Security, Authentication, and Authorization
Authentication versus authorization
Authentication proves identity through a namespace: the built-in Cognos namespace, LDAP/Active Directory, SAML 2.0, OpenID Connect, or a custom Java provider. Authorization controls what an authenticated user can do through permissions on content and capabilities on features.
Core rules
- Add the namespace in configuration and test it before assigning roles; a broken namespace blocks all non-administrator access.
- Permissions include traverse, read, write, execute, and set policy. Traverse is required on parent folders before a user can reach a child entry.
- Capabilities are secured functions and features, such as access to the administration console or report authoring; they do not grant data access.
- Use groups and roles, not individual accounts, and review the Everyone group because it can widen access unexpectedly.
- Effective permissions are the union of direct, inherited, and group permissions; check them when troubleshooting.
Worked example
A user cannot see a report in a folder. The administrator confirms group membership, then checks traverse on each parent folder, read on the report, and the capability for the reporting interface. The missing grant is traverse on an intermediate folder, so the report is invisible even though read is granted.
Traps
Granting read without traverse; treating a capability as a data permission; leaving Everyone with broad access; and forgetting that namespace configuration changes require a restart or redeploy.