Configuring Cognos-based Tivoli Common Reporting engine with LDAP

Use the Cognos® Configuration user interface to configure the Cognos-based Tivoli® Common Reporting engine and use the same user repository as the Tivoli Common Reporting application. This procedure is recommended for large user repositories.

About this task

If you installed your Tivoli Common Reporting on a single computer, the Tivoli Common Reporting VMMProvider is used for LDAP by default, and no additional LDAP configuration is required.

Procedure

  1. Open the IBM® Cognos Configuration by running:
    • Windows systems Start > All Programs > Tivoli Common Reporting 3.1 > IBM Cognos Configuration
    • Linux and UNIX systems c10_location/bin64/tcr_cogconfig.sh.
  2. In the Explorer navigation on the left, go to Security, and right-click the Authentication section.
  3. Select New resource > Namespace....
  4. Type in a name, select the registry type from the expandable list, and click OK. New user registry is added to the list.
  5. Select the entry that you created, and edit the fields required for configuration. You must provide different values depending on the type of user registry selected. For details on how to configure the user registry, see Configuring IBM Cognos Components to Use an Authentication Provider of IBMCognos information center.
    1. Set Use external identity? to True to enable single sign-on from the console to the reporting engine systems.
    2. Set External identity mapping to (uid=${environment("REMOTE_USER")}). If you use your email address instead of a user ID to log on to the console, set the value to: (mail=${environment("REMOTE_USER")}).
    3. Select Environment in the navigation tree and ensure that host names are set to be fully qualified.
  6. Right-click the entry that you created, and select Test to verify it before saving.
  7. Select Cognos entry, and edit the Allow anonymous access? field, changing it to False.
  8. Save the new configuration.

Results

Important: When you configure LDAP, the reporting portlet can no longer be used by users that are not contained in the configured LDAP and do not have the tcrPortalOperator role assigned.