Planning Analytics

Planning Analytics

Get AI-infused integrated business planning

 View Only
Expand all | Collapse all

Pafe & Paw - Setting up/Changing Password with IntergratedSecurity=1

  • 1.  Pafe & Paw - Setting up/Changing Password with IntergratedSecurity=1

    Posted Tue July 18, 2023 08:46 AM

    Hi Guys

    We have a client who use native (integratedsecurity=1) security and are migrating away from Perspective/Architect (on Prem)  to Pafe/PAW (hosted on Private Cloud). 

    Maintaining user password seem to be a problem. In PAW, once you have imported a new user, how do you assign an "initial" password. Even more importantly, in either of Pafe/PAW, how does a user change their password? We can't seem to find a way to do this, which seems really bizarre. This is supported in Perspectives & also in PASS (Tm1Web). Am I missing something?

    Regards

    Chris



    ------------------------------
    Chris Hewitt
    ------------------------------


  • 2.  RE: Pafe & Paw - Setting up/Changing Password with IntergratedSecurity=1

    Posted Wed July 19, 2023 02:48 AM

    Hi Chris

     

    There is no PAW specific user ID and password. When PAW is configured to use TM1 security it uses the password of the TM1 database that is entered into the bottom field on the PAW Admin Tool configuration page. If you have multiple TM1 databases then it is necessary to synchronise the password for all databases for each user or PAW will prompt for credentials as the user connects to each database.

    This is improved if you use CAM security as you can have the user authenticate with their windows ID and not have to manage the password synchronisation or credential re-entry.

     

    Regards

     

    Paul Coggan

     






  • 3.  RE: Pafe & Paw - Setting up/Changing Password with IntergratedSecurity=1

    Posted Wed July 19, 2023 03:08 AM

    Hi Paul

    So does this mean that if you do not have CAM configured, the only way to manage users (set them up, change passwords etc) is to remote onto the server itself and use Perspectives/Architect? The other issue I have noticed, is that when I set up a new Group in PAW (e.g. Country1_Users), is does not appear in the list of groups that I see when I want to assign users to groups. The only thing I have visible are the groups that where set up in Architect (prior to the migration). So even if CAM were used, how would I create new groups without doing so in Architect?

    Many thx

    Chris 



    ------------------------------
    Chris Hewitt
    ------------------------------



  • 4.  RE: Pafe & Paw - Setting up/Changing Password with IntergratedSecurity=1

    Posted Wed July 19, 2023 03:10 AM

    Why not have an Action Button call a process to prompt for a password and assign to the TM1User?

    Have not tested but throwing it out there...



    ------------------------------
    George Tonkin
    Business Partner
    MCI Consultants
    Johannesburg
    ------------------------------



  • 5.  RE: Pafe & Paw - Setting up/Changing Password with IntergratedSecurity=1

    Posted Wed July 19, 2023 03:14 AM

    Hi George

    Thanks - that is something I have considered. But then users will not be able to change password themselves (I tried it out). They need to have security admin rights. The other option is Tm1Web, which we can maybe use for the sole purpose of changing passwords. Also what is your take on adding/managing groups. Seems like you can only do so in Architect..?

    Regards

    Chris



    ------------------------------
    Chris Hewitt
    ------------------------------



  • 6.  RE: Pafe & Paw - Setting up/Changing Password with IntergratedSecurity=1

    Posted Wed July 19, 2023 03:20 AM

    Did you have the Security Access flag ticked on the process?

    Tried it quickly on my side and "seems" fine once Security Access is ticked and process has Read access for the user's group(s)



    ------------------------------
    George Tonkin
    Business Partner
    MCI Consultants
    Johannesburg
    ------------------------------



  • 7.  RE: Pafe & Paw - Setting up/Changing Password with IntergratedSecurity=1

    Posted Wed July 19, 2023 03:35 AM

    Thanks George! Assume you are using "AssignClientPassword"? Will this allow "regular" users to only change their own passwords? I suppose I could the "TM1User" function to ensure this, and have a separate process for admins to select any user to change. For user groups,  sounds like I would always need to use to Ti to manage if I wanted to avoid Architect.

    Appreciate your help.



    ------------------------------
    Chris Hewitt
    ------------------------------



  • 8.  RE: Pafe & Paw - Setting up/Changing Password with IntergratedSecurity=1

    Posted Wed July 19, 2023 04:57 AM
    Edited by George Tonkin Wed July 19, 2023 05:50 AM

    Yes, Simply the below where pPassword is obviously the parameter:

    AssignClientPassword(TM1User, pPassword);



    ------------------------------
    George Tonkin
    Business Partner
    MCI Consultants
    Johannesburg
    ------------------------------



  • 9.  RE: Pafe & Paw - Setting up/Changing Password with IntergratedSecurity=1

    Posted Wed July 19, 2023 03:24 AM

    So does this mean that if you do not have CAM configured, the only way to manage users (set them up, change passwords etc) is to remote onto the server itself and use Perspectives/Architect?

     

    Yes that' s correct for out of the box on premise PA.  You can also use the TM1 Web password change capability once a user is set up.

     

    We have written TI processes and created PAW workbooks that also support that process outside of Perspectives.

     

    I believe that a recent release of IBM Cloud based PAW does have new security admin functionality but I have not had opportunity to review this yet – perhaps it will be provided to the on premise version in future...

     

    The other issue I have noticed, is that when I set up a new Group in PAW (e.g. Country1_Users), is does not appear in the list of groups that I see when I want to assign users to groups. The only thing I have visible are the groups that where set up in Architect (prior to the migration). So even if CAM were used, how would I create new groups without doing so in Architect?

    PAW groups are independent of the user groups in the TM1 Databases. PAW groups are used for assigning access to PAW workbooks and applications. The database specific user groups still apply at the database level as an additional layer of security to administer. That still needs to be done via Architect or via a TI process.

     

     

    Regards

     

    Paul Coggan






  • 10.  RE: Pafe & Paw - Setting up/Changing Password with IntergratedSecurity=1

    Posted Wed July 19, 2023 03:05 AM

    There is an enhancement request for PAfE:

    https://ibm-data-and-ai.ideas.ibm.com/ideas/PAOC-I-619
    Mode 1 Users can change their own Password in Pafe 

    Regards



    ------------------------------
    Bernd Siebert
    ------------------------------



  • 11.  RE: Pafe & Paw - Setting up/Changing Password with IntergratedSecurity=1

    Posted Wed July 19, 2023 03:15 AM

    Hi Bernd

    Thanks - I did spot this. However Stuart replied to this, and status is "not under consideration"

    Regards

    Chris



    ------------------------------
    Chris Hewitt
    ------------------------------