Hi,

Is there a way where I can block users from logging into PAW if another person is already logged in with the same user?
So they're forced to use their own user...
#PlanningAnalyticswithWatson

Hi Luiz,

There is no option to prevent a user from logging in twice into Planning Analytics Workspace.  Based on your question it sounds like users are sharing accounts.  I would be interested to understand why users are sharing accounts?


------------------------------
Stuart King
IBM Planning Analytics Offering Manager
------------------------------

Hi Stuart, 
We have a license that we can rent our users to other people, and we would like to avoid this type of situation of user sharing an account so our clients can purchase less users from us.

How does IBM control that?
We would like to implement something so we can at least monitor if this is happening.

------------------------------
--------------------
Luiz R.
------------------------------

Original Message:
Sent: Wed January 22, 2020 07:07 AM
From: STUART KING
Subject: Restrict users from logging in with same account

Hi Luiz,

There is no option to prevent a user from logging in twice into Planning Analytics Workspace.  Based on your question it sounds like users are sharing accounts.  I would be interested to understand why users are sharing accounts?


------------------------------
Stuart King
IBM Planning Analytics Offering Manager
------------------------------

Hello, Luiz!

First of all, it seems that this problem should be solved nevertheless organizationally. For example, add information to the main page (welcome page or something else) about personal responsibility for unauthorized entry under the credentials of another user or about possible sudden checks of the IBM and existing fines in accordance with the license agreement.

If we talk about the technical side, the problem is that you can't disconnect a specific ID (you can see all IDs in TM1Top), as far as I know, you can only disconnect all user connection IDs at once ("Server manager" -> "Disconnect Clients" or through TM1 REST API).
Therefore, the most appropriate way seems to be that the user, before entering the authorization page in PAW, first goes to a special site that has fields for entering a login and password and verifies the client name and, for example, current computer account and does not allow to go further in PAW, if the credentials are different. If everything is successful, then sends it to PAW.
This site can use TM1 REST API to connect to the TM1 model and search in the attributes or configuration cube for the client and the account of each user machine.

Another option, for example, is to configure Integrated Login, SSO, so there is no need to enter credentials.

--
Best regards,
Dmitry

------------------------------
Dmitry Noskov
Intapplex
------------------------------

Hello Dimitry!

Thank you for sharing your great ideas. We will consider each one of them.

I have some questions though.
I like the idea of having a customized page where a user can log into before going into PAW, do you think is it possible we can implement this and after a user logins into our page and if the rest api call is sucessful then we can automatically redirect to a logged PAW page? I mean, without the user having to login again in the paw welcome page.

------------------------------
--------------------
Luiz R.
------------------------------

Original Message:
Sent: Wed January 22, 2020 07:03 AM
From: Dmitry Noskov
Subject: Restrict users from logging in with same account

Hello, Luiz!

First of all, it seems that this problem should be solved nevertheless organizationally. For example, add information to the main page (welcome page or something else) about personal responsibility for unauthorized entry under the credentials of another user or about possible sudden checks of the IBM and existing fines in accordance with the license agreement.

If we talk about the technical side, the problem is that you can't disconnect a specific ID (you can see all IDs in TM1Top), as far as I know, you can only disconnect all user connection IDs at once ("Server manager" -> "Disconnect Clients" or through TM1 REST API).
Therefore, the most appropriate way seems to be that the user, before entering the authorization page in PAW, first goes to a special site that has fields for entering a login and password and verifies the client name and, for example, current computer account and does not allow to go further in PAW, if the credentials are different. If everything is successful, then sends it to PAW.
This site can use TM1 REST API to connect to the TM1 model and search in the attributes or configuration cube for the client and the account of each user machine.

Another option, for example, is to configure Integrated Login, SSO, so there is no need to enter credentials.

--
Best regards,
Dmitry

------------------------------
Dmitry Noskov
Intapplex
------------------------------

Hi 

It depends what method of authentication you are using - check your TM1S.CFG

If you are using IntegratedSecurityMode 1, ie TM1 Authentication, then open the }ClientProperties cube and put 1 into MaximumPorts.

If you are using Mode 5 CAM Authentication I am not sure if this works. If not, you may need to speak to whomever manages the authentication method behind CAM, which is typically Microsoft Active Directory.

It is probably more likely that you are using TM1 Authentication, unless your users are also sharing their Windows passwords. A bit of education on the perils of sharing passwords would not go amiss.

A downside of limiting the MaximumPorts to 1 is that if a user's session terminates for any reason, eg Excel crashes, then they may not be able to login, until their session expires, which will be controlled by the IdleConnectionTimeout setting in the TM1S.CFG. From memory the default on this is 20 mins, but we always up it to 3600 seconds, ie an hour, as users complain about being logged out if they go for a coffee.

If you are using Cognos BI aka Cognos Analytics as well ,then again limiting the ports may cause issues as BI typically tries to run different parts of the query on multiple connections.

Regards

Paul Simon



------------------------------
Paul Simon
------------------------------

I seem to recall that setting MaximumPorts to 1 breaks Planning Analytics Workspace and Planning Analytics for Microsoft Excel.  Both of these tools make multiple connections to the TM1 database per user.  I think Workspace makes up to 6 connections when a user is interacting with a book.  The number of connections (threads) from Planning Analytics for Excel can be much higher.

------------------------------
Stuart King
IBM Planning Analytics Offering Manager
------------------------------

Original Message:
Sent: Wed January 22, 2020 03:52 PM
From: Paul Simon
Subject: Restrict users from logging in with same account

Hi 

It depends what method of authentication you are using - check your TM1S.CFG

If you are using IntegratedSecurityMode 1, ie TM1 Authentication, then open the }ClientProperties cube and put 1 into MaximumPorts.

If you are using Mode 5 CAM Authentication I am not sure if this works. If not, you may need to speak to whomever manages the authentication method behind CAM, which is typically Microsoft Active Directory.

It is probably more likely that you are using TM1 Authentication, unless your users are also sharing their Windows passwords. A bit of education on the perils of sharing passwords would not go amiss.

A downside of limiting the MaximumPorts to 1 is that if a user's session terminates for any reason, eg Excel crashes, then they may not be able to login, until their session expires, which will be controlled by the IdleConnectionTimeout setting in the TM1S.CFG. From memory the default on this is 20 mins, but we always up it to 3600 seconds, ie an hour, as users complain about being logged out if they go for a coffee.

If you are using Cognos BI aka Cognos Analytics as well ,then again limiting the ports may cause issues as BI typically tries to run different parts of the query on multiple connections.

Regards

Paul Simon



------------------------------
Paul Simon
------------------------------