That's a great approach
@Shahhere, well done!
I also wanted to share my approach to manage TM1 users and groups (and all TM1 object security as well)
I have a Google Sheets document containing 1 tab with users & groups for each TM1 environment.
That document is shared with some business users who can add\edit\delete users.
A little bit of formatting and you get a nice table with group dropdowns:
Using Google Sheets security (overall document access + and protected ranges) I can control permissions for business users.
Using Google Sheets file version, I can easily track all the changes.
When some changes are made, business users add a comment to sync security and I receive a notification from Google Sheets.
Once I sync the security I mark the comment as resolved and the user automatically gets a automated.
The process can create new user accounts and even security groups.
For some "power users" I can give permissions to run this "security synchronisation" from Google Sheets.
Nothing needs to be installed on TM1 servers or added to your TM1 models.
Access and manage all from your browser / Google Sheets
More details:
https://www.linkedin.com/feed/update/urn:li:activity:6975577306840875008https://succeedium.com/teamone/doc/usersUsing TeamOne you can document and manage TM1 object security as well:
- cube security
- dimension/hierarchy
- application security
- process security
https://succeedium.com/teamone/doc/functions.html#element-securityUsing TeamOne
Impersonate user feature, you can easily troubleshoot user access:
https://www.youtube.com/watch?v=bxk_ppmhGAcNOW:
It is possible to export users from Google Sheets as a CSV file so it can be uploaded to PAW
SOON:
There is a new feature coming to TeamOne -
background task automation with ability to create tasks which will be run "when you are not present" in Google Sheets. This feature will open up so many great opportunities for automation.
FUTURE:
Once the PAW security API is released, TeamOne will be able to sync users and groups in both TM1 and PAW
------------------------------
Vlad Didenko
Founder at Succeedium
TeamOne Google Sheets add-on for IBM Planning Analytics / TM1
https://succeedium.com/teamone/------------------------------
Original Message:
Sent: Fri October 14, 2022 08:54 AM
From: Shahhere
Subject: Import Users/Groups PAW API
- We have multiple (3-4) IBM PA Local instances hosted in AWS.
- I have another standalone "Login" instance where all the users from those other 3-4 instances are added and a chore on the Login instance that runs every minute to look for a CSV file in a folder to keep compiling new files.
- The Login instance is used as the authentication instance for PAW.
- I have a PAW front end for the Business Admins to add new userIDs which also creates a CSV noted above to add the users to the Login IBM PA instance.
- That same front end creates a CSV file in the PAW Administration format so that each time a new user is added it creates a User and a Group CSV that can be loaded into PAW Administration.
As noted in my earlier post I have all this working seamlessly and copying the 2 files User/Group to PAW shouldn't be too hard but is another step that is missing the automation and so someone has to manually do that step hence the need for an API type automation request.
If anyone has any questions about the 5 items I posted above feel free to reach out.
Shahhere
Original Message:
Sent: Thu October 13, 2022 05:19 PM
From: Roman Harasymiak
Subject: Import Users/Groups PAW API
Hi Charbel,
To echo some of the other sentiments on this post, we are running into a similar problem where on the IBM Cloud, the subscription management is somewhat disjointed from managing user access to environments and databases. We have several environments which we plan on provisioning to specific users based on divisional roles, however we are unable to automate any of this functionality as we cannot assign environment/tenant access until the user has accepted the invitation.
What we have found is that within the cloud, prior to a user accepting the invitation you can upload a file and process it with a TI to add users to a database by generating a CAMID with the following form --> CAMID("pans:u:<email address>") using the ADDCLIENT function, and subsequently adding them to any local TM1 Database groups.
We can automate that portion with a number of scripts and calls to AD groups to enable/configure the appropriate access to TM1 models, however what we cannot do is to provision the users into environments/subscriptions as we have no API or other reachable endpoint, requiring us to have a significant amount of effort to manage our users within our databases, where on prem we are doing this through AD Groups associated directly with CAM.
Happy to discuss in more detail to see if you have any other thoughts on how we can make this happen.
------------------------------
Roman Harasymiak
Original Message:
Sent: Mon October 10, 2022 01:08 PM
From: Charbel Abou-Khalil
Subject: Import Users/Groups PAW API
Hi Andy,
You can follow the instructions here : Upload users in bulk using a CSV file to invite them to Planning Analytics Workspace Local
| Ibm |
remove preview |
|
| Upload users in bulk using a CSV file to invite them to Planning Analytics Workspace Local |
| To add multiple users to IBM Planning Analytics Workspace Local, you upload a list of users and then can you activate, deactivate, or delete them. |
| View this on Ibm > |
|
|
To upload your users.
Essentially any browser request is an API request , so in theory an http/rest client such as curl, postman, or your own custom built, can be used to submit the exact same request. The only thing you will require is authentication. Which is also another http form submit.
See here for more details on authentication :
https://ibm.github.io/planninganalyticsapi/#logging-inHope this helps.
Charbel
------------------------------
Charbel Abou-Khalil
Original Message:
Sent: Sat October 08, 2022 01:42 AM
From: Andy Hsu
Subject: Import Users/Groups PAW API
Hi Everyone,
Does anyone know how to import users/groups using API? Because we make a TI to insert users/groups in PA. We should wait user first-login to sync to PAW. But we should set up the authority to plan/application and can not waiting user first-login. We need a PAW API to import users/groups. Anyone have solution?
------------------------------
Andy Hsu
------------------------------
#PlanningAnalyticswithWatson