We do not use Framework Manager to control any security - We control everything with multiple sign-on's on each data connection in Cognos Administration > Data Source Connections > Configurations.
Typically, we have 2 sign-on's for each connection, each with specific grant/deny permissions.
Therefore, a user running a report will be automatically directed to a specific sign-on and then there is security on our Oracle database which handles redirection using synonyms to a view (with masked columns) or the table (with all columns available) based on the sign-on selected.
So, all our necessary security (in this particular scenario) is handled at the database level rather than in Cognos.
That's why, as we have fully functional database security in place, I don't want to have to recreate it either in Framework Manager or in Data Modules.
Hope this helps.
Thanks again,
Adam.
------------------------------
Adam McIlravey
------------------------------
Original Message:
Sent: Fri January 10, 2020 09:40 AM
From: brenda grossnickle
Subject: Data Modules and Data Server Connections
A bit off topic, but how do you redirect to a different view based on the Cognos Group/Role?
In Framework Manage, we use a Cognos Macro that switches the data source based on the users Groups/Roles. For users in the SecureGroup, the macro changes the data source to SecureDS which uses the signin SecureUser. The SecureUser signin logs into SQL with specific credentials that have special permissions - mostly for decrypting sensitive information. If the user is not in the SecureGroup then the default data source and SQL credentials are used.
t sounds like you do something very different. Can you explain a bit more about your setup in Framework Manager.
------------------------------
brenda grossnickle
BI Programmer Analyst
FIS
Original Message:
Sent: Wed January 08, 2020 12:28 PM
From: Adam McIlravey
Subject: Data Modules and Data Server Connections
Currently, our PROD connection has 2 sign-on's (cog & secure_cog).
The sign-on "cog" has deny authority for a group of users and the sign-on "secure_cog" has grant permissions for that same group of users.
When a report is run using a Package, the user is directed by permissions as to which sign-on the connection uses.
For users in the "cog" group, all rows are returned but, certain data items are masked with the value 'SECURE' (we want the rows returned, just not the ability to see certain data elements). However, when the same report is run by a user in the "secure_cog" group, all data items are returned and visible.
So, a report over a Package using a Cognos connection data source, run by a user in the "cog" (masked data group) has their query on the database "redirected" to views (for certain tables) using Oracle synonyms - These views mask the returned data. The same report run by a user in the "cog_secure" (all data group) has their query go directly over the tables in the Oracle database.
However, when I use a Data Module with a Data Server connection (using the same defined PROD connections) for a report it defines the schema in the generated SQL - I presume that this is because I need to define schema(s) in the data server connection.
Simply, this is the difference in generated SQL's (as seen in Toad):
With Package and Cognos Connection/Sign-On's: select * from table
With Data Module & Data Server: select * from schema.table
This "hardcoding" of the schema name, even though the report runs with the appropriate user group sign-on, overrides the Oracle database synonym functionality as the schema is explicitly defined. Thus undermining our security.
Note:
I can use a Data Module containing a Package and get the expected results, it is only the inclusion of the Data Server as the source that seems to invalidate our security.
At the Data and AI Forum it was expressed that I should use Data Modules going forward instead of Framework Manager, but this issue will severely limit that transition.
Is there a way to take advantage of Data Server Connections in Data Modules without having to completely redesign our security?
Any thoughts will be greatly appreciated.
Thanks in advance,
Adam.
------------------------------
Adam McIlravey
------------------------------
#CognosAnalyticswithWatson