Planning Analytics Workspace Installation guide

With TM1 you'll have more time for analysis and other valuable activities without having to give up Excel. Cubewise will show you how

What do I need to start the installation of Workspace?

The installation would seem daunting at first as the installation of Planning Analytics Workspace is not as straight forward as the usual TM1 installations. To continue with the Workspace installation, confirm the current version of planning Analytics Local as at least version 2.0.0 or greater is required before you can continue with the installation of Workspace.

The following list contains information about requirements and the installation steps for the different operating systems supported by Planning Analytics Workspace.

Microsoft Windows Server 2016

  • Docker runs on a physical Microsoft Windows Server 2016 or a VM with Microsoft Windows Server 2016 running under VMware or Microsoft Hyper-V.
  • No hardware virtualization required.
  • Anti-virus software must fully support Windows Server 2016 and Docker.
  • Install the latest patches for Microsoft Windows Server 2016.
  • Download installation kit ipa_workspace_local_win_.zip.


  • Docker runs directly on Linux OS.
  • Download the installation kit ipa_workspace_local_.zip.

Install docker


If you are installing on a Microsoft Windows Server 2016 OS, then you don’t need to enable hardware virtualization. Docker runs on a physical Microsoft Windows Server 2016 or a virtual machine with Microsoft Windows Server 2016 running under VMware.

Are you unsure on the what and how of Docker and it’s working? Visit the Docker site to get insight into how this software assists in hosting Workspace.


  • Check and apply the latest updates to your virus protection software.
  • Ensure your Anti-virus is compatible and set up in accordance with Docker requirements.
  • Ensure the latest patches for Microsoft Windows Server 2016 is installed.
  • Install Docker Enterprise Edition by following the instructions here.
  • Download the latest version of Docker Compose.
  • Go to the Downloads section, right-click the docker-compose-Windows-x86_64.exefile, and save it as docker-compose.exe in C:\Program Files\Docker.

For more information, see Install Docker Enterprise Edition for Windows Server.

By default, Docker stores its images and containers in C:\ProgramData\Docker on Windows Server 2016. Make sure you have enough space at this location or change your Docker data-root configuration.

{ “data-root”: “d:\docker”}

For more information, see Docker daemon directory on the Docker documentation website or Docker Engine on Windows on the Microsoft documentation website.

Installing PAW

You can install Workspace directly on Microsoft Windows Server 2016 OS or Linux OS. Download and extract the installation kit specifically for your operating system. Use a folder structure that groups the installation kits into one directory which clearly shows the version number.

For example: C:\paw_install_kits\ipa_workspace_local_win_2.0.30.1132.7

Once the installation is finished, the admin tool will open in your browser.

Install Workspace directly on Windows Server 2016

The start script installs the Planning Analytics Workspace Docker images and then opens the Planning Analytics Workspace admin tool. Here’s a complete video that shows the installation of IBM Planning Analytics Local and Planning Analytics Workspace on a Microsoft Windows Server 2016:


  • Open a PowerShell terminal window, go to the directory where you extracted the installation kit, and type the following command:
  • ./Start.ps1
    • Reply “y” when you are asked if you want to start the administration tool. The Planning Analytics Workspace administration tool opens in your browser.

Connecting Planning Analytics Workspace Local to Cognos TM1 and authentication servers


In the Planning Analytics Workspace administration tool on the Configuration tab, enter the following server URIs:

  • TM1 Admin Server URI
    • Default value for the HTTPS REST API port is 5898, and 5895 for the HTTP REST API port.
  • TM1 Application Server Gateway URI
    • The TM1 Application Gateway provides access to TM1 Applications.
  • Provide the authentication Mode. This can be an option between TM1 or CAM.
    • Select TM1 if you’re using standard TM1 authentication or Integrated Windows Authentication. Select CAM if you’re using CAM security. If you selected TM1, enter the value for the TM1 Login Server URI.
    • Planning Analytics Workspace users authenticate to the system by logging in to the TM1 Login Server. Users must have the same credentials on any other TM1 server they access. You can specify a TM1 server that uses any security mode (1 – 5) for authentication. The following security modes are commonly used:
    • Security mode 1: Standard (native) TM1 authentication
    • Security mode 3: Integrated Windows Authentication
    • Security mode 2: Security modes 1 and 3 are supported. When a user logs in to Planning Analytics Workspace, they can choose between standard TM1 authentication or Integrated Windows Authentication.
  • If you selected CAM, enter the following values:
    • IBM Cognos BI Gateway URI To enable SSO for Planning Analytics Workspace, you must enter a value in this field.
    • IBM Cognos BI Dispatcher URI
    • IBM Cognos BI Authentication Namespace ID
  • Click Validate.

Planning Analytics Workspace verifies that it can communicate with the servers and that they are configured for use with it. If a server is not successfully validated, an error message is displayed.Click OK.

  • Click Update and OK to save your configuration settings.
  • Next verify that the Planning Analytics Workspace services started. For more information, see Checking the status of the services.

Access Planning Analytics Workspace by entering http:/// where is the hostname or IP address of your computer, in the address field of your browser. If you are installing on a Microsoft Windows OS other than Microsoft Windows Server 2016 and Planning Analytics Workspace is installed on the same computer as Cognos TM1, then you can use the IP address in the URIs.

Configure available Parameters

You can update the configuration of Workspace by updating the paw.env file. This file contains the current configuration parameters, additionally, you can add a few extra parameters if needed based on the list below.

The default values for the configuration parameters are stored in defaults.ps1 for the Microsoft Windows operating system and defaults.env for Linux. Keep the default files in their original state. If you wish to make changes edit the paw.ps1 and paw.env files with the changes you wish to apply.

Flag to enable IPv6 on the bridge network. Value is false.

Set to true if you are using SSL. Value is false. Leave all other SSL options at default values if you want to run using a self-signed test certificate.

Applies only to Planning Analytics Workspace Local.
If set to true, when a user logs in, they are immediately added as a user in Planning Analytics Workspace. Default value is true.

Host directory for storing service logs. Ensure that services can create directories here. Value is log.

HTTP port mapped to the host by pa-gateway. Value is 80.

HTTPS port mapped to the host by pa-gateway. Value is 443.

Name of the PAW bridge network. Value is paw_net.

IPv6 subnet for Docker containers. Value is fdfb:297:e511:0:d0c::/80.

Maximum number of seconds the gateway waits for a backend service response. Value is 120.

Docker registry. Value is pa-docker:5000/planninganalytics.

Domain name that is used to access Planning Analytics Workspace. This value is used by the gateway as the redirect target for non-SSL requests. Value is pa-gateway.

The amount of time a Planning Analytics Workspace login session can go unused before it is no longer valid. Specify a positive integer followed by a unit of time, which can be hours (h), minutes (m), or seconds (s). For example, specify 30 seconds as 30s. You can include multiple values in a single entry. For example, 1m30s is equivalent to 90 seconds. The default is 60 minutes.

For example, export SessionTimeout=”60m”.

Path to a PEM-encoded file that contains the private key, server certificate, and optionally, the entire certificate Trust Chain. Value is config/ssl/pa-workspace.pem on Microsoft Windows Server 2016 OS or config/pa-workspace.pem on Linux OS or other Windows OS.

Port for the TM1 Admin Host. The value is empty, which means to use the default port.

Path to and name of the random credential store key, which is generated the first time you start Planning Analytics Workspace. Value is config/credential_store.key.

If you are running the VM as a service using VBoxVmService, set this parameter to true to suppress scripts from probing or starting the VM using VirtualBox tools. Value is false.

Additional parameters that can be added

IBM Cognos BI CAM authentication namespace ID. Specify only when PAAuthMode = cam.

Gateway URI of the IBM Cognos BI server. Specify only when PAAuthMode = cam. To enable SSO for Planning Analytics Workspace, you must enter a value in this field.

Dispatcher URI of your IBM Cognos BI server. Specify only when PAAuthMode = cam.

Supported authentication modes. Value must be cam for IBM Cognos security authentication or tm1 for standard TM1 authentication.

URI of the TM1 Application Server. Value is http://tm1appshost:9510.

URI of the TM1 Admin Host. Value is https://tm1adminhost:5898.

URI of the TM1 server to be used for Planning Analytics Workspace authentication. Specify only when PAAuthMode = tm1.