CAM, SSO and the user's own session

Application login and connection login

UBC Data Bridge can use its own accounts, external SSO or IBM Cognos CAM login. Each TM1 connection separately has its own authentication method. Logging into UBC Data Bridge through SSO does not change the connection's saved Basic, CAMNamespace or Bearer credentials.

In CAM mode, Cognos passes a temporary ticket to a protected return address. The UBC Data Bridge server validates it through TM1 by reading ActiveUser and groups. The UBC Data Bridge role is determined by application access rules; an IBM group name alone does not grant an administrator role.

A “From user session” connection

1. Select “From user session” in the connection.
2. Enter the namespace and Cognos gateway address, for example https://cognos.example.com/ibmcognos/bi/v1/disp. An empty address uses the installation's gateway if configured.
3. Click “Test”. If there is no IBM login yet, choose “Sign in to IBM”.
4. Complete the corporate login in a separate window. Second-factor checks take place in the login system.
5. Return to UBC Data Bridge. The test repeats automatically after login; repeat other actions as needed.

The connection does not store a password. The temporary ticket is associated with the current session, Cognos gateway and namespace. TM1 validates it and applies the IBM user's permissions.

Session lifetime and termination

When TM1 no longer accepts the ticket, UBC Data Bridge requests a new login with code CAM_SESSION_EXPIRED. The absence of a matching login is indicated by CAM_SESSION_REQUIRED. When UBC Data Bridge uses CAM login, the same ticket can be used by a connection with the matching gateway and namespace.

Logging out of UBC Data Bridge ends its session and associated button permissions. This is not a global logout from Cognos, Workspace or the corporate identity provider: their browser sessions are managed by the respective systems.

When this method is unsuitable

• A scheduled background run without a user cannot use their interactive ticket. Use an appropriate service connection.
• This method is unavailable when UBC Data Bridge runs inside UBC Analytics, because UBC Analytics owns the login and user session.
• The “Sign in to IBM” button requires an HTTPS address for UBC Data Bridge.
• The Cognos administrator must allow UBC Data Bridge return addresses in a separate XML file. Being signed into PAW does not complete the integration without this configuration.

Administrator settings

The return address is constructed from BRIDGE_ORIGIN, BRIDGE_BASE_PATH and the CAM route. HTTPS requires BRIDGE_COOKIE_SECURE=true. After configuration, test a new login, rejection of a user without access, and signing in again after session expiry.