Hi James, if you are considering paid solutions, you can easily do this using SPACE (Succeedium Planning Analytics Cloud Extension).

A user with ADMIN rights in your DEV environment can create a release and add the required objects. Then, another user with ADMIN rights in PROD can compare and deploy the release content. Additionally, you get a complete audit trail that records who created, updated, and deployed the release content.

SPACE integrates TM1 lifecycle manager directly into PAW, allowing you to deploy cubes, views, rules, dimensions, hierarchies, attributes, subsets, processes, chores, and even data. You can compare objects before deployment and see the changes.

SPACE supports both IBM PA Local and Cloud, making it useful for on-prem to cloud migration. We are about to release a standalone version that can be used without PAW.

Feel free to contact me if you need any further information.

Hi Vlad, 

Nice application, but doesn't solve our problem. We have custom scripts to move objects via REST API but here in this case we are trying to find a way to do it without a full admin account.

Hi James, if you are considering paid solutions, you can easily do this using SPACE (Succeedium Planning Analytics Cloud Extension).

A user with ADMIN rights in your DEV environment can create a release and add the required objects. Then, another user with ADMIN rights in PROD can compare and deploy the release content. Additionally, you get a complete audit trail that records who created, updated, and deployed the release content.

SPACE integrates TM1 lifecycle manager directly into PAW, allowing you to deploy cubes, views, rules, dimensions, hierarchies, attributes, subsets, processes, chores, and even data. You can compare objects before deployment and see the changes.

SPACE supports both IBM PA Local and Cloud, making it useful for on-prem to cloud migration. We are about to release a standalone version that can be used without PAW.

Feel free to contact me if you need any further information.

Hi @James Lavierre, do your PROD admin users have admin access in your DEV environment too, or can you give them admin access in DEV? What programming language are you using for REST API?

Hi Vlad, 

Nice application, but doesn't solve our problem. We have custom scripts to move objects via REST API but here in this case we are trying to find a way to do it without a full admin account.

Hi James, if you are considering paid solutions, you can easily do this using SPACE (Succeedium Planning Analytics Cloud Extension).

A user with ADMIN rights in your DEV environment can create a release and add the required objects. Then, another user with ADMIN rights in PROD can compare and deploy the release content. Additionally, you get a complete audit trail that records who created, updated, and deployed the release content.

SPACE integrates TM1 lifecycle manager directly into PAW, allowing you to deploy cubes, views, rules, dimensions, hierarchies, attributes, subsets, processes, chores, and even data. You can compare objects before deployment and see the changes.

SPACE supports both IBM PA Local and Cloud, making it useful for on-prem to cloud migration. We are about to release a standalone version that can be used without PAW.

Feel free to contact me if you need any further information.

Hi James,

The short answer is that you can't and the longer answer is maybe,

In principle a user needs Admin access on the Production box to add new objects to the Production instance.

To avoid stopping and starting the model requires hot promotion which pushes the requirement towards the REST API. If you are using PAoC then you could apply for a Non-Interactive account:

https://www.ibm.com/docs/en/planning-analytics/2.0.0?topic=ccc-setting-up-non-interactive-account-use-in-ldap-namespace

This account could be given Admin access and can perform Hot Promotion on Processes and any other end points in your model.

However,

You 'could' develop some custom python scripts or use TM1py to automate picking up TI processes from a nominated folder and loading to the Production instance

This script could be converted to an executable via Pyinstaller

A TI process could run ExecuteCommand on this process to load files from a folder to Production

A New SecurityGroup on Production could be generated which gives selected users access to run the above process.

This is only a theory but in practice this should work, the point is to create a generic process in Production to load from a folder (or direct from Development/ Test/ UAT etc..) and you create packages into a defined folder to push objects to Production

I believe this could/ should work and I would be interested to hear any thoughts on this

------------------------------
Edward Stuart
------------------------------

Hi Edward, 

Shouldn't we need to provide an admin user and password to those TM1PY to be able to create TI processes in the production? 

The problem we have is that we won't have an admin account in the production system, only few of  business planners will have admin account. 

There are couple of strong enhancement requirements here (To IBM fellows) ;

1. Ability to create processes by processes (you can create any objects with processes like cubes, dims, views but not processes)
2. Another admin user group structure like security and operations admin, that will be able to create objects like processes, cubes, dims etc.  but will not be able to see cube data, can be called something like "model admin" .  

Without these features , we are always suffering with applications requires high confidentiality. 

------------------------------
James Lavierre
------------------------------


Original Message:
Sent: Thu March 07, 2024 12:05 PM
From: Edward Stuart
Subject: NonAdmin user to create process.

Hi James,

The short answer is that you can't and the longer answer is maybe,

In principle a user needs Admin access on the Production box to add new objects to the Production instance.

To avoid stopping and starting the model requires hot promotion which pushes the requirement towards the REST API. If you are using PAoC then you could apply for a Non-Interactive account:

https://www.ibm.com/docs/en/planning-analytics/2.0.0?topic=ccc-setting-up-non-interactive-account-use-in-ldap-namespace

This account could be given Admin access and can perform Hot Promotion on Processes and any other end points in your model.

However,

You 'could' develop some custom python scripts or use TM1py to automate picking up TI processes from a nominated folder and loading to the Production instance

This script could be converted to an executable via Pyinstaller

A TI process could run ExecuteCommand on this process to load files from a folder to Production

A New SecurityGroup on Production could be generated which gives selected users access to run the above process.

This is only a theory but in practice this should work, the point is to create a generic process in Production to load from a folder (or direct from Development/ Test/ UAT etc..) and you create packages into a defined folder to push objects to Production

I believe this could/ should work and I would be interested to hear any thoughts on this

------------------------------
Edward Stuart

Hi James, I guess the only alternative is that you need a user with DataAdmin rights on your prod environment. Kind regards, Luc 

Yes , you are right. In that case , there is no data confidentiality provided. Very frustrating situation. 

Unbelievable how IBM has no solution for this, this is not an unusual request for the applications with high data confidentiality required. 

All needed is just a user group type that can create objects without seeing data . 

Hi James, I guess the only alternative is that you need a user with DataAdmin rights on your prod environment. Kind regards, Luc 

If there were a "CreateProcess" function in TI then that could solve the issue.

Alternatively, you could store the admin password for production somewhere which is accessible to Python and pull that in as part of the script.

The point is the Development users shouldn't know the Production password or if they do they should only be restricted to creating Processes that do not manipulate data

Prod Admin users having Test admin user rights means you could trigger a package migration between environments without their knowledge and it could work but your risk around a failed migration likely outweigh the benefits of avoiding the stop/ starting of the model.

The Planning analytics engine only accepts Rest Api migration between instances so this is going to become more common. However, I've not come across an instance where I don't have the Production admin password or have a change management process to follow to promote code/ objects

Yes , you are right. In that case , there is no data confidentiality provided. Very frustrating situation. 

Unbelievable how IBM has no solution for this, this is not an unusual request for the applications with high data confidentiality required. 

All needed is just a user group type that can create objects without seeing data . 

Hi James, I guess the only alternative is that you need a user with DataAdmin rights on your prod environment. Kind regards, Luc 

Yes! if there were "CreateProcess" function , that would solve everything. We would just put that into a chore and make that create whatever we need. 

Interesting you didn't get such requirement before. This is 3rd time we are asked for such requirement in last few years. The first 2 just condoned that we can access all their critical data. But this one is not accepting. 

If there were a "CreateProcess" function in TI then that could solve the issue.

Alternatively, you could store the admin password for production somewhere which is accessible to Python and pull that in as part of the script.

The point is the Development users shouldn't know the Production password or if they do they should only be restricted to creating Processes that do not manipulate data

Prod Admin users having Test admin user rights means you could trigger a package migration between environments without their knowledge and it could work but your risk around a failed migration likely outweigh the benefits of avoiding the stop/ starting of the model.

The Planning analytics engine only accepts Rest Api migration between instances so this is going to become more common. However, I've not come across an instance where I don't have the Production admin password or have a change management process to follow to promote code/ objects

Yes , you are right. In that case , there is no data confidentiality provided. Very frustrating situation. 

Unbelievable how IBM has no solution for this, this is not an unusual request for the applications with high data confidentiality required. 

All needed is just a user group type that can create objects without seeing data . 

Hi James, I guess the only alternative is that you need a user with DataAdmin rights on your prod environment. Kind regards, Luc 

Hello,

Perhaps you can create the New TI Process by a script use TM1 API. (tm1PY, powershell, etc ....)

Each new Ti has a specific script an receive parameters: Server, HttpPortNumber, TM1User, Password

Yous give theses scripts to PROD environment and the pearsonn wich has Admin Rigth in prod can run scripts ?

regards,

Phiippe

Yes! if there were "CreateProcess" function , that would solve everything. We would just put that into a chore and make that create whatever we need. 

Interesting you didn't get such requirement before. This is 3rd time we are asked for such requirement in last few years. The first 2 just condoned that we can access all their critical data. But this one is not accepting. 

If there were a "CreateProcess" function in TI then that could solve the issue.

Alternatively, you could store the admin password for production somewhere which is accessible to Python and pull that in as part of the script.

The point is the Development users shouldn't know the Production password or if they do they should only be restricted to creating Processes that do not manipulate data

Prod Admin users having Test admin user rights means you could trigger a package migration between environments without their knowledge and it could work but your risk around a failed migration likely outweigh the benefits of avoiding the stop/ starting of the model.

The Planning analytics engine only accepts Rest Api migration between instances so this is going to become more common. However, I've not come across an instance where I don't have the Production admin password or have a change management process to follow to promote code/ objects

Yes , you are right. In that case , there is no data confidentiality provided. Very frustrating situation. 

Unbelievable how IBM has no solution for this, this is not an unusual request for the applications with high data confidentiality required. 

All needed is just a user group type that can create objects without seeing data . 

Hi James, I guess the only alternative is that you need a user with DataAdmin rights on your prod environment. Kind regards, Luc