Integrating IBM Cognos Planning into a SSL enabled Dispatcher

Transcription

1 Proven Practice Integrating IBM Cognos Planning into a SSL enabled Dispatcher Product(s): IBM Cognos Planning 8.4 Area of Interest: Infrastructure

2 Integrating IBM Cognos Planning into a SSL enabled Dispatcher 2 Copyright and Trademarks Licensed Materials - Property of IBM. Copyright IBM Corp IBM, the IBM logo, and Cognos are trademarks or registered trademarks of International Business Machines Corp., registered in many jurisdictions worldwide. Other product and service names might be trademarks of IBM or other companies. A current list of IBM trademarks is available on the Web at While every attempt has been made to ensure that the information in this document is accurate and complete, some typographical errors or technical inaccuracies may exist. IBM does not accept responsibility for any kind of loss resulting from the use of information contained in this document. The information contained in this document is subject to change without notice. This document is maintained by the Best Practices, Product and Technology team. You can send comments, suggestions, and additions to cscogpp@ca.ibm.com. Microsoft, Windows, Windows NT, and the Windows logo are trademarks of Microsoft Corporation in the United States, other countries, or both.

3 Integrating IBM Cognos Planning into a SSL enabled Dispatcher 3 Contents 1 INTRODUCTION PURPOSE APPLICABILITY ENABLING SSL ON THE DISPATCHER DISPATCHER URI SETTINGS CERTIFICATES COMMON NAME INSTALLING THE IBM COGNOS CERTIFICATE IBM COGNOS PLANNING 8.4 SERVICE VIEWING THE CERTIFICATE INSTALLING THE CERTIFICATE...8 APPENDIX A APPENDIX B... 13

4 Integrating IBM Cognos Planning into a SSL enabled Dispatcher 4 1 Introduction 1.1 Purpose This document is intended to show the reader how to enable IBM Cognos Planning to communicate with a SSL-enabled Dispatcher. 1.2 Applicability The content of this document has been tested with IBM Cognos Planning 8.4. Please note that this document doesn t go into the details of working with SSL. 2 Enabling SSL on the Dispatcher 2.1 Dispatcher URI settings In order to enable the dispatcher to use SSL internally minor changes need to be made to the configuration. Just open up the IBM Cognos Configuration tool and replace the dispatcher s protocol reference from http to https and modify the port. The default port for SSL would be 9343 but you can choose any available port. Below is a screenshot with the modified settings:

5 Integrating IBM Cognos Planning into a SSL enabled Dispatcher Certificates Common Name In order for SSL the function properly we will also need to change the Common Name for the generated server certificate. The Common Name identifies to whom a certificate is issued and should be modified to reflect the host name (or FQDN) of the Application server. By failing to do so the client Application (i.e. Internet Explorer, etc) will prompt and inform you that the certificate presented by the Application Server is invalid as the Common Name suggests this certificate is for a different server. Below is an example of this setting.

6 Integrating IBM Cognos Planning into a SSL enabled Dispatcher 6 3 Installing the IBM Cognos Certificate 3.1 IBM Cognos Planning 8.4 Service Once the above changes have been implemented, save the changes and stop both the Planning Server service and the IBM Cognos 8 service. When stopped open the Services MMC snap-in (Start > run > services.msc). Find the IBM Cognos 8 Planning service and Allow the service to interact with Desktop. This switch will allow you to import Certificates into the appropriate trust store via Graphical UI. Now go back to the IBM Cognos configuration tool and Start the IBM Cognos 8 service and then the Planning Server. When the Planning Server starts you should now get prompted with a Certificate error.

7 Integrating IBM Cognos Planning into a SSL enabled Dispatcher Viewing the Certificate When you encounter the above warning, click the View Certificate button. If the warning mentioned before should not appear then please refer to Appendix A as this shows how to import the CA certificate manually. Here you can see that the certificate presented by our dispatcher (or Common Name) cannot be verified because the CA (Cognos) which signed the certificate is not trusted by the Planning Server. Now continue by clicking the Certification Path tab and selecting the root certificate issued by the Cognos CA. Then click the View Certificate button.

8 Integrating IBM Cognos Planning into a SSL enabled Dispatcher Installing the Certificate Now that we see the Root Certificate we need to import this into the Trusted Root CA store. We will do this by using the Certificate Import Wizard. This wizard will appear as soon as you click Install Certificate.

9 Integrating IBM Cognos Planning into a SSL enabled Dispatcher 9 Now we can go through the wizard and import the certificate so the Planning Server can trust it and hence enable communication over SSL. Be sure to import the CA s Certificate into the Trusted Root Certification Authorities store as shown below.

10 Integrating IBM Cognos Planning into a SSL enabled Dispatcher 10 Appendix A If the SSL warning does not appear you can import the CA s certificate manually by following the method described below. 1) Open a browser and in the address bar type in the External Dispatcher URI entry from Cognos Configuration. That will pop up the SSL warning in the browser. 2) After clicking View Certificate you should see a similar screen to the one below.

11 Integrating IBM Cognos Planning into a SSL enabled Dispatcher 11 Here you can see that the certificate presented by our dispatcher (or Common Name) cannot be verified because the CA (Cognos) which signed the certificate is not trusted by the Planning Server. 3) Now continue by clicking the Certification Path tab and selecting the root certificate issued by the Cognos CA. Then click the View Certificate button. 4) Now that we see the Root Certificate we need to import this into the Trusted Root CA store. We will start this by exporting the certificate to DER encoded format first.

12 Integrating IBM Cognos Planning into a SSL enabled Dispatcher 12 To export the Certificate go to the Details tab, select Copy to file and complete the Certificate Export Wizard. 5) Open up the Certificates snap-in (See Appendix B) and import the file you created in the previous step by following the wizard.

13 Integrating IBM Cognos Planning into a SSL enabled Dispatcher 13 Appendix B The following steps will describe how you can set up the Certificates MMC snap-in. 1) Go to Start > Run > MMC 2) Click Add/Remove Snap-in to launch the wizard.

14 Integrating IBM Cognos Planning into a SSL enabled Dispatcher 14 3) From the list select Certificates and click Add to continue the wizard.

15 Integrating IBM Cognos Planning into a SSL enabled Dispatcher 15 Note that the above example was done for a Planning Service with Logon Identity set to Local System (hence we choose Computer Account in the Certificate snap-in wizard). If your service starts as Domain / Local user account you should be selecting Service account instead.