Planning Analytics

 View Only
Expand all | Collapse all

PAW on prem => Multi-tenancy

  • 1.  PAW on prem => Multi-tenancy

    Posted Fri May 03, 2024 07:39 AM

    Hi there

    While I was reading a recent post, multi-tenancy was mentioned for PA local. Can someone confirm that this is indeed possible for PA local. Also to confirm my understand of multitenancy. Do this mean that modelers will be able to log onto a (single) PAW server and choose between (for example) Prod and Dev Tm1 servers, and be able to performs all admin/development tasks? Would it therefore remove the need to have separate PAW installs/environments for Prod and Dev? From a user perspective, will they also be able to log on to a single PAW URL and choose between different Tm1 instances?

    Many thanks!

    Regards

    Chris



    ------------------------------
    Chris Hewitt
    ------------------------------


  • 2.  RE: PAW on prem => Multi-tenancy

    Posted Mon May 06, 2024 11:42 AM

    Hi Chris,

    It's absolutly possible to enable multi-tenancy in Planning Analytics Workspace local!  We released this in 2.0.92. Please see: https://www.ibm.com/docs/en/planning-analytics/2.0.0?topic=wnia2-create-edit-multiple-planning-analytics-local-environments-local-only

    Each environment (tenant) can have one or more TM1 Admin Servers.  The TM1 Admin Servers are used to control which TM1 databases are found in each of the Workspace environments.

    The advantage of this feature is that you only need to manage a single PAW deployment to support mulitple environments.  You can use the LCM feature to migrate content between environments without exporting and importing the snapshot. 

    There are a few other considerations when enabling multi-tenancy.  Make sure to read the linked documentation carefully.



    ------------------------------
    Stuart King
    IBM Planning Analytics Offering Manager
    ------------------------------



  • 3.  RE: PAW on prem => Multi-tenancy

    Posted Tue May 07, 2024 11:57 AM

    Hi Stuart

    Many thanks for your response  - sounds fantastic! So just to be 100% sure - you can log onto a single PAW instance, choose your environment, and administer, model, write dashboards etc and have the ability to flip between different Tm1 servers in whatever capacity you have security for. Following on from this, I guess the only reason you might want multiple PAW servers might be for performance considerations?

    Many thanks!

    Chris



    ------------------------------
    Chris Hewitt
    ------------------------------



  • 4.  RE: PAW on prem => Multi-tenancy

    Posted Wed May 08, 2024 11:20 AM

    Hi Chris,

    It's not just unique TM1 databases in each environment.  You can also have different Workspace users and groups in each environment and different Worksapce content (books, views, workbenches, etc).

    Yes, a big advantage of multi-tenancy is that you only need one deployment (installation) of Workspace to support dev and prod environments, or mutliple organizations with different users.  For our enterprise customers I'm sure that multi-tenancy will commonly used with scaled deployments of Workspace on OpenShift.



    ------------------------------
    Stuart King
    IBM Planning Analytics Offering Manager
    ------------------------------



  • 5.  RE: PAW on prem => Multi-tenancy

    Posted Tue March 11, 2025 09:18 AM

    Hi Stuart, 

    is there a way to restrict the TM1 servers for a PAW environment? I already tried it like this, but it did not work: https://adminhost:5898/../../../api/v1/Servers('tm1_server')

    Unfortunately, only host:port can be configured as admin host.

    Thanks in advance!

    Kind regards
    Hartmut Renker



    ------------------------------
    Hartmut Renker
    ------------------------------



  • 6.  RE: PAW on prem => Multi-tenancy

    Posted Tue March 11, 2025 09:29 AM

    Hi Hartmut,

    There is no way to limit the TM1 databases that are available from a specific TM1 Admin Server in an environment.  If you need different TM1 databases in each environment then you must have unique TM1 Admin Servers for each environment.  We do support a single TM1 databases have multiple TM1 Admin Servers.   



    ------------------------------
    Stuart King
    Product Manager
    IBM Planning Analytics
    ------------------------------



  • 7.  RE: PAW on prem => Multi-tenancy

    Posted Tue March 11, 2025 12:10 PM

    Hi Stuart,

    thank you for your answer. Is it possible to run multiple TM1 Admin Servers on one machine? For example on different ports? Is there perhaps a parameter PortNumber?

    We already run multiple Admin Servers on one machine, but we achieved it by a (dirty) hack via LD_PRELOAD on Linux and catching and redirecting the bind calls to virtual IP addresses.

    Kind regards
    Hartmut Renker



    ------------------------------
    Hartmut Renker
    ------------------------------



  • 8.  RE: PAW on prem => Multi-tenancy

    Posted Wed March 12, 2025 08:39 AM

    Hi Hartmut,

    Unfortunately there is no official way to deploy multiple instances of the admin server.

    Make sure to take a look at the 2.0.9.21 and 2.1.8 releases (available on Fix Central as of March 10).  With these releases we changed the installer and removed Cognos Configuration.  There is a new config file for the TM1 Admin Server where you can set the port.  While making these changes we did identify and correct a long standing issue the prevented the TM1 Admin Server port numbers from being modified.  

    "tm1AdminNonSSLPortNumber": 5495,
    "tm1AdminSSLPortNumber": 5498,
    "tm1AdminHTTPPortNumber": 5895,
    "tm1AdminHTTPSPortNumber": 5898

    However, we are not recommended the port numbers (tm1AdminNonSSLPortNumber and tm1AdminSSLPortNumber in particular) be changed because the AdminServer parameter in the tm1s.cfg files don't accept a port, just a hostname or IP address.  The TM1 Server is basically hard coded to look for the TM1 Admin Server on port 5498 when using SSL and 5495 when SSL is disabled.

    You might be able to use the above detail to simplify your hack.

    I'm inclined to agree that support for multiple admin hosts on the same system may be useful.   



    ------------------------------
    Stuart King
    Product Manager
    IBM Planning Analytics
    ------------------------------



  • 9.  RE: PAW on prem => Multi-tenancy

    Posted Wed March 12, 2025 09:13 AM

    Hi Stuart,

    thanks for the very detailed answer! With this option it is possible for us to start additional AdminServers on the same machine and post or delete TM1 Servers via REST API, so that they can be used in different PAW environments.

    Do you think PAW could also support rest calls as setting for the AdminServer in the future, as I wrote before? https://adminhost:5898/api/v1/Servers('tm1_server')

    Kind regards
    Hartmut Renker



    ------------------------------
    Hartmut Renker
    ------------------------------



  • 10.  RE: PAW on prem => Multi-tenancy

    Posted Wed March 12, 2025 04:09 PM

    Hi Hartmut,

    There is no parameter unfortunately but nothing that stops you from copying the binary directory, just the files you need for admin host/server and give it a separate configuration as, using the config file, you can specify all port numbers.

    And since you are on Linux, you could potentially just create a small docker container and start multiple of them using different port numbers that way (not need to fiddle with the configuration of the admin host/server itself that way).

    Also, not sure you are aware, you can manage the list of servers available on any admin host/server instance yourself using it's REST API as well, it can even be a mix of TM1 servers registering themselves with such admin host/server instance and TM1 servers you manually add/maintain (some customers use this to manage active/passive failover scenarios).

    Cheers,



    ------------------------------
    Hubert Heijkers
    STSM, Program Director TM1 Functional Database Technology and OData Evangelist
    ------------------------------



  • 11.  RE: PAW on prem => Multi-tenancy

    Posted Thu March 13, 2025 03:36 AM

    Hi Hubert,

    thanks for the answer. Yes, we are aware of patching AdminHosts via REST. Currently we think about to provide different PAW environments to different user groups. Since one can add multiple AdminHosts in the settings of a PAW environment, it would have been easy to use it like this, to get the TM1Servers from one AdminHost, where all TM1Servers are self registered:

    https://adminhost:5898/api/v1/Servers('tm1_server_1')
    https://adminhost:5898/api/v1/Servers('tm1_server_2')
    https://adminhost:5898/api/v1/Servers('tm1_server_3')

    Unfortunately that doesn't work. 

    Kind regards
    Hartmut Renker



    ------------------------------
    Hartmut Renker
    ------------------------------



  • 12.  RE: PAW on prem => Multi-tenancy

    Posted Thu March 13, 2025 05:03 AM

    Hi Hartmut,

    First up I have to correct my earlier comment, while I was excited about the fact that you can now 'easily' configure the ports for the admin host/server you effectively can't, as Stuart elutes to, make a TM1 server register itself with such admin host if it is not running on the default, SSL to be correct, port (read: 5498). So multiple instance running on different ports would only work if you managed the list of servers yourself (which obviously could be done using some automated process sourcing from one admin host/server and applying your magic to which should go where perhaps).

    That said, I'm not sure I understand your last request, are you saying you would like to identify the individual TM1 servers in each of the PAW environments? If so then I need to share a secret with you as that's a long standing wish I've had myself. In that case it wouldn't need to refer to an admin host/server but could simply the the service root URL to the TM1 server itself, but I suppose one could work out from the URL which one it is as well.

    Cheers,



    ------------------------------
    Hubert Heijkers
    STSM, Program Director TM1 Functional Database Technology and OData Evangelist
    ------------------------------



  • 13.  RE: PAW on prem => Multi-tenancy

    Posted Tue March 18, 2025 06:25 AM

    Hi Hubert,

    yes, I like to show subsets of TM1Servers for each PAW environment, retrieved from one AdminHost, where all TM1Servers have self registered. 
    The solution could be to allow REST calls in the settings, instead of using only host:port. Or add host:port of the specific TM1Servers directly.

    https://adminhost:5898/api/v1/Servers?$filter=Name eq 'tm1_server_1' or Name eq 'tm1_server_2' or Name eq 'tm1_server_3'

    Kind regards
    Hartmut Renker



    ------------------------------
    Hartmut Renker
    ------------------------------



  • 14.  RE: PAW on prem => Multi-tenancy

    Posted Tue March 18, 2025 10:19 AM

    Hi Hartmut,

    I can't speak for the PA side, Stuart can keep me honest here, but I don't expect they'd want to let you do that.

    But, if you are willing to 'customize' that way, and therefore there is some logic you can use to define the set of servers, then it should be fairly easy to write a little script that you could run ever so often that:
    1) retrieves the list of ALL TM1 servers that self registered to the Admin host running on the default port
    2) updates the list of the servers in the special, environments specific, Admin host with the list that environment should be showing, and do that for all environments

    The pattern is simple, the variable part is in the logic you'd apply on the list of available servers to begin with I suppose.

    Have to admit that I find it interesting that you have a TM1 server/database that you'd want to show up in multiple environments and was wondering if this translates to the TM1 v12 service where there are 'instances', which typically map to an environment (albeit IMHO an environment could/should be able to map to multiple instances perhaps), and databases are grouped underneath those instances but are never part of more then one either. 



    ------------------------------
    Hubert Heijkers
    STSM, Program Director TM1 Functional Database Technology and OData Evangelist
    ------------------------------



  • 15.  RE: PAW on prem => Multi-tenancy

    Posted Fri March 14, 2025 09:02 AM

    Hi,

    Apologies if this appears off topic or if my understanding is incorrect, as I know very little about the Multi Tenancy option. But this seems to tie into a gripe I have had for a while.

    We host and manage multiple customers Planning Analytics environments.

    One big problem we have is managing user set up and security on the PAW side.

    Ideally we want customer "Super Users" to manage user set up, including PAW User set up, but to do that we would need to give them the Administrator role in PAW, which means they have access things other than users and groups.

    On the TM1 server side, we can write TI processes to add users, and add users to groups etc and the customers can run those from PAW, but for PAW users and groups we do not have this option, as far as I know.

    Currently we have to bite the bullet and give "Super Users" the Administrator role in PAW, and hope they don't do anything silly.

    With this Multi Tenancy feature, I assume anyone with the Administrator role in PAW can see all environments, which would present a problem in the scenario above.

    I think in PAW we ideally need a way non admins can add users and manage group access for a given environment.

    regards,

    Mark 



    ------------------------------
    Mark Wragg
    ------------------------------



  • 16.  RE: PAW on prem => Multi-tenancy

    Posted Mon March 17, 2025 09:50 AM

    Hi Mark,

    The first user to log into a new PAW deployment has an extra 'environment administrator' privilege.  If you are upgrading an older PAW deployment to 2.0.92 or later (the version we introduced tenancy) then please see: https://www.ibm.com/docs/en/planning-analytics/2.0.0?topic=users-promote-user-administrator-local-only

    Only administrator users with the extra 'environment administrator' privilege can create, delete, and configure the environments.

    We are also working on some improvements to our capabilities control that will eventually allow you to have administrators that can manage users and groups without also providing access to manage the TM1 databases.   In current releases, capabilities is only found in Planning Analytics on Cloud (not local).



    ------------------------------
    Stuart King
    Product Manager
    IBM Planning Analytics
    ------------------------------