Cognos Application Firewall Known Issues

This Readme document contains late-breaking firewall issues.

Note: The Cognos Application Firewall component is not used with Cognos 8.

Look here for readme information about particular components:

• Installation Known Issues
• Configuration Manager Known Issues
• Data Access (UDA) Known Issues
• Access Manager Known Issues
• Architect Known Issues
• Cognos Query Known Issues
• Cognos Scheduler Known Issues
• CognosScript Editor Known Issues
• Deployment Manager Known Issues
• Impromptu Known Issues
• NoticeCast Known Issues
• PowerPlay Known Issues
• Upfront Known Issues
• Cognos Visualizer Known Issues

The Readme document also contains information about Features No Longer Supported in this release and those that will not be supported in subsequent releases.

To see Readme updates and information about deploying Cognos Enterprise Business Intelligence products, go to the Cognos support site (http://support.cognos.com).

Cognos Application Firewall Parameter-Signing and PowerPlay ISAPI Module

If you are using the PowerPlay ISAPI module with Cognos Application Firewall parameter-signing enabled, you must modify your Windows PATH variable to show the full path to the Cognos Series 7 Version 3 cgi-bin directory, as explained in the following procedure:

1. Stop your Web server.
2. From the Control Panel, select System and, on the Advanced tab of the System Properties window, click Environmental Variables.
3. Locate the Path variable, and edit the path list to include the full path to the PowerPlay Enterprise Server cgi-bin directory.
4. Click OK to save your change, and close the properties windows.
5. Restart your Web server.

454280

Cognos Application Firewall Logging (Windows 2000 XP, Windows 2003)

Cognos Application Firewall logging is not supported on Windows 2000 XP or Windows 2003 in the default configuration. This is because default Windows security settings restrict writing of log output by typical Web Server users with guest access.

File logging can be enabled, provided you grant the Web server user write permission to the Cognos Application Firewall log directory. For example, create the directory c:\caflogs, and then add permissions for the Web Server user to write to that directory. If Cognos Application Firewall fails to write a log output, it returns an error page with status -2301, -2300, -2002, -506, -514, -908, -907.

To ensure you are providing the correct write access to the Cognos Application Firewall log file, check which user account is running the CGI NSAPI, APACHEMOD, or ISAPI process for the gateway you are using. By default, Windows uses IUSR_computername and IWAM_computername. You can avoid logging errors by adding write access to these two user accounts for the Cognos Application Firewall log file.

419720

CAF Error When SiteMinder XSS-Checking is Enabled and Using Apache mod Cognos Gateways

A Cognos Application Firewall error will be generated in cases where the following implementation scenario exists:

• Components of both Cognos Enterprise Business Intelligence Series 7 and Cognos ReportNet are installed on the same system.
• Both Series 7 and ReportNet gateways are configured as Apache mod gateways.
• Cognos Application Firewall Series 7 was configured with SiteMinder XSS-checking enabled.
• The Cognos ReportNet gateway was configured with a non-default gateway name.

To resolve the problem, add the Cognos ReportNet gateway name to the gateway name list in the afconfig.ini file, located in the directory cern/caf.

nbna