Planning Analytics

 View Only

 Security configuration for TM1 access through Python?

Quin Kan's profile image
Quin Kan posted Tue January 07, 2025 08:15 PM

Hi,

I can access Planning Analytics data through PAX in Excel and through a web browser.  Now trying to get the same data using Python (TM1py).

Though the connection in the Python worked (as it returned the TM1 version), it did not return any cubes that I can see when I use PAX.  There was no error.

The team that manages the TM1 server suggested me to get another domain account, and they will assign it the same roles as I.  But it does not seem to be a solution.

For those who have any insight, is the issue due to server configuration?  I heard about CAM, and wonder if there is something specific that needs to be done in CAM.

Also, my colleague could see his cubes when he ran the same piece of code.  Wonder if the security configuration at the server is user specific, and that seems to make sense.  This leads to another question: is the security configuration for PAX and web access is different from Python access?  

Thanks

Vlad Didenko's profile image
Vlad Didenko IBM Champion posted Tue January 07, 2025 11:14 PM

TM1 security works the same across all UI interfaces (PAX, PAfE, TM1Web, Workspace, etc.) and the REST API (your use case with TM1py).

Are you using the same account for both PAX and TM1py?

If not, check the security permissions assigned to the account used with TM1py to ensure it has the necessary access rights. Using tools like TeamOne and SPACE you can easily troubleshoot permissions issues:

Quin Kan's profile image
Quin Kan posted Wed January 08, 2025 11:20 AM

Thank you for your reply and information, Vlad.  I use the same account for both PAX and TM1py.  Best regards.

Vlad Didenko's profile image
Vlad Didenko IBM Champion posted Thu January 09, 2025 02:28 AM

If you're using the same account in TM1py, sharing your Python code could help pinpoint the issue.

Quin Kan's profile image
Quin Kan posted Thu January 09, 2025 01:26 PM
The following is the code I use.  I removed the values in the connection string, except the one for ssl.
A colleague gave it to me, and the code works for him.
 
 
 
from TM1py import TM1Service
 
 
with TM1Service(address="", port=, ssl=False, namespace="", gateway="") as tm1:
    
    print('SW Version:\n')
    print(tm1.server.get_product_version())
    
    cube_names = tm1.cubes.get_all()
 
    print('\nCube Names:\n')
    for cube_name in cube_names:
        print(cube_name)
 
 
 
When I ran the program above, it returned the TM1 version, but nothing was returned for the cube name.  There was no error.
 
By the way, I just realized recently that the address in the connection string is for a Cognos server that I never use before.  
 
When I access the Cognos server using a web browser, I saw some cubes.  
 
Thank you
Vlad Didenko's profile image
Vlad Didenko IBM Champion posted Fri January 10, 2025 12:30 AM
...By the way, I just realized recently that the address in the connection string is for a Cognos server that I never use before.  

To ensure you are connected to the correct server with the appropriate user credentials, please confirm that the following two print statements return the expected output:

print(f"Server Name: {tm1.server.get_server_name()}")
print(f"User: {tm1.whoami}")

Chad Harvey's profile image
Chad Harvey posted Fri January 10, 2025 11:55 AM

Quin,

I think the function you are looking for is tm1.cubes.get_all_names()

This function will return the names for all cubes.  The function you are using tm1.cubes.get_all() is returning the cube objects themselves (i.e. JSON object).  if you want to continue to use the get_all() function you would need to do something like the follwing:

for cube in cube_names:

     print(cube.name)

Quin Kan's profile image
Quin Kan posted Fri January 10, 2025 02:07 PM
Hi Vlad,
 
Thank you for your code, which is helpful!  
 
The server returned was not the one I need access.  It is the one that the colleague, who sent me the original code, uses.
Does that mean the server I need access is not enabled for REST?  Perhaps it is something I need to ask our TM1 server team to check?
By the way, in the connection string, I added server="replaced-with-my-actual-server-name", but that did not help.  Again, the server was the one that my colleague accesses.
 
For the user, all returned parameters had a value, except "Groups@odata.bind", which had an empty bracket [].  Does it tell us anything?
 
Thank you, and have a great weekend!
 
Quin
Quin Kan's profile image
Quin Kan posted Fri January 10, 2025 02:13 PM

Hi Chad,

Thank you for your information; it's good to know.  I changed to using the following:

    # get all cubes
    cube_names = tm1.cubes.get_all_names()
   
    print('\nCube Names:\n')
    for cube_name in cube_names:
        print(cube_name)
No cube name was returned.
Best regards, and have a good weekend!
Quin
Vlad Didenko's profile image
Vlad Didenko IBM Champion posted Fri January 10, 2025 02:41 PM
The server returned was not the one I need access.  It is the one that the colleague, who sent me the original code, uses.
Does that mean the server I need access is not enabled for REST?  Perhaps it is something I need to ask our TM1 server team to check?
1. Check if you are using the correct port number, it should be the HttpPortNumber specified in their respective tm1s.cfg . You may have multiple TM1 servers running on the same machine and connecting to the wrong one.
2. Confirm if you have any proxies or load balancers used for the TM1 servers (which is pretty rare)
3. tm1.cubes.get_all() will still work, but it will return all cube information instead of just the names
Groups@odata.bind", which had an empty bracket [].
That means your user account has no access within the specified TM1 server hence you can see no cubes
Quin Kan's profile image
Quin Kan posted Tue January 14, 2025 11:51 AM

Thank you very much, Vlad, for mentioning to check whether the port number is correct etc and for your information about the empty Groups@odata.bind. 

I did wonder how users can switch between different TM1 servers if they have access to more than TM1 servers in the computer.  I tried adding server="replacedWithMyTM1serverName" to the connection string.  But it again returned my colleague's TM1 server, not mine.  I will pass along the info to the people who manage the TM1 server.

Best regards.

Edward Stuart's profile image
Edward Stuart IBM Champion posted Tue January 14, 2025 12:18 PM

Hi Quin,

Can you check what you can see when you put the Admin Host API link into a web browser, this requires no authentication and will display all available servers:

If not using HTTPS:

http://<tm1server>:5895/api/v1/Servers

If using HTTPS:

https://<tm1server>:5898/api/v1/Servers

Where <tm1server> is the admin host your Tm1 Server sits on

This should display some JSON which will identify what servers are running on the admin host and their details:

Can you confirm that your TM1 Server is listed and compare the differences between your server and the server you are able to connect to.

The theory is you should be able to use the HOST value alongside the HTTPPortNumber value to build up the API string to connect via TM1Py or any other method you wish.

See the below IBM Documentation for information:

https://www.ibm.com/docs/en/planning-analytics/2.0.0?topic=api-tm1-admin-server 

Quin Kan's profile image
Quin Kan posted Thu January 16, 2025 01:10 PM

Edward,

Thanks for your suggestion and information.  I tried it the other day; did not work (cannot reach).  Got side tracked, so did not reply till now.

The team that manages the TM1 server must be busy, as I have not heard from them.   I wish I had access to the computer that houses different TM1 instances to look into it further.   

Best regards.

Related Content