2.2
Excel Version: 2016
Location: Australia

Re: How to make system appear "offline" - TM1Web login unavailable

Post by jed » Fri Aug 23, 2019 2:27 am

Nah, that's changing the homepage after the users have logged in which we do already. I need to prevent them from logging in.
macsir wrote:
Fri Aug 23, 2019 2:19 am
maybe this one?
https://www.ibm.com/support/knowledgece ... 509d6.html

User avatar
orlando
Posts: 108
Joined: Fri Aug 04, 2017 8:27 am
OLAP Product: TM1
Version: PAL 2.0
Excel Version: Office 365

Re: How to make system appear "offline" - TM1Web login unavailable

Post by orlando » Fri Aug 23, 2019 6:51 am

One quick thought:
Unfortunately there is no login possible/not possible switch - at least I haven't met one yet.
Maybe it could go over the rights.
Use TI to read out all user rights and save them to a file or cube. Remove the rights from all users or create a group that is not allowed to do anything and assign the group to the users.
After maintenance, restore the rights.
Then the users can log in, but see nothing and do not disturb.

User avatar
gtonkin
MVP
Posts: 704
Joined: Thu May 06, 2010 3:03 pm
OLAP Product: TM1
Version: PAL 2.0.3
Excel Version: 2016 64-bit
Location: JHB, South Africa
Contact:

Re: How to make system appear "offline" - TM1Web login unavailable

Post by gtonkin » Fri Aug 23, 2019 8:03 am

If you are using authentication, other than TM1, you could try overwriting the UniqueID with a rule triggered by a flag - Invalidating this should prevent integrated logins.

lotsaram
MVP
Posts: 3290
Joined: Fri Mar 13, 2009 11:14 am
OLAP Product: TableManager1
Version: PA 2.0.x
Excel Version: Office 365
Location: Switzerland

Re: How to make system appear "offline" - TM1Web login unavailable

Post by lotsaram » Fri Aug 23, 2019 12:11 pm

Have you looked at this?
Please place all requests for help in a public thread. I will not answer PMs requesting assistance.

User avatar
orlando
Posts: 108
Joined: Fri Aug 04, 2017 8:27 am
OLAP Product: TM1
Version: PAL 2.0
Excel Version: Office 365

Re: How to make system appear "offline" - TM1Web login unavailable

Post by orlando » Fri Aug 23, 2019 12:19 pm

lotsaram wrote:
Fri Aug 23, 2019 12:11 pm
Have you looked at this?
clever way - i like ist
hopefully he's using PA

tomok
MVP
Posts: 2599
Joined: Tue Feb 16, 2010 2:39 pm
OLAP Product: TM1, Palo
Version: Beginning of time thru 10.2
Excel Version: 2003-2007-2010-2013
Location: Atlanta, GA
Contact:

Re: How to make system appear "offline" - TM1Web login unavailable

Post by tomok » Fri Aug 23, 2019 12:42 pm

If you are already using security mode 1 you could put a rule on the }ClientProperties cube that assigned a crazy password like 7dhsye4$2Hu7)d or similar to every client except ADMIN. No one would be able to login unless they could guess the password. When you want to go back simply remove the rule.
Tom O'Kelley - Manager Finance Systems
American Tower
http://www.onlinecourtreservations.com/

jed
Posts: 55
Joined: Wed Sep 02, 2009 11:33 am
OLAP Product: TM1
Version: 10.2.2
Excel Version: 2016
Location: Australia

Re: How to make system appear "offline" - TM1Web login unavailable

Post by jed » Sun Aug 25, 2019 11:10 pm

orlando wrote:
Fri Aug 23, 2019 12:19 pm
lotsaram wrote:
Fri Aug 23, 2019 12:11 pm
Have you looked at this?
clever way - i like ist
hopefully he's using PA
oh yeah this would be an option...unfortunately we're not upgrading to PA for a few months :roll:

Bakkone
Posts: 102
Joined: Mon Oct 27, 2014 10:50 am
OLAP Product: TM1
Version: 10.2.2
Excel Version: 2013

Re: How to make system appear "offline" - TM1Web login unavailable

Post by Bakkone » Mon Aug 26, 2019 7:53 am

If you dont need TM1Web/Applicaiton Web to check your admin changes. It would be a possibility to just stop those services.

Another solution I have used once was to close the firewall on the web-server so noone could access it. This way I could use the system since I was on the server. But noone else could access it from an external laptop.

Drg
Posts: 132
Joined: Fri Aug 12, 2016 10:02 am
OLAP Product: tm1
Version: 10.2.0 - 10.3.0
Excel Version: 2010

Re: How to make system appear "offline" - TM1Web login unavailable

Post by Drg » Wed Sep 04, 2019 2:59 pm

Hello
We use for this 2 step:

1 tm1kill.exe to kick all users from model.
2 run process append to all users *LOCK* string to passworh hash.
I would like to warn you against using this approach. if you delete the line * LOCK * and insert the old password hash, we encounter a problem, cellpuss uses the trimm function, which leads to problems for some users.

Now we are considering a situation with password rules and there is also a more elegant solution that we will implement a bit later:
to OFFLINE
1 savedataall
2 copy file cube }ClientsProperties to temp folder (via executecommnd)
3 change password hash for all users exclude 'admins'
to ONLINE
1 cubeunload(}ClientsProperties)
2 copy file cube from temp folder to datafolder
enjoy

lotsaram
MVP
Posts: 3290
Joined: Fri Mar 13, 2009 11:14 am
OLAP Product: TableManager1
Version: PA 2.0.x
Excel Version: Office 365
Location: Switzerland

Re: How to make system appear "offline" - TM1Web login unavailable

Post by lotsaram » Wed Sep 04, 2019 5:23 pm

This sounds useful! But does unload work for }ClientProperties?
Please place all requests for help in a public thread. I will not answer PMs requesting assistance.

Drg
Posts: 132
Joined: Fri Aug 12, 2016 10:02 am
OLAP Product: tm1
Version: 10.2.0 - 10.3.0
Excel Version: 2010

Re: How to make system appear "offline" - TM1Web login unavailable

Post by Drg » Thu Sep 05, 2019 6:38 am

lotsaram wrote:
Wed Sep 04, 2019 5:23 pm
This sounds useful! But does unload work for }ClientProperties?
We tested. YES :P

jed
Posts: 55
Joined: Wed Sep 02, 2009 11:33 am
OLAP Product: TM1
Version: 10.2.2
Excel Version: 2016
Location: Australia

Re: How to make system appear "offline" - TM1Web login unavailable

Post by jed » Mon Sep 09, 2019 1:36 am

to OFFLINE
1 savedataall
2 copy file cube }ClientsProperties to temp folder (via executecommnd)
3 change password hash for all users exclude 'admins'
to ONLINE
1 cubeunload(}ClientsProperties)
2 copy file cube from temp folder to datafolder
So, in this scenario if the users keeps trying to login they will lock their account given their password has changed?? Does copying the }ClientProperties cube back resolve the fact that MaximumLoginAttempts has been reached? Because normally a locked account can only be reset but changing the password (or restarting the TM1 service).

I feel like this method might be a bit flawed (what about if integrated login is used?)...but maybe a variation on this could be applied....

Drg
Posts: 132
Joined: Fri Aug 12, 2016 10:02 am
OLAP Product: tm1
Version: 10.2.0 - 10.3.0
Excel Version: 2010

Re: How to make system appear "offline" - TM1Web login unavailable

Post by Drg » Mon Sep 09, 2019 6:48 am

Yep you right. MaximumLoginAttempts it's dynamic params you cn change it anytime.

integratedmode dinamic params only in PA not in TM1/. :|

Post Reply