If you're willing to use third party software, my Object Search in CogBox handles this quite well.
When you do a search for users it runs the expressbus/content-manager API to get a list of all accounts. As users log in, I have a script that automatically records their identity and capabilities into their userprofile. This is then pulled and used to generate the output.
The output includes a separate tab which lists each user by each piece of identity. If you want to see a list of every user who has a specific identity (like Directory Admins) you can just filter on that.
The same way I'm showing identities I also list out each individual capability. Also useful to see who, for example, can use the canAuthorDashboard capability.
And since we had the tab for identities, I figured I'd just add a list showing the quantity of each capability, and the associated license it uses.
And since that worked so well, I also provide a list of all identities (excluding type account) and how many people are associated with it.
Feel free to drop me a line and I can give you a demo.
And since I'm not a sales guy, I'll also explain how to use the expressbus api if you'd prefer not to pay for a 3rd party tool (even though it's super awesome)
First, this.utils.getItems is an abstraction of a fetch request. You could just do fetch with the url, but you'd also have to define the xsrf token in the header (although there are ways around that too).
await this.utils.getItems(`${__glassAppController.glassContext.gateway}/v1/expressbus/content-manager?searchPath=//schedule[@triggerName]&properties=triggerName,parent&options={refProps:[{refPropName:parent,properties:[defaultName,searchPath,type,id]}]}`);
Breaking it down:
__glassAppController.glassContext.gateway gets the current gateway information. It will probably be something like /ibmcognos/bi but that is liable to change based on your own setup.
/v1/expressbus/content-manager this is the api endpoint. There's not much public documentation on it (and by not much I'm exaggerating), so pretty much all of this is based on trial and error.
?searchPath=//schedule[@triggerName] this is any valid searchpath expression. Cognos searchpaths are basically xpath expressions. //schedule will return every schedule in the system and [@triggerName] only returns schedules where triggerName is not null. //account will return a list of every account in the system //folder[contains(@name,'Sales')]/report will return every report that is a direct child of any folder containing the string "Sales" in it's name. https://www.ibm.com/docs/en/cognos-analytics/12.1.0?topic=developer-search-path-syntax
&properties=triggerName,parent the resulting array of objects contains any number of properties. in this case I'm asking only for the trigger name and the parent details. You can also use properties=* to get all of the properties, but I strongly recommend against doing this when you're pulling a lot of data.
&options={refProps:[{refPropName:parent,properties:[defaultName,searchPath,type,id]}]}`) this bit took me a long time to figure out. The refProps allows us to specify which objects we get when looking at things like the parent. In this case the parent of a schedule might be a report, a job, an event, or whatever. By default the parent is an array of a single object containing id, searchPath and type. The options here allows us to specify exactly what other attributes we can see in it. In this case I'm saying I also want to see the defaultName. Any valid property for the expected object will work. So specification will work for reports, but don't expect it to do anything for accounts.
Note that this isn't a published API yet, but I keep pushing for it. So far it works the same in 11.2 all the way through 12.1. It does not work in 11.1.