diff --git a/.fixtures.yml b/.fixtures.yml
new file mode 100644
index 0000000..c269a20
--- /dev/null
+++ b/.fixtures.yml
@@ -0,0 +1,7 @@
+# ref: https://github.com/puppetlabs/puppetlabs_spec_helper#fixtures-examples
+# the symlinks are relative to the fixtures directory, hence all the '..'
+fixtures:
+  repositories:
+    stdlib: "git://github.com/puppetlabs/puppetlabs-stdlib"
+    firewalld: "git://github.com/crayfishx/puppet-firewalld"
+    #db2: "git://github.com/jpuskar/puppet-db2"
diff --git a/.gitignore b/.gitignore
new file mode 100644
index 0000000..51af1ec
--- /dev/null
+++ b/.gitignore
@@ -0,0 +1,6 @@
+# Created by .ignore support plugin (hsz.mobi)
+.idea/
+.vagrant/
+vagrant/
+custom
+cognos_11_installer.properties
\ No newline at end of file
diff --git a/Gemfile b/Gemfile
new file mode 100644
index 0000000..42ff184
--- /dev/null
+++ b/Gemfile
@@ -0,0 +1,41 @@
+source 'https://rubygems.org'
+
+# NOTE: Relying on the controlrepo gem in jenkins will end up with over 100 gems
+# installed as dependencies.  When running in CI, this can be unnecessarily time
+# consuming, especially if only RSpec tests are being exercised.  Consuder using
+# the controlrepo gem when integration and system level tests are exericsed, but
+# for now I recommend only using it in development, not when testing in CI.
+
+group :development do
+  # controlrepo is a helper tool to setup spec and integration testing inside of a
+  # Puppet control repository.  We're not using the rake rakes, but instead
+  # directly invoking `rspec spec` in an effort to cut down on the amount of
+  # implicit, magic behavior.  The controlrepo gem provides value in the form of
+  # an updated set of depenencies suitable for spec testing using rspec-puppet.
+  #
+  # https://github.com/jeffmccune/controlrepo_gem
+  gem 'controlrepo'
+  # Interactive debugger and REPL breakpoint tool
+  # See http://pryrepl.org/
+  gem 'pry'
+  gem 'pry-stack_explorer'
+end
+
+group :test, :development do
+  gem 'puppet', '4.9.4'
+  # should be 3.7.2 but not available on rubygems
+  gem 'facter'
+  gem 'hiera', '3.3.1'
+  gem 'hiera-eyaml', '2.1.0'
+  gem 'parallel_tests'
+
+  # other testing gems we want
+  gem 'rspec-puppet'
+  gem 'puppetlabs_spec_helper'
+  gem 'rake-notes'
+
+  # pinning specific versions
+  gem 'puppet-lint', '~> 2.1'
+
+end
+
diff --git a/Gemfile.lock b/Gemfile.lock
new file mode 100644
index 0000000..748e18c
--- /dev/null
+++ b/Gemfile.lock
@@ -0,0 +1,397 @@
+GEM
+  remote: https://rubygems.org/
+  specs:
+    CFPropertyList (2.3.5)
+    addressable (2.5.1)
+      public_suffix (~> 2.0, >= 2.0.2)
+    aws-sdk-v1 (1.67.0)
+      json (~> 1.4)
+      nokogiri (~> 1)
+    beaker (3.17.0)
+      aws-sdk-v1 (~> 1.57)
+      beaker-hiera (~> 0.0)
+      beaker-hostgenerator
+      docker-api
+      fission (~> 0.4)
+      fog (~> 1.38)
+      google-api-client (~> 0.9)
+      hocon (~> 1.0)
+      in-parallel (~> 0.1)
+      inifile (~> 3.0)
+      minitar (~> 0.5.4)
+      minitest (~> 5.4)
+      net-scp (~> 1.2)
+      net-ssh (~> 4.0)
+      open_uri_redirections (~> 0.2.1)
+      rbvmomi (~> 1.9)
+      rsync (~> 1.0.9)
+      stringify-hash (~> 0.0)
+      thor (~> 0.19)
+      unf (~> 0.1)
+    beaker-hiera (0.1.1)
+      stringify-hash (~> 0.0.0)
+    beaker-hostgenerator (0.8.4)
+      deep_merge (~> 1.0)
+      stringify-hash (~> 0.0.0)
+    beaker-rspec (6.1.0)
+      beaker (~> 3.0)
+      rspec (~> 3.0)
+      serverspec (~> 2)
+      specinfra (~> 2)
+    binding_of_caller (0.7.2)
+      debug_inspector (>= 0.0.1)
+    builder (3.2.3)
+    coderay (1.1.1)
+    colored (1.2)
+    controlrepo (2.0.10)
+      beaker-rspec
+      bundler
+      git
+      json (>= 1.8.2)
+      puppet
+      puppetlabs_spec_helper (>= 0.4.0)
+      r10k (>= 2.1.0)
+      rake (>= 10.0.0)
+      rspec (>= 3.0.0)
+      rspec-puppet
+    cri (2.6.1)
+      colored (~> 1.2)
+    debug_inspector (0.0.3)
+    declarative (0.0.9)
+    declarative-option (0.1.0)
+    deep_merge (1.1.1)
+    diff-lcs (1.3)
+    docker-api (1.33.4)
+      excon (>= 0.38.0)
+      json
+    excon (0.56.0)
+    facter (3.6.4)
+    faraday (0.9.2)
+      multipart-post (>= 1.2, < 3)
+    faraday_middleware (0.10.1)
+      faraday (>= 0.7.4, < 1.0)
+    fast_gettext (1.1.0)
+    fission (0.5.0)
+      CFPropertyList (~> 2.2)
+    fog (1.40.0)
+      fog-aliyun (>= 0.1.0)
+      fog-atmos
+      fog-aws (>= 0.6.0)
+      fog-brightbox (~> 0.4)
+      fog-cloudatcost (~> 0.1.0)
+      fog-core (~> 1.43)
+      fog-digitalocean (>= 0.3.0)
+      fog-dnsimple (~> 1.0)
+      fog-dynect (~> 0.0.2)
+      fog-ecloud (~> 0.1)
+      fog-google (<= 0.1.0)
+      fog-json
+      fog-local
+      fog-openstack
+      fog-powerdns (>= 0.1.1)
+      fog-profitbricks
+      fog-rackspace
+      fog-radosgw (>= 0.0.2)
+      fog-riakcs
+      fog-sakuracloud (>= 0.0.4)
+      fog-serverlove
+      fog-softlayer
+      fog-storm_on_demand
+      fog-terremark
+      fog-vmfusion
+      fog-voxel
+      fog-vsphere (>= 0.4.0)
+      fog-xenserver
+      fog-xml (~> 0.1.1)
+      ipaddress (~> 0.5)
+      json (>= 1.8, < 2.0)
+    fog-aliyun (0.1.0)
+      fog-core (~> 1.27)
+      fog-json (~> 1.0)
+      ipaddress (~> 0.8)
+      xml-simple (~> 1.1)
+    fog-atmos (0.1.0)
+      fog-core
+      fog-xml
+    fog-aws (1.3.0)
+      fog-core (~> 1.38)
+      fog-json (~> 1.0)
+      fog-xml (~> 0.1)
+      ipaddress (~> 0.8)
+    fog-brightbox (0.11.0)
+      fog-core (~> 1.22)
+      fog-json
+      inflecto (~> 0.0.2)
+    fog-cloudatcost (0.1.2)
+      fog-core (~> 1.36)
+      fog-json (~> 1.0)
+      fog-xml (~> 0.1)
+      ipaddress (~> 0.8)
+    fog-core (1.44.3)
+      builder
+      excon (~> 0.49)
+      formatador (~> 0.2)
+    fog-digitalocean (0.3.0)
+      fog-core (~> 1.42)
+      fog-json (>= 1.0)
+      fog-xml (>= 0.1)
+      ipaddress (>= 0.5)
+    fog-dnsimple (1.0.0)
+      fog-core (~> 1.38)
+      fog-json (~> 1.0)
+    fog-dynect (0.0.3)
+      fog-core
+      fog-json
+      fog-xml
+    fog-ecloud (0.3.0)
+      fog-core
+      fog-xml
+    fog-google (0.1.0)
+      fog-core
+      fog-json
+      fog-xml
+    fog-json (1.0.2)
+      fog-core (~> 1.0)
+      multi_json (~> 1.10)
+    fog-local (0.3.1)
+      fog-core (~> 1.27)
+    fog-openstack (0.1.21)
+      fog-core (>= 1.40)
+      fog-json (>= 1.0)
+      ipaddress (>= 0.8)
+    fog-powerdns (0.1.1)
+      fog-core (~> 1.27)
+      fog-json (~> 1.0)
+      fog-xml (~> 0.1)
+    fog-profitbricks (3.0.0)
+      fog-core (~> 1.42)
+      fog-json (~> 1.0)
+    fog-rackspace (0.1.5)
+      fog-core (>= 1.35)
+      fog-json (>= 1.0)
+      fog-xml (>= 0.1)
+      ipaddress (>= 0.8)
+    fog-radosgw (0.0.5)
+      fog-core (>= 1.21.0)
+      fog-json
+      fog-xml (>= 0.0.1)
+    fog-riakcs (0.1.0)
+      fog-core
+      fog-json
+      fog-xml
+    fog-sakuracloud (1.7.5)
+      fog-core
+      fog-json
+    fog-serverlove (0.1.2)
+      fog-core
+      fog-json
+    fog-softlayer (1.1.4)
+      fog-core
+      fog-json
+    fog-storm_on_demand (0.1.1)
+      fog-core
+      fog-json
+    fog-terremark (0.1.0)
+      fog-core
+      fog-xml
+    fog-vmfusion (0.1.0)
+      fission
+      fog-core
+    fog-voxel (0.1.0)
+      fog-core
+      fog-xml
+    fog-vsphere (1.10.0)
+      fog-core
+      rbvmomi (~> 1.9)
+    fog-xenserver (0.3.0)
+      fog-core
+      fog-xml
+    fog-xml (0.1.3)
+      fog-core
+      nokogiri (>= 1.5.11, < 2.0.0)
+    formatador (0.2.5)
+    gettext (3.2.2)
+      locale (>= 2.0.5)
+      text (>= 1.3.0)
+    gettext-setup (0.25)
+      fast_gettext (~> 1.1.0)
+      gettext (>= 3.0.2)
+      locale
+    git (1.3.0)
+    google-api-client (0.11.3)
+      addressable (>= 2.5.1)
+      googleauth (~> 0.5)
+      httpclient (>= 2.8.1, < 3.0)
+      mime-types (>= 3.0)
+      representable (~> 3.0)
+      retriable (>= 2.0, < 4.0)
+    googleauth (0.5.1)
+      faraday (~> 0.9)
+      jwt (~> 1.4)
+      logging (~> 2.0)
+      memoist (~> 0.12)
+      multi_json (~> 1.11)
+      os (~> 0.9)
+      signet (~> 0.7)
+    hiera (3.3.1)
+    hiera-eyaml (2.1.0)
+      highline (~> 1.6.19)
+      trollop (~> 2.0)
+    highline (1.6.21)
+    hocon (1.2.5)
+    httpclient (2.8.3)
+    in-parallel (0.1.17)
+    inflecto (0.0.2)
+    inifile (3.0.0)
+    ipaddress (0.8.3)
+    json (1.8.6)
+    json_pure (1.8.6)
+    jwt (1.5.6)
+    little-plugger (1.1.4)
+    locale (2.1.2)
+    log4r (1.1.10)
+    logging (2.2.2)
+      little-plugger (~> 1.1)
+      multi_json (~> 1.10)
+    memoist (0.15.0)
+    metaclass (0.0.4)
+    method_source (0.8.2)
+    mime-types (3.1)
+      mime-types-data (~> 3.2015)
+    mime-types-data (3.2016.0521)
+    mini_portile2 (2.1.0)
+    minitar (0.5.4)
+    minitest (5.10.2)
+    mocha (1.2.1)
+      metaclass (~> 0.0.1)
+    multi_json (1.12.1)
+    multipart-post (2.0.0)
+    net-scp (1.2.1)
+      net-ssh (>= 2.6.5)
+    net-ssh (4.1.0)
+    net-telnet (0.1.1)
+    nokogiri (1.7.2)
+      mini_portile2 (~> 2.1.0)
+    open_uri_redirections (0.2.1)
+    os (0.9.6)
+    parallel (1.11.2)
+    parallel_tests (2.14.1)
+      parallel
+    pry (0.10.4)
+      coderay (~> 1.1.0)
+      method_source (~> 0.8.1)
+      slop (~> 3.4)
+    pry-stack_explorer (0.4.9.2)
+      binding_of_caller (>= 0.7)
+      pry (>= 0.9.11)
+    public_suffix (2.0.5)
+    puppet (4.9.4)
+      facter (> 2.0, < 4)
+      gettext-setup (>= 0.10, < 1)
+      hiera (>= 2.0, < 4)
+      json_pure (~> 1.8)
+      locale (~> 2.1)
+    puppet-lint (2.2.1)
+    puppet-syntax (2.4.0)
+      rake
+    puppet_forge (2.2.4)
+      faraday (~> 0.9.0)
+      faraday_middleware (>= 0.9.0, < 0.11.0)
+      gettext-setup (~> 0.11)
+      minitar
+      semantic_puppet (~> 0.1.0)
+    puppetlabs_spec_helper (2.1.3)
+      mocha (~> 1.0)
+      puppet-lint (~> 2.0)
+      puppet-syntax (~> 2.0)
+      rspec-puppet (~> 2.0)
+    r10k (2.5.4)
+      colored (= 1.2)
+      cri (~> 2.6.1)
+      gettext-setup (~> 0.5)
+      log4r (= 1.1.10)
+      minitar (= 0.5.4)
+      multi_json (~> 1.10)
+      puppet_forge (~> 2.2)
+      semantic_puppet (~> 0.1.0)
+    rake (12.0.0)
+    rake-notes (0.2.0)
+      colored
+      rake
+    rbvmomi (1.11.2)
+      builder (~> 3.0)
+      json (>= 1.8)
+      nokogiri (~> 1.5)
+      trollop (~> 2.1)
+    representable (3.0.4)
+      declarative (< 0.1.0)
+      declarative-option (< 0.2.0)
+      uber (< 0.2.0)
+    retriable (3.0.2)
+    rspec (3.6.0)
+      rspec-core (~> 3.6.0)
+      rspec-expectations (~> 3.6.0)
+      rspec-mocks (~> 3.6.0)
+    rspec-core (3.6.0)
+      rspec-support (~> 3.6.0)
+    rspec-expectations (3.6.0)
+      diff-lcs (>= 1.2.0, < 2.0)
+      rspec-support (~> 3.6.0)
+    rspec-its (1.2.0)
+      rspec-core (>= 3.0.0)
+      rspec-expectations (>= 3.0.0)
+    rspec-mocks (3.6.0)
+      diff-lcs (>= 1.2.0, < 2.0)
+      rspec-support (~> 3.6.0)
+    rspec-puppet (2.5.0)
+      rspec
+    rspec-support (3.6.0)
+    rsync (1.0.9)
+    semantic_puppet (0.1.4)
+      gettext-setup (>= 0.3)
+    serverspec (2.39.1)
+      multi_json
+      rspec (~> 3.0)
+      rspec-its
+      specinfra (~> 2.68)
+    sfl (2.3)
+    signet (0.7.3)
+      addressable (~> 2.3)
+      faraday (~> 0.9)
+      jwt (~> 1.5)
+      multi_json (~> 1.10)
+    slop (3.6.0)
+    specinfra (2.68.0)
+      net-scp
+      net-ssh (>= 2.7, < 5.0)
+      net-telnet
+      sfl
+    stringify-hash (0.0.2)
+    text (1.3.1)
+    thor (0.19.4)
+    trollop (2.1.2)
+    uber (0.1.0)
+    unf (0.1.4)
+      unf_ext
+    unf_ext (0.0.7.4)
+    xml-simple (1.1.5)
+
+PLATFORMS
+  ruby
+
+DEPENDENCIES
+  controlrepo
+  facter
+  hiera (= 3.3.1)
+  hiera-eyaml (= 2.1.0)
+  parallel_tests
+  pry
+  pry-stack_explorer
+  puppet (= 4.9.4)
+  puppet-lint (~> 2.1)
+  puppetlabs_spec_helper
+  rake-notes
+  rspec-puppet
+
+BUNDLED WITH
+   1.14.6
diff --git a/README.md b/README.md
new file mode 100644
index 0000000..5d5629f
--- /dev/null
+++ b/README.md
@@ -0,0 +1,54 @@
+# cognos
+
+#### Table of Contents
+
+1. [Description](#description)
+1. [Setup - The basics of getting started with cognos](#setup)
+    * [Setup requirements](#setup-requirements)
+1. [Usage - Configuration options and additional functionality](#usage)
+1. [Reference - An under-the-hood peek at what the module is doing and how](#reference)
+1. [Limitations - OS compatibility, etc.](#limitations)
+1. [Development - Guide for contributing to the module](#development)
+
+## Description
+
+This module installs and configures a basic cognos server using db2.
+
+## Setup
+
+### Setup Requirements
+
+The cognos and db2 v10.1 install binaries must be pre-staged, and the parameter named 'installer_source_dir' configured.
+
+## Usage
+The param 'installer_source_dir' expects to find the folder ./exp.
+For example, if "/root" is specified, than this should exist: "/root/exp/db2"
+
+
+```puppet
+class {'cognos':
+  cognos_user_password    => 'mypass',
+  cognos_db_user_password => 'mypass',
+  cog_users_password_salt => 'random phrase',
+  installer_source_dir    => '/root',
+  installer_filename      => 'ca_srv_lnxi38664_11.0.5.16111917.bin',
+}
+```
+## Reference
+
+Please see the individual manifest files for additional parameters.
+
+## Limitations
+
+This module has only been tested with Cognos 11.0.5 using DB2 Express V10.1 on Centos 7.3.
+
+In addition, it currently does not support:
++ Content Managers other than DB2 running on localhost.
++ Multiple servers / tires.
++ Authentication providers of any kind.
+## Development
+
+This module includes a Vagrantfile for easy testing. Just install vagrant and virtualbox, clone this repo, and 'vagrant up'.
+
+To stage the DB2 media, make a folder in the repo root called "vagrant", and ensure that the folder structure looks like: "./puppet-cognos/vagrant/exp/db2".
+The cognos installer file must also reside in "./puppet-cognos/vagrant".
diff --git a/Rakefile b/Rakefile
new file mode 100644
index 0000000..b549d7d
--- /dev/null
+++ b/Rakefile
@@ -0,0 +1,12 @@
+require 'rubygems'
+require 'puppetlabs_spec_helper/rake_tasks'
+require 'puppet-lint/tasks/puppet-lint'
+PuppetLint.configuration.send('disable_80chars')
+PuppetLint.configuration.ignore_paths = ["spec/**/*.pp", "pkg/**/*.pp"]
+
+# Forsake support for Puppet 2.6.2 for the benefit of cleaner code.
+# http://puppet-lint.com/checks/class_inherits_from_params_class/
+PuppetLint.configuration.send('disable_class_inherits_from_params_class')
+
+desc "Run all tests"
+task :test => [:lint, :validate, :spec]
diff --git a/Vagrantfile b/Vagrantfile
new file mode 100644
index 0000000..d787ef4
--- /dev/null
+++ b/Vagrantfile
@@ -0,0 +1,38 @@
+# -*- mode: ruby -*-
+
+Vagrant.configure("2") do |config|
+    # Every Vagrant virtual environment requires a box to build off of.
+    config.vm.box = "puppetlabs/centos-7.2-64-puppet"
+
+    # Assign this VM to a host-only network IP, allowing you to access it
+    # via the IP.
+    config.vm.provider 'virtualbox' do |vb|
+        vb.customize ["modifyvm", :id, "--natnet1", "172.31.9/24"]
+        vb.gui = false
+        vb.memory = 6144
+        vb.customize ["modifyvm", :id, "--ioapic", "on"]
+        vb.customize ["modifyvm", :id, "--hpet", "on"]
+    end
+
+    # Second network interface, vm's will all exist on this network
+    ip = "192.168.44.35"
+    config.vm.network :private_network, ip: ip
+    config.vm.network :forwarded_port, guest: 9300, host: 9393
+
+    $script = <<SCRIPT
+echo I am provisioning...
+export FACTER_is_vagrant='true'
+[ -d /tmp/modules/cognos ] || mkdir -p /tmp/modules/cognos
+mount | grep /tmp/modules/cognos || mount --bind /vagrant /tmp/modules/cognos
+puppet module install puppetlabs-stdlib
+puppet module install crayfishx-firewalld
+puppet module install puppet-selinux
+puppet module install puppet-nginx
+puppet module install jpuskar-db2
+puppet apply --modulepath '/tmp/modules:/etc/puppetlabs/code/environments/production/modules' -e "include '::db2'"
+puppet apply --modulepath '/tmp/modules:/etc/puppetlabs/code/environments/production/modules' -e "include '::cognos'"
+SCRIPT
+
+    config.vm.provision "shell", inline: $script
+
+end
diff --git a/manifests/cm_db/db2.pp b/manifests/cm_db/db2.pp
new file mode 100644
index 0000000..533096d
--- /dev/null
+++ b/manifests/cm_db/db2.pp
@@ -0,0 +1,36 @@
+#
+class cognos::cm_db::db2 {
+
+  # Cognos DB2 CM SQL File
+  $cognos_db_file = "/home/${cognos::cognos_db_instance_user}/create_cognos_db.sql"
+  file{$cognos_db_file:
+    content => template('cognos/create_cognos_db.sql.erb'),
+    mode    => '0755',
+    owner   => $cognos::cognos_db_instance_user,
+    group   => $cognos::cognos_db_instance_user,
+  }
+
+  # Configure Cognos ContentDb
+  exec{'configure_cognos_db2_cm_db':
+    command => "${cognos::db2_install_path}/bin/db2 -tvf ${cognos_db_file}",
+    user    => $cognos::cognos_db_instance_user,
+    cwd     => "/home/${cognos::cognos_db_instance_user}",
+    timeout => 600,
+    unless  => "${cognos::db2_install_path}/bin/db2 list db directory | grep \"Database name\" | grep \"= CM\"",
+    require => File[$cognos_db_file],
+  }
+
+  # DB2 drivers
+  exec{'install_db2_java_driver_cognos':
+    command  => "cp ${cognos::db2_install_path}/java/db2jcc.jar ${cognos::installer_target_dir}/drivers",
+    unless   => "test -f ${cognos::installer_target_dir}/drivers/db2jcc.jar",
+    provider => 'shell',
+  }
+  -> file{"${cognos::installer_target_dir}/drivers/db2jcc.jar":
+    mode    => '0775',
+    owner   => $cognos::cognos_user,
+    group   => $cognos::cognos_user,
+    require => Exec['install_db2_java_driver_cognos'],
+  }
+
+}
\ No newline at end of file
diff --git a/manifests/config.pp b/manifests/config.pp
new file mode 100644
index 0000000..798bea4
--- /dev/null
+++ b/manifests/config.pp
@@ -0,0 +1,124 @@
+#
+class cognos::config{
+  # Startup wait times. If unset, Cognos may fail to start.
+  file_line { 'Cognos_ServiceMaxTries':
+    ensure => present,
+    path   => '/opt/ibm/cognos/analytics/configuration/cogconfig.prefs',
+    line   => "ServiceMaxTries=${cognos::service_max_tries}",
+    match  => '^ServiceMaxTries*',
+  }
+  file_line { 'Cognos_ServiceWaitInverval':
+    ensure => present,
+    path   => '/opt/ibm/cognos/analytics/configuration/cogconfig.prefs',
+    line   => "ServiceWaitInterval=${cognos::service_wait_interval}",
+    match  => '^ServiceWaitInterval*',
+  }
+
+  if $cognos::enable_debug_logging {
+    file_line { 'cognos_log4j_axis_debug':
+      ensure => present,
+      path   => '/opt/ibm/cognos/analytics/bin/log4j.properties',
+      line   => 'log4j.logger.org.apache.axis=DEBUG, CONSOLE',
+      match  => '^log4j\.logger\.org\.apache\.axis=+',
+    }
+    file_line { 'cognos_log4j_axis_enterprise_debug':
+      ensure => present,
+      path   => '/opt/ibm/cognos/analytics/bin/log4j.properties',
+      line   => 'log4j.logger.org.apache.axis.enterprise=DEBUG, CONSOLE',
+      match  => '^log4j\.logger\.org\.apache\.axis\.enterprise=+',
+    }
+    file_line { 'cognos_log4j_appender_console_debug':
+      ensure => present,
+      path   => '/opt/ibm/cognos/analytics/bin/log4j.properties',
+      line   => 'log4j.appender.CONSOLE.Threshold=DEBUG',
+      match  => '^log4j\.appender\.CONSOLE\.Threshold=+',
+    }
+    file_line { 'cognos_log4j_appender_logfile_debug':
+      ensure => present,
+      path   => '/opt/ibm/cognos/analytics/bin/log4j.properties',
+      line   => 'log4j.appender.LOGFILE.Threshold=DEBUG',
+      match  => '^log4j\.appender\.LOGFILE\.Threshold=+',
+    }
+    file_line { 'cognos_cogconfigipf_info':
+      ensure   => present,
+      path     => '/opt/ibm/cognos/analytics/configuration/cogconfigipf.xml',
+      line     => '                <level value="info"/>',
+      match    => '^(\s)+\<level\ value=',
+      multiple => true,
+    }
+  }
+
+  if $cognos::manage_firewall {
+    include '::firewalld'
+    firewalld_port { 'Open port 8080 in the public zone':
+      ensure   => present,
+      zone     => 'public',
+      port     => 9300,
+      protocol => 'tcp',
+    }
+
+    # firewall { '1205 [cognos::config] allow cognos gateway https inbound':
+    #   chain  => 'INPUT',
+    #   proto  => 'tcp',
+    #   dport  => 443,
+    #   state  => 'NEW',
+    #   action => 'accept',
+    # }
+    #
+    # firewall { '3505 [cognos::config] allow cognos gateway https outbound':
+    #   chain  => 'OUTPUT',
+    #   proto  => 'tcp',
+    #   dport  => 443,
+    #   state  => 'NEW',
+    #   action => 'accept',
+    # }
+  }
+
+  # Cognos config file
+  file{"${cognos::installer_target_dir}/configuration/cogstartup.puppet.xml":
+    content => template('cognos/cognos11_config.xml.erb'),
+    mode    => '0755',
+    before  => Exec['apply_new_cognos_config'],
+    notify  => Exec['apply_new_cognos_config'],
+  }
+
+  # Configure Cognos
+  $cog_conf_cmd = @("END_COG_CONF_CMD"/$)
+systemctl stop cognos || true
+cp ${cognos::installer_target_dir}/configuration/cogstartup.puppet.xml \
+  ${cognos::installer_target_dir}/configuration/cogstartup.xml
+chown ${cognos::cognos_user}:${cognos::cognos_user} \
+  ${cognos::installer_target_dir}/configuration/cogstartup.xml
+  | END_COG_CONF_CMD
+
+  exec{'apply_new_cognos_config':
+    command     => $cog_conf_cmd,
+    provider    => 'shell',
+    refreshonly => true,
+    notify      => Service['cognos'],
+  }
+
+  # Add symlinks for intuitive log and config locations
+  if $cognos::install_symlinks {
+    file { '/etc/cognos':
+      ensure => 'directory',
+    }
+    -> file { '/etc/cognos/configuration':
+      ensure => 'link',
+      target => '/opt/ibm/cognos/analytics/configuration',
+    }
+
+    file { '/var/log/cognos':
+      ensure => 'directory',
+    }
+    -> file { '/var/log/cognos/common':
+      ensure => 'link',
+      target => '/opt/ibm/cognos/analytics/logs',
+    }
+    -> file { '/var/log/cognos/wlp':
+      ensure => 'link',
+      target => '/opt/ibm/cognos/analytics/wlp/usr/servers/cognosserver/logs',
+    }
+  }
+
+}
\ No newline at end of file
diff --git a/manifests/init.pp b/manifests/init.pp
new file mode 100644
index 0000000..701937d
--- /dev/null
+++ b/manifests/init.pp
@@ -0,0 +1,52 @@
+# Class: cognos
+# ===========================
+#
+class cognos(
+  $installer_target_dir         = '/opt/ibm/cognos/analytics',
+  $installer_source_dir         = '/vagrant',
+  $installer_filename           = 'ca_srv_lnxi38664_11.0.5.16111917.bin',
+  $installer_timeout            = 600,
+  $install_app_tier             = true,
+  $install_gateway              = true,
+  $install_prereq_packages      = true,
+  $install_symlinks             = true,
+  $cognos_user                  = 'cognos',
+  $cognos_user_uid              = '4979',
+  $cognos_user_password         = 'vagrant',
+  $cognos_db_user               = 'cog_db2',
+  $cognos_db_user_uid           = '4980',
+  $cognos_db_user_password      = 'vagrant',
+  $cog_users_password_salt      = 'vagrant',
+  $cognos_db_instance_user      = 'db2inst1',
+  $pmp_max_memory               = 1024,
+  $dispatcher_max_memory        = 4096,
+  $sort_memory                  = 32,
+  $external_dispatcher_uri_port = 443,
+  $service_max_tries            = 600,
+  $service_wait_interval        = 10000,
+  $manage_firewall              = true,
+  $configure_db2_cm_db          = true,
+  $db2_install_path             = '/opt/ibm/db2/V10.1',
+  $enable_debug_logging         = true,
+  $enable_delivery_service      = false,
+) {
+  # TODO: cognos::config - file for cogstartup.puppet.xml should be set to root-only.
+
+  # Prereq packages
+  if $cognos::install_prereq_packages {
+    class {'cognos::install::prereqs':}
+  }
+
+  # Other prep items
+  -> class {'cognos::install::prep':}
+
+  # Main install
+  -> class {'cognos::install::main':}
+
+  # Config
+  -> class {'cognos::config':}
+  -> if $cognos::configure_db2_cm_db {
+    class {'cognos::cm_db::db2':}
+  }
+  -> class {'cognos::install::service':}
+}
diff --git a/manifests/install/main.pp b/manifests/install/main.pp
new file mode 100644
index 0000000..a99d311
--- /dev/null
+++ b/manifests/install/main.pp
@@ -0,0 +1,92 @@
+#
+class cognos::install::main {
+
+  # variables for response file
+  if $cognos::install_app_tier {
+    $install_app_tier_int = 1
+  } else {
+    $install_app_tier_int = 0
+  }
+  if $cognos::install_gateway {
+    $install_gateway_int = 1
+  } else {
+    $install_gateway_int = 0
+  }
+
+  # Input validation
+  # TODO: swap to validate_legacy()
+  #validate_legacy(Optional[String], 'validate_re', $db2::instance_user_password, ['^(?!vagrant$).*$'])
+  validate_legacy(
+    Optional[String],
+    'validate_re',
+    $cognos::cognos_user,
+    '^[a-zA-Z0-9]{1,8}$',   # CHAR(8) && !/w && ![A-Z]
+  )
+  validate_legacy(
+    Optional[String],
+    'validate_re',
+    $cognos::cognos_db_user,
+    '^[a-zA-Z0-9_]{1,8}$',   # CHAR(8) && !/w && ![A-Z]
+  )
+
+  # If we're not in vagrant, then assert that our passwords aren't 'vagrant'.
+  if $::is_vagrant != 'true' { # lint:ignore:quoted_booleans
+    validate_legacy(
+      Optional[String],
+      'validate_re',
+      $cognos::cognos_user,
+      '^(?!vagrant$).*$',
+    )
+
+    validate_legacy(
+      Optional[String],
+      'validate_re',
+      $cognos::cognos_db_user,
+      '^(?!vagrant$).*$',
+    )
+
+    validate_legacy(
+      Optional[String],
+      'validate_re',
+      $cognos::cog_users_password_salt,
+      '^(?!vagrant$).*$',
+    )
+  }
+
+  # Cognos response file
+  $response_file_name = "${cognos::installer_source_dir}/cognos_11_installer.properties"
+  file{$response_file_name:
+    content => template('cognos/cognos_11.rsp.erb'),
+    mode    => '0755',
+  }
+
+  # Install Cognos
+  $cog_install_cmd = @("END_COG_INSTALL_CMD"/$)
+export LAX_DEBUG=true
+./${cognos::installer_source_dir}/${cognos::installer_filename} -f ${response_file_name} -i silent
+  | END_COG_INSTALL_CMD
+
+  $cog_unless_cmd = @("END_COG_UNLESS_CMD"/$)
+  test -f ${cognos::installer_target_dir}/cmplst.txt && \
+  cat ${cognos::installer_target_dir}/cmplst.txt | grep -i PSPORTLETS_name=IBM\ Cognos\ Portal\ Services
+  | END_COG_UNLESS_CMD
+
+  exec{'install_cognos':
+    command  => $cog_install_cmd,
+    provider => 'shell',
+    cwd      => $cognos::installer_source_dir,
+    timeout  => $cognos::installer_timeout,
+    unless   => $cog_unless_cmd,
+    require  => [
+      File[$response_file_name],
+    ],
+    before   => Exec['chown_cognos_install_dir'],
+  }
+
+  exec{'chown_cognos_install_dir':
+    command  => "chown -R ${cognos::cognos_user}:${cognos::cognos_user} /opt/ibm/cognos",
+    unless   => "ls -l ${cognos::installer_target_dir} | grep \"${cognos::cognos_user}\\:${cognos::cognos_user}\"",
+    provider => 'shell',
+  }
+
+}
diff --git a/manifests/install/prep.pp b/manifests/install/prep.pp
new file mode 100644
index 0000000..a58312d
--- /dev/null
+++ b/manifests/install/prep.pp
@@ -0,0 +1,35 @@
+#
+class cognos::install::prep {
+
+  group{$cognos::cognos_user:
+    gid => $cognos::cognos_user_uid,
+  }
+
+  group{$cognos::cognos_db_user:
+    gid => $cognos::cognos_db_user_uid,
+  }
+
+  user{$cognos::cognos_user:
+    uid      => $cognos::cognos_user_uid,
+    groups   => $cognos::cognos_user,
+    password => pw_hash($cognos::cognos_user_password,'SHA-512', $cognos::cog_users_password_salt),
+    require  => Group[$cognos::cognos_user],
+  }
+
+  user{$cognos::cognos_db_user:
+    uid      => $cognos::cognos_db_user_uid,
+    groups   => $cognos::cognos_db_user,
+    password => pw_hash($cognos::cognos_db_user_password,'sha-512', $cognos::cog_users_password_salt),
+    shell    => '/bin/bash',
+    comment  => 'cognos db2 user',
+    require  => Group[$cognos::cognos_db_user],
+  }
+
+  # Cognos won't start without this host entry
+  ensure_resource(
+    'host',
+    $::fqdn,
+    { ip => '127.0.0.1' }
+  )
+
+}
\ No newline at end of file
diff --git a/manifests/install/prereqs.pp b/manifests/install/prereqs.pp
new file mode 100644
index 0000000..5f71f85
--- /dev/null
+++ b/manifests/install/prereqs.pp
@@ -0,0 +1,27 @@
+#
+class cognos::install::prereqs{
+
+  # centos 7
+  $prereq_packages = [
+    'unzip',
+    'glibc.i686',
+    'glibc.x86_64',
+    'nspr.x86_64',
+    'nss.x86_64',
+    'motif.i686',
+    'motif.x86_64',
+    'libstdc++',
+    'nss-tools',
+  ]
+
+  $prereq_packages.each | $pkg_name | {
+    if($pkg_name) {
+      ensure_resource(
+        'package',
+        $pkg_name,
+        { ensure => 'present' },
+      )
+    }
+  }
+
+}
\ No newline at end of file
diff --git a/manifests/install/service.pp b/manifests/install/service.pp
new file mode 100644
index 0000000..3c0a0cb
--- /dev/null
+++ b/manifests/install/service.pp
@@ -0,0 +1,18 @@
+#
+class cognos::install::service {
+  # Cognos unit file
+  file{'/etc/systemd/system/cognos.service':
+    content => template('cognos/cognos.service.erb'),
+    mode    => '0644',
+    notify  => Exec['cognos_reload_systemd_units'],
+  }
+  exec{'cognos_reload_systemd_units':
+    command     => 'systemctl daemon-reload',
+    refreshonly => true,
+    provider    => 'shell',
+  }
+  ~> service{'cognos':
+    ensure => running,
+    enable => true,
+  }
+}
diff --git a/metadata.json b/metadata.json
new file mode 100644
index 0000000..460b900
--- /dev/null
+++ b/metadata.json
@@ -0,0 +1,16 @@
+{
+  "name": "puppet-cognos",
+  "version": "0.1.0",
+  "author": "jpuskar",
+  "summary": "Installs and configures Cognos.",
+  "license": "Apache-2.0",
+  "source": "https://github.com/jpuskar/puppet-cognos",
+  "project_page": "https://github.com/jpuskar/puppet-cognos",
+  "issues_url": "https://github.com/jpuskar/puppet-cognos/issues",
+  "dependencies": [
+    {"name":"puppetlabs-stdlib","version_requirement":">= 4.13.0"},
+    {"name":"crayfishx-firewalld","version_requirement":">=3.3.1"},
+    {"name":"puppet-selinux","version_requirement":">= 0.8.0"}
+  ],
+  "data_provider": null
+}
diff --git a/spec/classes/init_spec.rb b/spec/classes/init_spec.rb
new file mode 100644
index 0000000..6db6548
--- /dev/null
+++ b/spec/classes/init_spec.rb
@@ -0,0 +1,42 @@
+require 'spec_helper'
+
+describe 'cognos' do
+
+  context 'on CentOS 7' do
+    describe 'without any parameters' do
+      let(:facts) {{
+        :osfamily => 'RedHat',
+        :operatingsystem => 'CentOS',
+        :operatingsystemmajrelease => '7',
+        :is_vagrant => 'true',
+      }}
+      let(:params) {{ }}
+
+      it { is_expected.to compile.with_all_deps }
+      it { is_expected.to contain_class('cognos::cm_db::db2') }
+      it { is_expected.to contain_class('cognos::install::main') }
+      it { is_expected.to contain_class('cognos::install::prep') }
+      it { is_expected.to contain_class('cognos::install::prereqs') }
+      it { is_expected.to contain_class('cognos::install::service') }
+      it { is_expected.to contain_class('cognos::config') }
+
+      it { is_expected.to contain_file('/home/db2inst1/create_cognos_db.sql') }
+      it { is_expected.to contain_file('/opt/ibm/cognos/analytics/drivers/db2jcc.jar') }
+      it { is_expected.to contain_file('/vagrant/cognos_11_installer.properties') }
+      it { is_expected.to contain_file('/etc/systemd/system/cognos.service') }
+      it { is_expected.to contain_file('/opt/ibm/cognos/analytics/configuration/cogstartup.puppet.xml') }
+      it { is_expected.to contain_file('/etc/cognos') }
+      it { is_expected.to contain_file('/var/log/cognos') }
+      it { is_expected.to contain_file('/var/log/cognos/common') }
+      it { is_expected.to contain_file('/var/log/cognos/wlp') }
+
+      it { is_expected.to contain_user('cognos') }
+      it { is_expected.to contain_user('cog_db2') }
+      it { is_expected.to contain_group('cognos') }
+      it { is_expected.to contain_group('cog_db2') }
+
+    end
+  end
+
+end
+
diff --git a/spec/spec_helper.rb b/spec/spec_helper.rb
new file mode 100644
index 0000000..479ed69
--- /dev/null
+++ b/spec/spec_helper.rb
@@ -0,0 +1,2 @@
+require 'rubygems'
+require 'puppetlabs_spec_helper/module_spec_helper'
\ No newline at end of file
diff --git a/templates/cognos.service.erb b/templates/cognos.service.erb
new file mode 100644
index 0000000..c05ae4b
--- /dev/null
+++ b/templates/cognos.service.erb
@@ -0,0 +1,25 @@
+[Unit]
+Description=Cognos Analytics
+# TODO: if using db2: After=db2inst1.service
+# TODO: if using nginx: After=nginx.service
+
+[Service]
+Type=oneshot
+RemainAfterExit=yes
+User=<%= scope['cognos::cognos_user'] %>
+LimitNOFILE=65536
+CPUAccounting=1
+MemoryAccounting=1
+BlockIOAccounting=1
+#Slice=workload-application.slice
+Environment=LD_LIBRARY_PATH=<%= scope['cognos::installer_target_dir'] %>/cgi-bin
+# TODO: if using db2, append to LD_LIBRARY_PATH: :<%= scope['cognos::db2_instance_dir'] %>/sqllib/lib32/
+Environment=JAVA_HOME=<%= scope['cognos::installer_target_dir'] %>/jre
+ExecStart=<%= scope['cognos::installer_target_dir'] %>/bin64/cogconfig.sh -s -d
+ExecStop=<%= scope['cognos::installer_target_dir'] %>/bin64/cogconfig.sh -stop
+RestartSec=900
+#Restart=always
+
+[Install]
+WantedBy=multi-user.target
+
diff --git a/templates/cognos11_config.xml.erb b/templates/cognos11_config.xml.erb
new file mode 100644
index 0000000..898ffd6
--- /dev/null
+++ b/templates/cognos11_config.xml.erb
@@ -0,0 +1,1896 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!--
+===============================================================================================
+	Licensed Materials - Property of IBM
+	IBM Cognos Products: cnfg
+	(C) Copyright IBM Corp. 2016
+	US Government Users Restricted Rights - Use, duplication or disclosure restricted by GSA ADP Schedule Contract with IBM Corp.
+
+
+Master configuration file for all IBM Cognos components.
+===============================================================================================
+ -->
+<crn:parameters xmlns:crn="http://developer.cognos.com/schemas/crconfig/1/" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:cfg="http://developer.cognos.com/schemas/configparams/XMLSchema/1/" version="166.0" xsi:schemaLocation="http://developer.cognos.com/schemas/crconfig/1/ cogstartup.xsd">
+  <crn:parameter name="edition">
+    <crn:value xsi:type="xsd:string">enterprise</crn:value>
+  </crn:parameter>
+  <crn:parameter name="releaseType">
+    <crn:value xsi:type="xsd:string">ga</crn:value>
+  </crn:parameter>
+  <crn:parameter name="licenseType">
+    <crn:value xsi:type="xsd:string">production</crn:value>
+  </crn:parameter>
+  <!-- advancedProperties: Specifies a set of advanced properties.  -->
+  <!-- The user needs to provide the name and the value for each advanced property.  -->
+  <crn:parameter name="advancedProperties" opaque="true">
+    <crn:value xsi:type="cfg:array"/>
+  </crn:parameter>
+  <!-- serverLocale: Specifies the server locale.  -->
+  <!-- The server locale is set using the language selected during installation, but can
+       be changed. This property ensures all log messages are written in one language determined
+       by server locale. If the data in the log is in multiple languages, you may want to
+       override this value so that messages are logged using UTF8 encoding. To do this,
+       set the value of the UTF8 encoding property to true for the Logging component.  -->
+  <crn:parameter name="serverLocale">
+    <crn:value xsi:type="xsd:language">en</crn:value>
+  </crn:parameter>
+  <!-- serverTimeZoneID: Specifies the time zone used by Content Manager.  -->
+  <!-- Use this property to identify the time zone used by Content Manager. Time zones are
+       used as the time reference in schedules and other system times.  -->
+  <crn:parameter name="serverTimeZoneID">
+    <crn:value xsi:type="cfg:timeZone">Europe/Dublin</crn:value>
+  </crn:parameter>
+  <!-- defaultFont: Specifies the font used in PDF reports when no fonts can be found in
+       the stylesheet to display the data.  -->
+  <!-- Use one of the globally supported font names.  -->
+  <crn:parameter name="defaultFont">
+    <crn:value xsi:type="xsd:string">Andale WT</crn:value>
+  </crn:parameter>
+  <!-- emailEncoding: Specifies the email encoding.  -->
+  <!-- The specified encoding will be used for subject and body text when sending email.
+       This has no effect on attachments or the HTML body.  -->
+  <crn:parameter name="emailEncoding">
+    <crn:value xsi:type="xsd:string">utf-8</crn:value>
+  </crn:parameter>
+  <!-- bvMaxAttachmentSize: This parameter specifies the maximum size of a file attachment
+       that can be uploaded to the Business Viewpoint server.  -->
+  <!-- A value of 0 indicates that the maximum size is unlimited.  -->
+  <crn:parameter name="bvMaxAttachmentSize" disabled="true">
+    <crn:value xsi:type="xsd:unsignedShort">1024</crn:value>
+  </crn:parameter>
+  <!-- deploymentPath: Specifies the location where deployment archives are stored.  -->
+  <!-- Because a deployment archive can contain sensitive information, for security reasons
+       you may wish to restrict access to this location.  -->
+  <crn:parameter name="deploymentPath">
+    <crn:value xsi:type="cfg:folderPath">../deployment</crn:value>
+  </crn:parameter>
+  <crn:parameter name="doReportSpecUpgrade">
+    <crn:value xsi:type="xsd:boolean">false</crn:value>
+  </crn:parameter>
+  <!-- data: Specifies the location where data files created by the product components are
+       stored.  -->
+  <!-- You can't delete these files. These files remain on your computer until they are
+       no longer required by the component that created them.  -->
+  <crn:parameter name="data">
+    <crn:value xsi:type="cfg:folderPath">../data</crn:value>
+  </crn:parameter>
+  <!-- mapFileLocation: Specifies the location of the folder that contains the IBM Cognos
+       map files (*.cmf).  -->
+  <!-- IBM Cognos map files contain drawing information and localized strings used when
+       rendering maps.  -->
+  <crn:parameter name="mapFileLocation">
+    <crn:value xsi:type="cfg:folderPath">../maps</crn:value>
+  </crn:parameter>
+  <!-- temp: Specifies the location of the folder that contains recently viewed reports.  -->
+  <!-- The product creates temporary files each time you open a report. The product stores
+       these temporary files in the location you specify. The product may not delete all
+       temporary files when it closes and they may remain on your computer until you delete
+       them.  -->
+  <crn:parameter name="temp">
+    <crn:value xsi:type="cfg:folderPath">../temp</crn:value>
+  </crn:parameter>
+  <!-- encryptTemporaryFiles: Specifies whether the content of temporary files is encrypted.  -->
+  <!-- If recently viewed reports contain sensitive data, set the value of this property
+       to 'true' to encrypt the content of temporary files.  -->
+  <crn:parameter name="encryptTemporaryFiles">
+    <crn:value xsi:type="xsd:boolean">false</crn:value>
+  </crn:parameter>
+  <!-- formatSpecificationLocation: Specifies the name and location of a file that contains
+       format specifications.  -->
+  <crn:parameter name="formatSpecificationLocation">
+    <crn:value xsi:type="cfg:filePath">../configuration/cogformat.xml</crn:value>
+  </crn:parameter>
+  <!-- sortMemory: Specifies the sort buffer size to use for local processing.  -->
+  <!-- Queries which are not processed entirely within a database server may require local
+       processing that involves sorting. Sorting operations use a memory buffer which will
+       overflow to temporary storage for larger sort operations. Increasing the sort memory
+       can improve performance by reducing the number of read and write operations to the
+       temporary storage. Allocating too much memory to concurrent sorting operations may
+       impact the memory management of the operating system.  -->
+  <crn:parameter name="sortMemory">
+    <crn:value xsi:type="xsd:unsignedInt"><%= scope['cognos::sort_memory'] %></crn:value>
+  </crn:parameter>
+  <!-- networkConfiguration: Specifies the IP version for host name resolution.  -->
+  <!-- Use this property to specify the internet protocol version for host name resolution.  -->
+  <crn:parameter name="networkConfiguration">
+    <crn:value xsi:type="xsd:string">IPv4</crn:value>
+  </crn:parameter>
+  <!-- gateway: Specifies the URI to the gateway.  -->
+  <!-- Use the 'https' or 'http' protocol to select SSL or non-SSL communication. The host
+       name portion of the gateway URI must be changed from localhost to an IP address or
+       a network host name.  -->
+  <crn:parameter name="gateway">
+    <crn:value xsi:type="xsd:anyURI">http://<%= @fqdn %>:9300/bi/v1/disp</crn:value>
+  </crn:parameter>
+  <!-- gatewayNamespace: Specifies the Namespace ID of the authentication provider to which
+       the gateway connects to verify user credentials.  -->
+  <!-- Use this property so that the gateway connects to one namespace. Users logged onto
+       the Web server where the gateway is located are not prompted to choose an authentication
+       source. By default, the gateway uses all configured namespaces and you are prompted
+       to select a namespace.  -->
+  <crn:parameter name="gatewayNamespace">
+    <crn:value xsi:type="xsd:string"></crn:value>
+  </crn:parameter>
+  <!-- gatewayCMSPNName: Specifies the sAMAccountName of the user running Content Manager.  -->
+  <!-- This value must be set if you are using kerberos authentication with constrained
+       delegation and IBM Cognos BI is installed on Microsoft Windows operating systems.  -->
+  <crn:parameter name="gatewayCMSPNName">
+    <crn:value xsi:type="xsd:string"></crn:value>
+  </crn:parameter>
+  <!-- overrideNamespace: Setting this property to true authenticates requests from the
+       Portal Services portlets against the specified namespace for the third-party portal.  -->
+  <!-- When integrating IBM Cognos portlets within a third-party portal, it is often a requirement
+       to enable single signon to automatically authenticate users. When enabling single
+       signon, the Allow Namespace Override parameter in IBM Cognos Configuration must be
+       set to true. Additionally, within the third-party portal, a parameter must be set
+       in the IBM Cognos portlets to explicitly point to one distinct namespace ID. The
+       Allow Namespace Override parameter notifies the IBM Cognos portlets to use the namespace
+       defined within the third-party portal for single signon. If you are not using IBM
+       Cognos' portlets within a third-party portal, this setting should remain false. For
+       more information on how to enable single signon for third-party portals, see the
+       Portal Services Administration chapter of the IBM Cognos Administration and Security
+       Guide.  -->
+  <crn:parameter name="overrideNamespace">
+    <crn:value xsi:type="xsd:boolean">false</crn:value>
+  </crn:parameter>
+  <!-- gatewayDispatcherURIList: Specifies one or more URIs to Dispatchers that the Gateway
+       may use.  -->
+  <!-- This property is used by the gateway to send requests to IBM Cognos. The first dispatcher
+       in the list is the default dispatcher to which requests will be sent. If the first
+       dispatcher becomes unreachable, the second dispatcher in the list becomes the default
+       dispatcher, and so on. The URI values must match External dispatcher URI of dispatchers
+       in your installation except they must also have '/ext' at the end. They must specify
+       a network host name or IP address rather than 'localhost'.  -->
+  <crn:parameter name="gatewayDispatcherURIList" opaque="true">
+    <crn:value xsi:type="cfg:sortedArray">
+      <crn:item xsi:type="xsd:anyURI" order="0">http://127.0.0.1:9300/bi/v1/disp</crn:item>
+    </crn:value>
+  </crn:parameter>
+  <!-- controllerServerURI: Specifies the URI to the IBM Cognos Controller server, if present.  -->
+  <!-- This property is used by the gateway to send requests to IBM Cognos Controller server.  -->
+  <crn:parameter name="controllerServerURI">
+    <crn:value xsi:type="xsd:anyURI">http://127.0.0.1:80/ibmcognos/controllerServer</crn:value>
+  </crn:parameter>
+  <!-- externalDispatcher: Specifies the URI to the dispatcher that processes requests from
+       a gateway or service on a remote computer.  -->
+  <!-- This property defines the HTTP endpoint through which the dispatcher receives requests
+       that originate on other computers. It identifies this dispatcher to other dispatchers
+       that are part of the same installation. Use the 'https' or 'http' protocol to select
+       SSL or non-SSL communication. Specify a vacant port number. The dispatcher will use
+       the computer's network hostname by default. In some cases it may be necessary to
+       specify the network host name or an IP address. If the host name portion of the URI
+       is set to 'localhost', ensure that 'localhost' is defined on the computer.  -->
+  <crn:parameter name="externalDispatcher">
+    <crn:value xsi:type="cfg:localURI">http://127.0.0.1:9300/p2pd/servlet/dispatch</crn:value>
+  </crn:parameter>
+  <!-- internalDispatcher: Specifies the URI to the dispatcher that processes requests from
+       services on the same computer.  -->
+  <!-- This property defines the HTTP endpoint through which the dispatcher receives requests
+       from the local computer. It must have the same value as External dispatcher URI unless
+       you choose to use SSL only for external requests. In that case, External dispatcher
+       URI will specify 'https' and Internal dispatcher URI will specify 'http', and the
+       port numbers must be different. The hostname portion of the URI must refer to the
+       local computer. If the host name portion of the URI is set to 'localhost', ensure
+       that 'localhost' is defined on the computer.  -->
+  <crn:parameter name="internalDispatcher">
+    <crn:value xsi:type="cfg:localURI">http://127.0.0.1:9300/p2pd/servlet/dispatch</crn:value>
+  </crn:parameter>
+  <!-- disp_sharedsecret: Specifies the password that enables secure communication between
+       Dispatchers.  -->
+  <!-- This property is case-sensitive.  -->
+  <crn:parameter name="disp_sharedsecret">
+    <crn:value xsi:type="cfg:systemPassword">NoPassWordSet</crn:value>
+  </crn:parameter>
+  <!-- jmxPort: Specifies the port number to the JMX administration interface.  -->
+  <!-- Set the value to 0 to disable the interface.  -->
+  <crn:parameter name="jmxPort">
+    <crn:value xsi:type="xsd:int">0</crn:value>
+  </crn:parameter>
+  <!-- jmxCredential: Specifies a username and password for securing the JMX administration
+       interface.  -->
+  <!-- Be sure to configure a port in addition to setting a username and password.  -->
+  <crn:parameter name="jmxCredential">
+    <crn:value xsi:type="cfg:credential">
+      <credential>
+        <username/>
+        <password/>
+      </credential>
+    </crn:value>
+  </crn:parameter>
+  <!-- rsvpExecutionMode: Specifies the Report Server execution mode.  -->
+  <!-- The 64-bit mode is applicable only to 64-bit installations.  -->
+  <crn:parameter name="rsvpExecutionMode">
+    <crn:value xsi:type="xsd:string">64-bit</crn:value>
+  </crn:parameter>
+  <!-- sdk: Specifies the URI used by the Framework Manager, Metrics Designer, Dynamic Query
+       Analyzer or SDK to send requests to IBM Cognos.  -->
+  <!-- The value typically corresponds to the External dispatcher URI of one of the dispatchers
+       in your installation. It must use the real network host name or IP address instead
+       of localhost. If Framework Manager, Metrics Designer, Dynamic Query Analyzer or SDK
+       clients connect to IBM Cognos through an intermediary like a load balancer or proxy,
+       specify the host and port of the intermediary. This property is used by Framework
+       Manager when publishing models, by Metrics Designer when creating metrics, by Dynamic
+       Query Analyer when querying Content Manager or send request to Dynamic Query Cube,
+       and by SDK developers when querying Content Manager for output. IBM Cognos must be
+       able to locate a gateway or dispatcher running on a Web server that supports chunking
+       and attachments to handle large volumes of data. If there is no firewall between
+       Framework Manager, Metrics Designer, Dynamic Query Analyzer or SDK users and IBM
+       Cognos, components use the default setting. If there is a firewall, you must have
+       access to at least one Web server that supports chunking outside of the firewall.
+       The http or https protocol prefix indicates if SSL is required.  -->
+  <crn:parameter name="sdk">
+    <crn:value xsi:type="xsd:anyURI">http://<%= @fqdn %>:<%= scope['cognos::external_dispatcher_uri_port'] %>/bi/v1/disp</crn:value>
+  </crn:parameter>
+  <!-- contentManagers: Specifies one or more URIs to the Content Manager.  -->
+  <!-- Use the 'https' or 'http' protocol to select SSL or non-SSL communication. This property
+       is used by dispatchers and services to send requests to the Content Manager. If you
+       are using Standby Content Manager functionality, enter the URIs of all Content Managers.
+       If the host name portion of the URI is set to 'localhost', ensure that 'localhost'
+       is defined on the computer.  -->
+  <crn:parameter name="contentManagers" opaque="true">
+    <crn:value xsi:type="cfg:array">
+      <crn:item xsi:type="xsd:anyURI">http://<%= @fqdn %>:9300/p2pd/servlet</crn:item>
+    </crn:value>
+  </crn:parameter>
+  <crn:parameter name="retrieveConfigUser">
+    <crn:value xsi:type="xsd:string"></crn:value>
+  </crn:parameter>
+  <crn:parameter name="retrieveConfigPassword">
+    <crn:value xsi:type="cfg:systemPassword"></crn:value>
+  </crn:parameter>
+  <crn:parameter name="retrieveConfigNamespaceID">
+    <crn:value xsi:type="xsd:string"></crn:value>
+  </crn:parameter>
+  <!-- DSSOAPServerURI: Specifies the URI to the Data Manager SOAP Server.  -->
+  <crn:parameter name="DSSOAPServerURI" disabled="true">
+    <crn:value xsi:type="cfg:localURI">http://localhost:9300/axis</crn:value>
+  </crn:parameter>
+  <!-- fontPaths: Specifies the locations of font files.  -->
+  <crn:parameter name="fontPaths">
+    <crn:value xsi:type="xsd:string">../bin/fonts</crn:value>
+  </crn:parameter>
+  <!-- brsPDFEmbeddableFonts: Specifies the fonts that may be embedded in a PDF document
+       by the batch report service.  -->
+  <!-- The decision to always or never embed a font in a PDF document is based on whether
+       embedding was allowed and if the document used characters that are not part of the
+       windows-1252 character encoding.  -->
+  <crn:parameter name="brsPDFEmbeddableFonts">
+    <crn:value xsi:type="cfg:fontsEmbed"></crn:value>
+  </crn:parameter>
+  <!-- brsPDFNonEmbeddableFonts: Specifies the fonts that may not be embedded in a PDF document
+       by the batch report service.  -->
+  <!-- The decision to not embed a font in a PDF document is based on whether the embedding
+       was allowed and if the document used characters that are not part of the windows-1252
+       character encoding.  -->
+  <crn:parameter name="brsPDFNonEmbeddableFonts">
+    <crn:value xsi:type="cfg:fontsEmbed"></crn:value>
+  </crn:parameter>
+  <!-- rsPDFEmbeddableFonts: Specifies the fonts that may be embedded in a PDF document
+       by the report service.  -->
+  <!-- The decision to always or never embed a font in a PDF document is based on whether
+       embedding was allowed and if the document used characters that are not part of the
+       windows-1252 character encoding.  -->
+  <crn:parameter name="rsPDFEmbeddableFonts">
+    <crn:value xsi:type="cfg:fontsEmbed"></crn:value>
+  </crn:parameter>
+  <!-- rsPDFNonEmbeddableFonts: Specifies the fonts that may not be embedded in a PDF document
+       by the report service.  -->
+  <!-- The decision to not embed a font in a PDF document is based on whether the embedding
+       was allowed and if the document used characters that are not part of the windows-1252
+       character encoding.  -->
+  <crn:parameter name="rsPDFNonEmbeddableFonts">
+    <crn:value xsi:type="cfg:fontsEmbed"></crn:value>
+  </crn:parameter>
+  <crn:parameter name="feedbackPort">
+    <crn:value xsi:type="xsd:unsignedShort">9363</crn:value>
+  </crn:parameter>
+  <!-- CFS: Defines the properties for the configuration group.  -->
+  <crn:parameter name="CFS" opaque="true">
+    <crn:value>
+      <!-- configGroupName: Specifies the name of the configuraiton group.  -->
+      <!-- A name that defines a group of installs/servers that share configuration in a configuration
+           group. This value must be the same for all servers in the configuration group, and
+           must be unique for each group. Different configuration groups must have a different
+           name. A descriptive name like "inventory_production" is recommended  -->
+      <crn:parameter name="configGroupName">
+        <crn:value xsi:type="xsd:string">GRP_<%= @hostname %></crn:value>
+      </crn:parameter>
+      <!-- configGroupPassword: Specifies the password that enables secure communication between
+           members of configuration group.  -->
+      <!-- The password must be the same for all members of the group.  -->
+      <crn:parameter name="configGroupPassword">
+        <crn:value xsi:type="cfg:systemPassword"></crn:value>
+      </crn:parameter>
+      <!-- configGroupContactPort: Specifies the port number used for group communication and
+           coordination on the primary configuration group member.  -->
+      <!-- Other CA installs use this port and group contact host as the initial way to join
+           the configuration group  -->
+      <crn:parameter name="configGroupContactPort">
+        <crn:value xsi:type="xsd:int">5701</crn:value>
+      </crn:parameter>
+      <!-- configGroupContactHost: Specifies the host name of the primary configuration group
+           member. It should be the same host as primary Content Manager install.  -->
+      <crn:parameter name="configGroupContactHost">
+        <crn:value xsi:type="xsd:string"><%= @fqdn %></crn:value>
+      </crn:parameter>
+      <!-- configGroupMemberSyncPort: Specifies the local port number used for network communication
+           that transfers and synchronizes configuration information from one server to another.  -->
+      <!-- It can be any free port  -->
+      <crn:parameter name="configGroupMemberSyncPort">
+        <crn:value xsi:type="xsd:int">4300</crn:value>
+      </crn:parameter>
+      <!-- configGroupMemberCoordinationPort: Specifies the local port number used for network
+           communication for group coordination.  -->
+      <!-- This port is used to discover and join a group, and to maintain an up to date list
+           of configuration group members. On the primary CM install group contact port is the
+           same port.  -->
+      <crn:parameter name="configGroupMemberCoordinationPort">
+        <crn:value xsi:type="xsd:int">5701</crn:value>
+      </crn:parameter>
+    </crn:value>
+  </crn:parameter>
+  <!-- pmpService: Defines a group of properties for the TM1 Application Server.  -->
+  <crn:parameter name="pmpService" opaque="true" disabled="true">
+    <crn:value>
+      <!-- pmpMaxMemory: Specifies the maximum amount of memory in MB that can be used by the
+           process.  -->
+      <!-- This value determines the amount of memory used by the Java Virtual Machine and depends
+           on how much memory is available. If this value is too high, the process will fail
+           to start and no log information will be generated.  -->
+      <crn:parameter name="pmpMaxMemory" disabled="true">
+        <crn:value xsi:type="xsd:unsignedInt"><%= scope['cognos::pmp_max_memory'] %></crn:value>
+      </crn:parameter>
+      <!-- pmpShutdownPort: Specifies the port the product uses to listen for a shutdown command.  -->
+      <!-- The port number is used by Tomcat. When you change the port, it is automatically
+           updated in the server.xml file located in the cognos_location/tomcat/conf directory.  -->
+      <crn:parameter name="pmpShutdownPort" disabled="true">
+        <crn:value xsi:type="xsd:unsignedShort">9513</crn:value>
+      </crn:parameter>
+      <!-- pmpGatewayURI: Specifies the URI to the gateway.  -->
+      <!-- The gateway must be located on the same computer as a Web server.  -->
+      <crn:parameter name="pmpGatewayURI" disabled="true">
+        <crn:value xsi:type="xsd:anyURI">http://localhost:9510/pmpsvc</crn:value>
+      </crn:parameter>
+      <!-- pmpExternalURI: Specifies the external URI used to access the service.  -->
+      <!-- Specifies the external URI used to access the service when it is placed behind a
+           firewall. This element will default to the internal service URI.  -->
+      <crn:parameter name="pmpExternalURI" disabled="true">
+        <crn:value xsi:type="cfg:hostportURI">http://localhost:9510</crn:value>
+      </crn:parameter>
+      <!-- pmpSessionTimeout: Planning service portal session timeout.  -->
+      <!-- Specifies the length of idle time permitted before a session is terminated.  -->
+      <crn:parameter name="pmpSessionTimeout" disabled="true">
+        <crn:value xsi:type="xsd:string">60</crn:value>
+      </crn:parameter>
+      <!-- pmpForceQualifiedPaths: Force qualified paths.  -->
+      <!-- Force qualified paths.  -->
+      <crn:parameter name="pmpForceQualifiedPaths" disabled="true">
+        <crn:value xsi:type="xsd:boolean">true</crn:value>
+      </crn:parameter>
+      <!-- pmpNotificationsProvider: Specifies the Notifications provider.  -->
+      <!-- Specifies the Notifications provider, used to control the delivery of notifications.
+           DLS: Emails will be sent (if a mail server is configured), but no notifications will
+           appear in the Cognos Inbox. HTS: Notifications will be sent to the Cognos Inbox,
+           and emails will also be sent if a mail server is configured.  -->
+      <crn:parameter name="pmpNotificationsProvider" disabled="true">
+        <crn:value xsi:type="xsd:string"></crn:value>
+      </crn:parameter>
+      <!-- pmpBVEnable: Enable Business Viewpoint.  -->
+      <!-- Enable Business Viewpoint.  -->
+      <crn:parameter name="pmpBVEnable" disabled="true">
+        <crn:value xsi:type="xsd:boolean">false</crn:value>
+      </crn:parameter>
+      <!-- pmpBVURI: Specifies Business Viewpoint URI.  -->
+      <!-- Specifies Business Viewpoint URI.  -->
+      <crn:parameter name="pmpBVURI" disabled="true">
+        <crn:value xsi:type="xsd:anyURI">http://localhost:9510/bv</crn:value>
+      </crn:parameter>
+      <!-- pmpSCEnable: Enable Scorecarding.  -->
+      <!-- Enable Scorecarding.  -->
+      <crn:parameter name="pmpSCEnable" disabled="true">
+        <crn:value xsi:type="xsd:boolean">true</crn:value>
+      </crn:parameter>
+      <!-- pmpBIFolderName: Specify the default name of the Cognos 10 folder.  -->
+      <!-- Used to specify the default name of the Cognos 10 folder which will be created at
+           the Public Folders level to contain URL objects.  -->
+      <crn:parameter name="pmpBIFolderName" disabled="true">
+        <crn:value xsi:type="xsd:string">IBM Cognos TM1 Application - My Applications</crn:value>
+      </crn:parameter>
+      <!-- pmpAppDefPath: The path to the location of the TM1 Application definitions. This
+           may be a UNC reference.  -->
+      <!-- Used to specify the location of the application definition files.  -->
+      <crn:parameter name="pmpAppDefPath" disabled="true">
+        <crn:value xsi:type="cfg:folderPath"></crn:value>
+      </crn:parameter>
+      <!-- pmpUserPrefPath: The path to the location of the User preference files.  -->
+      <!-- Used to specify the location of the user preference files. This only applies to TM1
+           servers authenticated using Native TM1 security.  -->
+      <crn:parameter name="pmpUserPrefPath" disabled="true">
+        <crn:value xsi:type="cfg:folderPath"></crn:value>
+      </crn:parameter>
+      <!-- pmpResourcePath: Specifies the location of the string xml files that store the TM1
+           Application Server configuration.  -->
+      <!-- Specifies the name of the folder where the string xml files are located.  -->
+      <crn:parameter name="pmpResourcePath" disabled="true">
+        <crn:value xsi:type="cfg:folderPath"></crn:value>
+      </crn:parameter>
+      <!-- pmpDispatcherURI: Specifies the URI to the dispatcher that processes requests from
+           services on the same computer.  -->
+      <crn:parameter name="pmpDispatcherURI" disabled="true">
+        <crn:value xsi:type="xsd:anyURI">http://localhost:9510/pmpsvc/dispatcher/servlet</crn:value>
+      </crn:parameter>
+      <!-- pmpTrustedUser: Specifies the user ID and password.  -->
+      <!-- This value identifies the planning user that has access privileges to the planning
+           server. Services use this account to authenticate with the planning server.  -->
+      <crn:parameter name="pmpTrustedUser" disabled="true">
+        <crn:value xsi:type="cfg:credential">
+          <credential>
+            <username/>
+            <password/>
+          </credential>
+        </crn:value>
+      </crn:parameter>
+      <!-- pmpNamespace: Specifies the namespace information.  -->
+      <!-- This property is optional. It specifies the namespace information required for authentication.  -->
+      <crn:parameter name="pmpNamespace" disabled="true">
+        <crn:value xsi:type="xsd:string"></crn:value>
+      </crn:parameter>
+      <!-- pmpTm1Clients: Configuration settings for TM1 Clients  -->
+      <crn:parameter name="pmpTm1Clients" opaque="true" disabled="true">
+        <crn:value>
+          <!-- pmpProvisionURI: Specifies the URI of provisioning site.  -->
+          <!-- Specifies the URI of provisioning site. This element will default to planning service
+               application URI.  -->
+          <crn:parameter name="pmpProvisionURI" disabled="true">
+            <crn:value xsi:type="xsd:anyURI"></crn:value>
+          </crn:parameter>
+          <!-- pmpProvisionAllowInstall: Specifies whether clients may be provisioned from the TM1
+               Application Server.  -->
+          <!-- Specifies whether client software may be provisioned to end user machines.  -->
+          <crn:parameter name="pmpProvisionAllowInstall" disabled="true">
+            <crn:value xsi:type="xsd:boolean">true</crn:value>
+          </crn:parameter>
+          <!-- pmpProvisionAllowUpdate: Specifies whether existing clients may be updated from the
+               TM1 Application Server.  -->
+          <!-- Specifies whether existing client software on end user machines may be updated if
+               the TM1 Application Server is updated.  -->
+          <crn:parameter name="pmpProvisionAllowUpdate" disabled="true">
+            <crn:value xsi:type="xsd:boolean">true</crn:value>
+          </crn:parameter>
+          <!-- pmpInsightPublishEnable: Enable publish from Cognos Insight.  -->
+          <!-- Enable publish from Cognos Insight.  -->
+          <crn:parameter name="pmpInsightPublishEnable" disabled="true">
+            <crn:value xsi:type="xsd:boolean">true</crn:value>
+          </crn:parameter>
+          <!-- pmpsvcPingTime: Specifies the frequency that the Cognos Insight pings TM1 Application
+               Server.  -->
+          <!-- Specifies the frequency that the Cognos Insight client, in 'Contributor mode' pings
+               the TM1 Application Server. Default is 30 seconds.  -->
+          <crn:parameter name="pmpsvcPingTime" disabled="true">
+            <crn:value xsi:type="xsd:string">30</crn:value>
+          </crn:parameter>
+        </crn:value>
+      </crn:parameter>
+    </crn:value>
+  </crn:parameter>
+  <!-- tm1ExcelService: Defines a group of properties for the TM1 Excel service  -->
+  <!-- TM1 Excel service support TM1 Web with Export to Excel capabilities.  -->
+  <crn:parameter name="tm1ExcelService" opaque="true" disabled="true">
+    <crn:value>
+      <!-- advancedProperties: Specifies a set of advanced properties.  -->
+      <!-- The user needs to provide the name and the value for each advanced property.  -->
+      <crn:parameter name="advancedProperties" opaque="true" disabled="true">
+        <crn:value xsi:type="cfg:array"/>
+      </crn:parameter>
+    </crn:value>
+  </crn:parameter>
+  <!-- tm1AdminServer: Defines a group of properties for the TM1 Admin Server.  -->
+  <crn:parameter name="tm1AdminServer" opaque="true" disabled="true">
+    <crn:value>
+      <!-- tm1AdminNonSSLPortNumber: Specifies the TCP port number used by TM1 Admin Server
+           for unsecured communication.  -->
+      <crn:parameter name="tm1AdminNonSSLPortNumber" disabled="true">
+        <crn:value xsi:type="xsd:unsignedShort">5495</crn:value>
+      </crn:parameter>
+      <!-- tm1AdminSSLPortNumber: Specifies the TCP port number used by TM1 Admin Server for
+           secured (SSL) communication.  -->
+      <crn:parameter name="tm1AdminSSLPortNumber" disabled="true">
+        <crn:value xsi:type="xsd:unsignedShort">5498</crn:value>
+      </crn:parameter>
+      <!-- tm1AdminSupportNonSSLClients: Specifies if the TM1 Admin Server supports non-SSL
+           TM1 clients.  -->
+      <!-- Set the parameter to true to configure TM1 Admin Server to support non-SSL clients
+           and to listen for client connections on both secured (SSL) and unsecured ports. If
+           set to false TM1 Admin Server will support only SSL client connections on the secured
+           port.  -->
+      <crn:parameter name="tm1AdminSupportNonSSLClients" disabled="true">
+        <crn:value xsi:type="xsd:boolean">false</crn:value>
+      </crn:parameter>
+      <!-- tm1AdminDHFile2048: Specifies the location of the Diffie-Hellman 2048 bit key file.  -->
+      <!-- The full path of the file that contains a pre-generated Diffie-Hellman 2048 bit key.
+           The generation of Diffie-Hellman parameters can be computationally expensive. To
+           minimize the consumption of resources and to reduce the amount of time required to
+           load the TM1 server, the Diffie-Hellman 2048 bit key should be pre-generated and
+           stored in a file that is read when the TM1 Admin Server starts.  -->
+      <crn:parameter name="tm1AdminDHFile2048" disabled="true">
+        <crn:value xsi:type="cfg:filePath"></crn:value>
+      </crn:parameter>
+      <!-- tm1AdminDHFile1024: Specifies the location of the Diffie-Hellman 1024 bit key file.  -->
+      <!-- The full path of the file that contains a pre-generated Diffie-Hellman 1024 bit key.
+           The generation of Diffie-Hellman parameters can be computationally expensive. To
+           minimize the consumption of resources and to reduce the amount of time required to
+           load the TM1 server, the Diffie-Hellman 1024 bit key should be pre-generated and
+           stored in a file that is read when the TM1 Admin Server starts.  -->
+      <crn:parameter name="tm1AdminDHFile1024" disabled="true">
+        <crn:value xsi:type="cfg:filePath"></crn:value>
+      </crn:parameter>
+      <!-- tm1AdminDHFile512: Specifies the location of the Diffie-Hellman 512 bit key file.  -->
+      <!-- The full path of the file that contains a pre-generated Diffie-Hellman 512 bit key.
+           The generation of Diffie-Hellman parameters can be computationally expensive. To
+           minimize the consumption of resources and to reduce the amount of time required to
+           load the TM1 server, the Diffie-Hellman 512 bit key should be pre-generated and stored
+           in a file that is read when the TM1 Admin Server starts.  -->
+      <crn:parameter name="tm1AdminDHFile512" disabled="true">
+        <crn:value xsi:type="cfg:filePath"></crn:value>
+      </crn:parameter>
+      <!-- tm1AdminSSLCertificate: Specifies the location of the certificate file.  -->
+      <!-- The full path of the TM1 Admin Server certificate file, which contains the public/private
+           key pair.  -->
+      <crn:parameter name="tm1AdminSSLCertificate" disabled="true">
+        <crn:value xsi:type="cfg:filePath"></crn:value>
+      </crn:parameter>
+      <!-- tm1AdminSSLCertRevocationFile: Specifies the location of the certificate revocation
+           file.  -->
+      <!-- The full path of the TM1 Admin Server certificate revocation file. A certificate
+           revocation file will only exist in the event a certificate had been revoked.  -->
+      <crn:parameter name="tm1AdminSSLCertRevocationFile" disabled="true">
+        <crn:value xsi:type="cfg:filePath"></crn:value>
+      </crn:parameter>
+      <!-- tm1AdminExportSvrSSLCert: Specifies whether the TM1 Admin Server certificate should
+           be exported from the Windows certificate store.  -->
+      <!-- If the parameter value is true the TM1 Admin Server certificate is exported from
+           the Windows certificate store when the certificate is requested by the TM1 Admin
+           Server. You must also set the following TM1 Admin Server parameters: 'TM1 Admin Server
+           export key ID', 'TM1 Admin Server certificate ID', 'TM1 Admin Server private key
+           password file location', 'TM1 Admin Server password key file location', 'TM1 Admin
+           Server certificate authority file location'. For details on using your own security
+           certificates and exporting certificates from the Windows certificate store, see Using
+           Independent Certificates topic in TM1 Operation Guide.  -->
+      <crn:parameter name="tm1AdminExportSvrSSLCert" disabled="true">
+        <crn:value xsi:type="xsd:boolean">false</crn:value>
+      </crn:parameter>
+      <!-- tm1AdminSvrSSLExportKeyID: Specifies the identity key used to export the TM1 Admin
+           Server certificate from the Windows certificate store.  -->
+      <!-- This parameter is used only if you use the certificate store.  -->
+      <crn:parameter name="tm1AdminSvrSSLExportKeyID" disabled="true">
+        <crn:value xsi:type="xsd:string"></crn:value>
+      </crn:parameter>
+      <!-- tm1AdminSSLCertificateID: Specifies the name of the principal to whom the TM1 Admin
+           Server certificate is issued.  -->
+      <crn:parameter name="tm1AdminSSLCertificateID" disabled="true">
+        <crn:value xsi:type="xsd:string"></crn:value>
+      </crn:parameter>
+      <!-- tm1AdminSSLPrivateKeyPwdFile: Specifies the location of the private key password
+           file.  -->
+      <!-- The full path of the file that contains the encrypted password for the TM1 Admin
+           Server private key.  -->
+      <crn:parameter name="tm1AdminSSLPrivateKeyPwdFile" disabled="true">
+        <crn:value xsi:type="cfg:filePath"></crn:value>
+      </crn:parameter>
+      <!-- tm1AdminSSLPwdKeyFile: Specifies the location of the password key file.  -->
+      <!-- The full path of the file that contains the key used to encrypt and decrypt the password
+           for the private key.  -->
+      <crn:parameter name="tm1AdminSSLPwdKeyFile" disabled="true">
+        <crn:value xsi:type="cfg:filePath"></crn:value>
+      </crn:parameter>
+      <!-- tm1AdminSSLCertAuthority: Specifies the full path to the certificate authority file.  -->
+      <crn:parameter name="tm1AdminSSLCertAuthority" disabled="true">
+        <crn:value xsi:type="cfg:filePath"></crn:value>
+      </crn:parameter>
+      <!-- tm1AdminIPVersion: Specifies the Internet Protocol(s) which the TM1 Admin Server
+           will support.  -->
+      <crn:parameter name="tm1AdminIPVersion" disabled="true">
+        <crn:value xsi:type="xsd:string">IPv4</crn:value>
+      </crn:parameter>
+      <!-- tm1AdminActivityInterval: Specifies the interval in seconds wherein the TM1 Server
+           will notify the TM1 Admin Server that it is active.  -->
+      <crn:parameter name="tm1AdminActivityInterval" disabled="true">
+        <crn:value xsi:type="xsd:positiveInteger">10</crn:value>
+      </crn:parameter>
+      <!-- tm1AdminInactivityTimeout: Specifies the interval in seconds that the TM1 Server
+           is allowed to be inactive before it is removed from the TM1 Admin Server.  -->
+      <crn:parameter name="tm1AdminInactivityTimeout" disabled="true">
+        <crn:value xsi:type="xsd:positiveInteger">10</crn:value>
+      </crn:parameter>
+      <!-- tm1AdminSvrCertificateVersion: Specifies which version of the TM1 generated SSL certificates
+           to use.  -->
+      <!-- By default, the 1024-bit encryption version of the TM1 generated certificates is
+           used. Change this parameter only if you want to use the new 2048-bit encryption version
+           of the default certificates. You can use the new version with old and new TM1 clients,
+           but you must configure the clients to use the new certificate authority file. This
+           parameter does not apply if you are using your own SSL certificates. Valid values
+           include: 1 = certificate authority to enable 1024-bit encryption with sha-1 (default
+           value); 2 = certificate authority to enable 2048-bit encryption with sha-256.  -->
+      <crn:parameter name="tm1AdminSvrCertificateVersion" disabled="true">
+        <crn:value xsi:type="xsd:int">1</crn:value>
+      </crn:parameter>
+    </crn:value>
+  </crn:parameter>
+  <!-- mdmService: Defines a group of properties for the Tomcat application server.  -->
+  <!-- Business Viewpoint web application runs under the Tomcat server.  -->
+  <crn:parameter name="mdmService" opaque="true" disabled="true">
+    <crn:value>
+      <!-- mdmDefaultPort: Specifies the TCP port number on which the Tomcat server listens
+           for client connections.  -->
+      <crn:parameter name="mdmDefaultPort" disabled="true">
+        <crn:value xsi:type="xsd:unsignedShort">9410</crn:value>
+      </crn:parameter>
+      <!-- mdmSSLPort: Specifies the TCP port number on which the Tomcat server listens for
+           SSL client connections.  -->
+      <crn:parameter name="mdmSSLPort" disabled="true">
+        <crn:value xsi:type="xsd:unsignedShort">9443</crn:value>
+      </crn:parameter>
+      <!-- mdmUseSSL: Specifies if all requests sent to the default port have to be rerouted
+           to SSL port  -->
+      <crn:parameter name="mdmUseSSL" disabled="true">
+        <crn:value xsi:type="xsd:boolean">false</crn:value>
+      </crn:parameter>
+      <!-- mdmShutdownPort: Specifies the TCP port number on which the Tomcat server listens
+           for a shutdown request.  -->
+      <crn:parameter name="mdmShutdownPort" disabled="true">
+        <crn:value xsi:type="xsd:unsignedShort">9489</crn:value>
+      </crn:parameter>
+      <!-- mdmSessionTimeout: Specifies the time between client requests before the servlet
+           container invalidates the session.  -->
+      <!-- A value of -1 indicates the session should never timeout.  -->
+      <crn:parameter name="mdmSessionTimeout" disabled="true">
+        <crn:value xsi:type="xsd:int">60</crn:value>
+      </crn:parameter>
+    </crn:value>
+  </crn:parameter>
+  <!-- MDCSettings: Defines a group of properties for IBM Cognos Business Viewpoint server.  -->
+  <!-- Use these properties to specify connection information for the main Business Viewpoint
+       server.  -->
+  <crn:parameter name="MDCSettings" opaque="true" disabled="true">
+    <crn:value>
+      <!-- mdcServerHost: Specifies the name of the Business Viewpoint server machine.  -->
+      <crn:parameter name="mdcServerHost" disabled="true">
+        <crn:value xsi:type="cfg:hostOnly"></crn:value>
+      </crn:parameter>
+      <!-- mdcServerPort: Specifies the TCP port number on which the Business Viewpoint server
+           listens for client connections.  -->
+      <crn:parameter name="mdcServerPort" disabled="true">
+        <crn:value xsi:type="xsd:unsignedShort">9410</crn:value>
+      </crn:parameter>
+    </crn:value>
+  </crn:parameter>
+  <!-- MDCAdapters: Defines the adapters for IBM Cognos Business Viewpoint Client.  -->
+  <!-- Use these properties to configure the Business Viewpoint Client adapters.  -->
+  <crn:parameter name="MDCAdapters" opaque="true" disabled="true">
+    <crn:value>
+      <!-- mdc_adapter: Specifies the adapter type.  -->
+      <!-- You cannot change the value of this property. It is automatically set when you choose
+           the type of a new adapter.  -->
+      <crn:instances name="mdc_adapter" disabled="true">
+        <!-- Relational Database: Defines a group of properties for the Business Viewpoint Client
+             Relational Database adapter.  -->
+        <crn:instance name="Relational Database" class="mdcAdapterRelationalDB" disabled="true">
+          <!-- mdcAdapterEnabled: Use this flag to enable or disable this adapter.  -->
+          <crn:parameter name="mdcAdapterEnabled" disabled="true">
+            <crn:value xsi:type="xsd:boolean">true</crn:value>
+          </crn:parameter>
+          <!-- mdcAdapterId: Specifies the unique ID of this adapter.  -->
+          <!-- The IDs of all adapter configuration instances must be unique among all adapter instances
+               that are connected to the same Business Viewpoint server. This includes adapter instances
+               on other computers that are connected to the same server.  -->
+          <crn:parameter name="mdcAdapterId" disabled="true">
+            <crn:value xsi:type="xsd:int">100</crn:value>
+          </crn:parameter>
+        </crn:instance>
+      </crn:instances>
+    </crn:value>
+  </crn:parameter>
+  <!-- IPF: Defines a group of properties for the log server.  -->
+  <!-- Use this group of properties to provide access to the log server and specify where
+       the log server sends log messages. The log server can direct messages to any number
+       of destinations of any available type, such as a file, a database or a remote log
+       server.  -->
+  <crn:parameter name="IPF" opaque="true">
+    <crn:value>
+      <!-- logServerPort: Specifies the port used by the local log server.  -->
+      <!-- Ensure that you specify a port that is not already in use.  -->
+      <crn:parameter name="logServerPort">
+        <crn:value xsi:type="xsd:unsignedShort">9362</crn:value>
+      </crn:parameter>
+      <!-- enableTCPConnection: Specifies whether to use TCP protocol for communication between
+           the product components and the log server.  -->
+      <!-- If you set the value of this property to true, a TCP (Transmission Control Protocol)
+           connection is used to communicate with the log server. TCP guarantees the delivery
+           of packets in the same order in which they were sent. If you set this property to
+           false, UDP (User Datagram Protocol) connection is used.  -->
+      <crn:parameter name="enableTCPConnection">
+        <crn:value xsi:type="xsd:boolean">false</crn:value>
+      </crn:parameter>
+      <!-- workerThreads: Specifies the maximum number of threads available on the local log
+           server to manage incoming log messages.  -->
+      <!-- Enter a value between 1 and 20. The higher the number of threads, the more memory
+           allocated to processing messages.  -->
+      <crn:parameter name="workerThreads">
+        <crn:value xsi:type="xsd:unsignedShort">10</crn:value>
+      </crn:parameter>
+      <!-- appender: Specifies a unique instance of a device to which the log server directs
+           messages.  -->
+      <!-- The value of this property specifies the destination to which the log server directs
+           messages generated by the product. You cannot change the value of this property.
+           It is automatically set when you choose the destination type for logging in the Explorer
+           window.  -->
+      <crn:instances name="appender">
+        <!-- File: Defines a group of properties that allows the log server to direct messages
+             to a file.  -->
+        <!-- By default, all log messages are directed by the log server to a file stored on the
+             local computer. Not all log statements or messages indicate problems; some messages
+             are purely informational, while others help diagnose problems.  -->
+        <crn:instance name="File" class="file">
+          <!-- appenderName: Specifies the name and location of a file that contains log statements
+               or messages.  -->
+          <crn:parameter name="appenderName">
+            <crn:value xsi:type="cfg:filePath">../logs/cogserver.log</crn:value>
+          </crn:parameter>
+          <!-- appenderMaxSize: Specifies the maximum size of the log file in MB.  -->
+          <!-- When this limit is exceeded, a new backup file is created. Enter a number between
+               1 and 50.  -->
+          <crn:parameter name="appenderMaxSize">
+            <crn:value xsi:type="xsd:positiveInteger">10</crn:value>
+          </crn:parameter>
+          <!-- appenderRollOver: Specifies the maximum number of backup log files.  -->
+          <!-- When the limit is exceeded, the oldest log file is deleted. Each backup file is created
+               using a sequential file extension. For example, 'filename.1', 'filename.2'.  -->
+          <crn:parameter name="appenderRollOver">
+            <crn:value xsi:type="xsd:positiveInteger">10</crn:value>
+          </crn:parameter>
+          <!-- useUTF8Encoding: Specifies whether to use UTF-8 character set encoding for log messages.  -->
+          <!-- Set this value to true to use UTF-8 encoding. Otherwise, native encoding is used.  -->
+          <crn:parameter name="useUTF8Encoding">
+            <crn:value xsi:type="xsd:boolean">true</crn:value>
+          </crn:parameter>
+        </crn:instance>
+      </crn:instances>
+    </crn:value>
+  </crn:parameter>
+  <!-- CBS: Defines a group of properties for the IBM Cognos services.  -->
+  <!-- Use these properties to specify the amount of resources that the IBM Cognos services
+       use.  -->
+  <crn:parameter name="CBS" opaque="true">
+    <crn:value>
+      <!-- asvIsEnabled: Specifies whether the agent service is enabled.  -->
+      <!-- Use this property to enable or disable the agent service on the local computer. The
+           agent service executes agents. If the conditions for an agent are met, the agent
+           service signals the monitor service to execute the tasks. By default the agent service
+           is enabled.  -->
+      <crn:parameter name="asvIsEnabled">
+        <crn:value xsi:type="xsd:boolean">true</crn:value>
+      </crn:parameter>
+      <!-- ansIsEnabled: Specifies whether the annotation service is enabled.  -->
+      <!-- Use this property to enable or disable the annotation service on the local computer.
+           This service allows the ability to add commentary to reports. By default the annotation
+           service is enabled.  -->
+      <crn:parameter name="ansIsEnabled">
+        <crn:value xsi:type="xsd:boolean">true</crn:value>
+      </crn:parameter>
+      <!-- brsIsEnabled: Specifies whether the batch report service is enabled.  -->
+      <!-- Use this property to enable or disable the batch report service on the local computer.
+           The batch report service handles background requests for report executions and provides
+           output, on behalf of the monitor service. The batch report service works the same
+           as the report service, except it handles only background executions. By default the
+           batch report service is enabled.  -->
+      <crn:parameter name="brsIsEnabled">
+        <crn:value xsi:type="xsd:boolean">true</crn:value>
+      </crn:parameter>
+      <!-- cmIsEnabled: Specifies whether the Content Manager service is enabled.  -->
+      <!-- Use this property to enable or disable the Content Manager service on the local computer.
+           The Content Manager service is a service used by other services to store, organize,
+           and retrieve application data such as system configuration, models, report specifications,
+           report outputs, schedules, user accounts, groups, contacts, distribution lists and
+           data sources. A distributed installation may have one active Content Manager service,
+           and one or more standby Content Manager services. By default the Content Manager
+           service is enabled.  -->
+      <crn:parameter name="cmIsEnabled">
+        <crn:value xsi:type="xsd:boolean">true</crn:value>
+      </crn:parameter>
+      <!-- disIsEnabled: Specifies whether the data integration service is enabled.  -->
+      <!-- Use this property to enable or disable the data integration service on the local
+           computer. The data integration service manages the tasks that obtain data from data
+           sources, extract information from data stores, recalculate and transform data, and
+           load content for use by Metrics Manager in the portal. By default the data integration
+           service is enabled.  -->
+      <crn:parameter name="disIsEnabled" disabled="true">
+        <crn:value xsi:type="xsd:boolean">true</crn:value>
+      </crn:parameter>
+      <!-- dssoapIsEnabled: Specifies whether the Data Manager SOAP service is enabled.  -->
+      <!-- Use this property to enable or disable Data Manager SOAP service on the local computer.
+           By default Data Manager SOAP service is enabled.  -->
+      <crn:parameter name="dssoapIsEnabled" disabled="true">
+        <crn:value xsi:type="xsd:boolean">true</crn:value>
+      </crn:parameter>
+      <!-- dmsIsEnabled: Specifies whether the data movement service is enabled.  -->
+      <!-- Use this property to enable or disable the data movement service on the local computer.
+           The data movement service is used for CEBA-based requests for data movement tasks.
+           By default, the data movement service is enabled.  -->
+      <crn:parameter name="dmsIsEnabled" disabled="true">
+        <crn:value xsi:type="xsd:boolean">true</crn:value>
+      </crn:parameter>
+      <!-- dlsIsEnabled: Specifies whether the delivery service is enabled.  -->
+      <!-- Use this property to enable or disable the delivery service on the local computer.
+           The delivery service sends emails on behalf of other services, such as the report
+           service, job service or agent service. By default the delivery service is enabled.  -->
+      <crn:parameter name="dlsIsEnabled">
+        <crn:value xsi:type="xsd:boolean"><%= scope['cognos::enable_delivery_service'] %></crn:value>
+      </crn:parameter>
+      <!-- dispIsEnabled: Specifies whether the dispatcher related services are enabled.  -->
+      <!-- Use this property to enable or disable a number of services on the local computer.
+           Currently these are the batch report service, report service, data movement service,
+           metadata service and presentation service. By default these services are disabled
+           on computers where Content Manager is the only component that is installed. Please
+           note that the dispatcher itself will not be disabled.  -->
+      <crn:parameter name="dispIsEnabled">
+        <crn:value xsi:type="xsd:boolean">true</crn:value>
+      </crn:parameter>
+      <!-- emIsEnabled: Specifies whether the event management service is enabled.  -->
+      <!-- Use this property to enable or disable the event management service on the local
+           computer. The event management service manages scheduled task executions. When a
+           scheduled task execution begins, the event management service signals the monitor
+           service to begin the execution of the task. By default the event management service
+           is enabled.  -->
+      <crn:parameter name="emIsEnabled">
+        <crn:value xsi:type="xsd:boolean">true</crn:value>
+      </crn:parameter>
+      <!-- gsIsEnabled: Specifies whether the graphics service is enabled.  -->
+      <!-- Use this property to enable or disable the graphics service on the local computer.
+           The graphics service produces charts and graphics on behalf of the report service.
+           By default the graphics service is enabled.  -->
+      <crn:parameter name="gsIsEnabled">
+        <crn:value xsi:type="xsd:boolean">true</crn:value>
+      </crn:parameter>
+      <!-- htsIsEnabled: Specifies whether the human task service is enabled.  -->
+      <!-- Use this property to enable or disable the human task service on the local computer.
+           This service enables the ability to create and manage human tasks. A human task,
+           such as a report approval, can be assigned to individuals or groups on an ad-hoc
+           basis or by any of the other services. By default the human task service is enabled.  -->
+      <crn:parameter name="htsIsEnabled">
+        <crn:value xsi:type="xsd:boolean">true</crn:value>
+      </crn:parameter>
+      <!-- idVizIsEnabled: Specifies whether the interactive discovery visualization service
+           is enabled.  -->
+      <!-- Use this property to enable or disable the interactive discovery visualization service
+           on the local computer. The interactive discovery visualization service provides content
+           to IBM Cognos products to support interactive discovery and visualization functionality.
+           By default the interactive discovery visualization service is enabled.  -->
+      <crn:parameter name="idVizIsEnabled">
+        <crn:value xsi:type="xsd:boolean">true</crn:value>
+      </crn:parameter>
+      <!-- jsIsEnabled: Specifies whether the job service is enabled.  -->
+      <!-- Use this property to enable or disable the job service on the local computer. The
+           job service executes jobs and signals the monitor service to execute job steps in
+           the background. By default the job service is enabled.  -->
+      <crn:parameter name="jsIsEnabled">
+        <crn:value xsi:type="xsd:boolean">true</crn:value>
+      </crn:parameter>
+      <!-- mdsIsEnabled: Specifies whether the metadata service is enabled.  -->
+      <!-- Use this property to enable or disable the metadata service on the local computer.
+           The metadata service handles metadata requests including lineage, queryMetadata,
+           updateMetadata and testDataSourceConnection. By default, the metadata service is
+           enabled.  -->
+      <crn:parameter name="mdsIsEnabled">
+        <crn:value xsi:type="xsd:boolean">true</crn:value>
+      </crn:parameter>
+      <!-- cmmIsEnabled: Specifies whether Metrics Manager service is enabled.  -->
+      <!-- Use this property to enable or disable Metrics Manager service on the local computer.
+           The Metrics Manager service manages application requests, such as requests for Web
+           pages or application configuration information. By default the Metrics Manager service
+           is enabled.  -->
+      <crn:parameter name="cmmIsEnabled" disabled="true">
+        <crn:value xsi:type="xsd:boolean">true</crn:value>
+      </crn:parameter>
+      <!-- migsrvIsEnabled: Specifies whether the migration service is enabled.  -->
+      <!-- Use this property to enable or disable the migration service on the local computer.
+           The migration service is used to migrate PowerPlay content. By default the migration
+           service is disabled on computers where Content Manager is not installed.  -->
+      <crn:parameter name="migsrvIsEnabled" disabled="true">
+        <crn:value xsi:type="xsd:boolean">true</crn:value>
+      </crn:parameter>
+      <!-- mobIsEnabled: Specifies whether the mobile service is enabled.  -->
+      <!-- Use this property to enable or disable the mobile service on the local computer.
+           The mobile service allows content to be sent to mobile devices, and handles requests
+           from mobile devices. By default the mobile service is enabled.  -->
+      <crn:parameter name="mobIsEnabled">
+        <crn:value xsi:type="xsd:boolean">true</crn:value>
+      </crn:parameter>
+      <!-- msIsEnabled: Specifies whether the monitor service is enabled.  -->
+      <!-- Use this property to enable or disable the monitor service on the local computer.
+           The monitor service signals a target service to handle a task, then monitors the
+           execution of the task and collects and saves history information for the execution
+           of the task. The monitor service can also take control of asynchronous service conversations
+           on behalf of the client. By default the monitor service is enabled.  -->
+      <crn:parameter name="msIsEnabled">
+        <crn:value xsi:type="xsd:boolean">true</crn:value>
+      </crn:parameter>
+      <!-- pasIsEnabled: Specifies whether the planning administration console service is enabled.  -->
+      <!-- Use this property to enable or disable the planning administration console service
+           on the local computer. By default the planning administration console service is
+           enabled.  -->
+      <crn:parameter name="pasIsEnabled" disabled="true">
+        <crn:value xsi:type="xsd:boolean">true</crn:value>
+      </crn:parameter>
+      <!-- pdsIsEnabled: Specifies whether the planning data service is enabled.  -->
+      <!-- Use this property to enable or disable the planning data service on the local computer.
+           The planning data service manages report queries against IBM Cognos Planning - Contributor
+           data sources. By default, the planning data service is enabled.  -->
+      <crn:parameter name="pdsIsEnabled" disabled="true">
+        <crn:value xsi:type="xsd:boolean">true</crn:value>
+      </crn:parameter>
+      <!-- pjsIsEnabled: Specifies whether the planning job Data Manager service is enabled.  -->
+      <!-- Use this property to enable or disable the planning job service on the local computer.
+           By default the planning job service is enabled.  -->
+      <crn:parameter name="pjsIsEnabled" disabled="true">
+        <crn:value xsi:type="xsd:boolean">true</crn:value>
+      </crn:parameter>
+      <!-- pwsIsEnabled: Specifies whether the planning Web service is enabled.  -->
+      <!-- Use this property to enable or disable the planning Web service on the local computer.
+           By default the planning Web service is enabled.  -->
+      <crn:parameter name="pwsIsEnabled" disabled="true">
+        <crn:value xsi:type="xsd:boolean">true</crn:value>
+      </crn:parameter>
+      <!-- ppesIsEnabled: Specifies whether the PowerPlay service is enabled.  -->
+      <!-- Use this property to enable or disable the PowerPlay service on the local computer.
+           By default the PowerPlay service is enabled.  -->
+      <crn:parameter name="ppesIsEnabled" disabled="true">
+        <crn:value xsi:type="xsd:boolean">true</crn:value>
+      </crn:parameter>
+      <!-- xtscrnIsEnabled: Specifies whether the presentation service is enabled.  -->
+      <!-- Use this property to enable or disable the presentation service on the local computer.
+           The presentation service handles requests for IBM Cognos Connection, Query Studio,
+           and Event Studio. By default the presentation service is disabled on computers where
+           Content Manager is the only component that is installed.  -->
+      <crn:parameter name="xtscrnIsEnabled">
+        <crn:value xsi:type="xsd:boolean">true</crn:value>
+      </crn:parameter>
+      <!-- qsIsEnabled: Specifies whether the query service is enabled.  -->
+      <!-- Use this property to enable or disable the query service on the local computer. By
+           default the query service is enabled.  -->
+      <crn:parameter name="qsIsEnabled">
+        <crn:value xsi:type="xsd:boolean">true</crn:value>
+      </crn:parameter>
+      <!-- ccsIsEnabled: Specifies whether the report data service is enabled.  -->
+      <!-- Use this property to enable or disable the report data service on the local computer.
+           The report data service manages external client requests such as IBM Cognos BI for
+           Microsoft Office. By default the report data service is enabled.  -->
+      <crn:parameter name="ccsIsEnabled">
+        <crn:value xsi:type="xsd:boolean">true</crn:value>
+      </crn:parameter>
+      <!-- warpIsEnabled: Specifies whether the report service is enabled.  -->
+      <!-- Use this property to enable or disable the report service on the local computer.
+           The report service handles interactive requests for report executions and generates
+           output for a user in IBM Cognos Connection or one of the studios. By default the
+           report service is enabled.  -->
+      <crn:parameter name="warpIsEnabled">
+        <crn:value xsi:type="xsd:boolean">true</crn:value>
+      </crn:parameter>
+      <!-- repoIsEnabled: Specifies whether the repository service is enabled.  -->
+      <!-- Use this property to enable or disable the repository service on the local computer.
+           By default the repository service is enabled.  -->
+      <crn:parameter name="repoIsEnabled">
+        <crn:value xsi:type="xsd:boolean">true</crn:value>
+      </crn:parameter>
+      <!-- rmdsIsEnabled: Specifies whether the relational metadata service is enabled.  -->
+      <!-- Use this property to enable or disable the relational metadata service on the local
+           computer. By default the relational metadata service is enabled.  -->
+      <crn:parameter name="rmdsIsEnabled">
+        <crn:value xsi:type="xsd:boolean">true</crn:value>
+      </crn:parameter>
+      <!-- vgsIsEnabled: Specifies whether the visualization gallery service is enabled.  -->
+      <!-- Use this property to enable or disable the visualization gallery service on the local
+           computer. By default the visualization gallery service is enabled.  -->
+      <crn:parameter name="vgsIsEnabled">
+        <crn:value xsi:type="xsd:boolean">true</crn:value>
+      </crn:parameter>
+      <!-- cbs: Specifies the template used to configure the IBM Cognos service.  -->
+      <!-- This property is automatically set when you select a template for the IBM Cognos
+           service. You cannot change the value of this property in this window. If you want
+           to use another template, in the Explorer window, right-click the service and click
+           Delete. Right-click IBM Cognos service, click New resource, Configuration. Enter
+           a resource name and then select a template from the list.  -->
+      <crn:instances name="cbs">
+        <!-- IBM Cognos: Defines a group of properties for a configuration template used for WebSphere
+             Liberty Profile.  -->
+        <crn:instance name="IBM Cognos" class="WebSphereLiberty">
+          <!-- dispatcherPingTimeout: Specifies the maximum number of seconds to wait for a response
+               to a ping.  -->
+          <!-- If the ping is not responded to within the specified time interval, the process is
+               automatically restarted.  -->
+          <crn:parameter name="dispatcherPingTimeout">
+            <crn:value xsi:type="xsd:unsignedShort">240</crn:value>
+          </crn:parameter>
+          <!-- dispatcherStopWaitTime: Specifies the maximum number of seconds that the IBM Cognos
+               service waits for the process to stop.  -->
+          <!-- After this amount of time, the process is automatically stopped.  -->
+          <crn:parameter name="dispatcherStopWaitTime">
+            <crn:value xsi:type="xsd:unsignedShort">60</crn:value>
+          </crn:parameter>
+          <!-- dispatcherMaxMemory: Specifies the maximum amount of memory in MB that can be used
+               by the process.  -->
+          <!-- This value determines the amount of memory used by the Java Virtual Machine and depends
+               on how much memory is available. If this value is too high, the process will fail
+               to start and no log information will be generated. Invoke the test action to determine
+               if this value is valid.  -->
+          <crn:parameter name="dispatcherMaxMemory">
+            <crn:value xsi:type="xsd:unsignedInt"><%= scope['cognos::dispatcher_max_memory'] %></crn:value>
+          </crn:parameter>
+          <!-- wlpProperties: These properties are used to tune the WebSphere Liberty Profile (WLP)
+               server.  -->
+          <!-- The property value of 'coreThreads' represents the number of threads that the WLP
+               server starts up with. The 'maxThreads' value represents the maximum number of threads
+               that can be associated with the WLP server. Customize these values according to the
+               hardware resources available. For more information, refer to the WLP server documentation
+               (http://www-01.ibm.com/support/knowledgecenter/?lang=en#!/SSEQTP_8.5.5/com.ibm.websphere.wlp.doc/ae/twlp_tun.html?cp=SSEQTP_8.5.5%2F1-3-11-0-7).  -->
+          <crn:parameter name="wlpProperties" opaque="true">
+            <crn:value xsi:type="cfg:array">
+              <crn:parameter name="coreThreads">
+                <crn:value xsi:type="xsd:string">100</crn:value>
+              </crn:parameter>
+              <crn:parameter name="maxThreads">
+                <crn:value xsi:type="xsd:string">1500</crn:value>
+              </crn:parameter>
+            </crn:value>
+          </crn:parameter>
+        </crn:instance>
+      </crn:instances>
+    </crn:value>
+  </crn:parameter>
+  <!-- CPS: Defines the properties for the portal services.  -->
+  <crn:parameter name="CPS" opaque="true">
+    <crn:value>
+      <!-- webcontent: Specifies the URI of the portal services Web content.  -->
+      <!-- No value is required when the Web content, represented by the portal services portlets,
+           is used in IBM Cognos Connection. When the portlets are deployed to a third-party
+           portal, this value can optionally be used to specify an alternate Web content URI
+           where portal users can access portal services images and Web content. For example,
+           http://MyPortalImageServer/ibmcognos/.  -->
+      <crn:parameter name="webcontent">
+        <crn:value xsi:type="xsd:anyURI"></crn:value>
+      </crn:parameter>
+      <!-- applications: Specifies the URI or local file path of the applications.xml file.  -->
+      <!-- If your environment includes more than one instance of IBM Cognos, and you configure
+           different instances to use different applications.xml locations, each location must
+           contain the same version of the applications.xml file.  -->
+      <crn:parameter name="applications">
+        <crn:value xsi:type="xsd:string">http://localhost:9300/samples/cps4/applications.xml</crn:value>
+      </crn:parameter>
+      <!-- cps_namespaceID: Specifies the authentication namespace ID.  -->
+      <!-- Enter the value of an existing authentication namespace.  -->
+      <crn:parameter name="cps_namespaceID">
+        <crn:value xsi:type="xsd:string"></crn:value>
+      </crn:parameter>
+      <!-- cps_sharedSecret: Specifies the value of a key for single signon using the shared
+           secret method.  -->
+      <!-- This property is case-sensitive.  -->
+      <crn:parameter name="cps_sharedSecret">
+        <crn:value xsi:type="xsd:string"></crn:value>
+      </crn:parameter>
+    </crn:value>
+  </crn:parameter>
+  <!-- CDS: Defines a group of properties for Data Manager.  -->
+  <crn:parameter name="CDS" opaque="true" disabled="true">
+    <crn:value>
+      <!-- DS_DATA_DIR: Specifies the directory that Data Manager delivers text data files and
+           metadata files to.  -->
+      <crn:parameter name="DS_DATA_DIR" disabled="true">
+        <crn:value xsi:type="cfg:folderPath">../datamanager/data</crn:value>
+      </crn:parameter>
+      <!-- DS_LOG_DIR: Specifies the directory that Data Manager writes log files to when you
+           execute builds from a catalog.  -->
+      <crn:parameter name="DS_LOG_DIR" disabled="true">
+        <crn:value xsi:type="cfg:folderPath">../datamanager/log</crn:value>
+      </crn:parameter>
+      <!-- CDSNet: Defines a group of properties for Data Manager network services.  -->
+      <crn:parameter name="CDSNet" opaque="true" disabled="true">
+        <crn:value>
+          <!-- DS_NET_LOG_DIR: Specifies the directory that Data Manager network services writes
+               log files to.  -->
+          <crn:parameter name="DS_NET_LOG_DIR" disabled="true">
+            <crn:value xsi:type="cfg:folderPath">../datamanager/dsnetlog</crn:value>
+          </crn:parameter>
+          <!-- CDSNetClient: Defines a group of properties for Data Manager server connections.  -->
+          <crn:parameter name="CDSNetClient" opaque="true" disabled="true">
+            <crn:value>
+              <!-- DSNET_CLIENT_LOG_SEVERITY: Specifies the level of logging on the client. 1 = least
+                   verbose, 5 = most verbose.  -->
+              <crn:parameter name="DSNET_CLIENT_LOG_SEVERITY" disabled="true">
+                <crn:value xsi:type="xsd:unsignedShort">3</crn:value>
+              </crn:parameter>
+              <!-- DS_NET_DEFAULT_PORT: Specifies the default port for the remote connection.  -->
+              <crn:parameter name="DS_NET_DEFAULT_PORT" disabled="true">
+                <crn:value xsi:type="xsd:unsignedShort">9300</crn:value>
+              </crn:parameter>
+              <!-- DS_NET_DEFAULT_PROTOCOL: The default protocol used for remote connection.  -->
+              <!-- Use this property to specify the protocol for the remote connection.  -->
+              <crn:parameter name="DS_NET_DEFAULT_PROTOCOL" disabled="true">
+                <crn:value xsi:type="xsd:string">SOAP</crn:value>
+              </crn:parameter>
+              <!-- DSNET_DFLT_PWD: The default service access password for remote Data Manager Network
+                   servers.  -->
+              <!-- This password is used if no matched server connection entry is found for given host
+                   / port / protocol.  -->
+              <crn:parameter name="DSNET_DFLT_PWD" disabled="true">
+                <crn:value xsi:type="cfg:systemPassword">NoPassWordSet</crn:value>
+              </crn:parameter>
+              <crn:instances name="DS_NET_CONNECTION" disabled="true">
+                <!-- localhost: Defines a group of properties used to define a server connection.  -->
+                <!-- Ensure that the server exists and that the resource name is the host name of the
+                     remote server.  -->
+                <crn:instance name="localhost" class="DS_NET_SERVERCONNECTION" disabled="true">
+                  <!-- DS_NET_PORT: Specifies the port of the remote connection.  -->
+                  <crn:parameter name="DS_NET_PORT" disabled="true">
+                    <crn:value xsi:type="xsd:unsignedShort">9300</crn:value>
+                  </crn:parameter>
+                  <!-- DS_NET_PROTOCOL: The protocol used for remote connection.  -->
+                  <!-- Use this property to specify the protocol for the remote connection.  -->
+                  <crn:parameter name="DS_NET_PROTOCOL" disabled="true">
+                    <crn:value xsi:type="xsd:string">SOAP</crn:value>
+                  </crn:parameter>
+                  <!-- DS_NET_PWD: The service access password for the Data Manager network server.  -->
+                  <crn:parameter name="DS_NET_PWD" disabled="true">
+                    <crn:value xsi:type="cfg:systemPassword">NoPassWordSet</crn:value>
+                  </crn:parameter>
+                </crn:instance>
+              </crn:instances>
+            </crn:value>
+          </crn:parameter>
+          <!-- CDSNetServer: Defines a group of properties for Data Manager servers.  -->
+          <crn:parameter name="CDSNetServer" opaque="true" disabled="true">
+            <crn:value>
+              <!-- CDSNetSOAPServer: Defines a group of properties for Data Manager network services
+                   SOAP Server.  -->
+              <crn:parameter name="CDSNetSOAPServer" opaque="true" disabled="true">
+                <crn:value>
+                  <!-- DSNET_SOAP_SERVER_LOG_SEVERITY: Specifies the level of logging on the server. 1 =
+                       least verbose, 5 = most verbose.  -->
+                  <crn:parameter name="DSNET_SOAP_SERVER_LOG_SEVERITY" disabled="true">
+                    <crn:value xsi:type="xsd:unsignedShort">3</crn:value>
+                  </crn:parameter>
+                </crn:value>
+              </crn:parameter>
+              <!-- CDSNetSocketServer: Defines a group of properties for Data Manager network services
+                   Socket Server.  -->
+              <crn:parameter name="CDSNetSocketServer" opaque="true" disabled="true">
+                <crn:value>
+                  <!-- DSNET_PWD: The service access password for the Data Manager network server.  -->
+                  <crn:parameter name="DSNET_PWD" disabled="true">
+                    <crn:value xsi:type="cfg:systemPassword">NoPassWordSet</crn:value>
+                  </crn:parameter>
+                  <!-- DS_NET_SOCK_PORT: Specifies the port for the Socket Server.  -->
+                  <crn:parameter name="DS_NET_SOCK_PORT" disabled="true">
+                    <crn:value xsi:type="xsd:unsignedShort">9310</crn:value>
+                  </crn:parameter>
+                  <!-- DSNET_SOCKET_SERVER_LOG_SEVERITY: Specifies the level of logging on the server. 1
+                       = least verbose, 5 = most verbose.  -->
+                  <crn:parameter name="DSNET_SOCKET_SERVER_LOG_SEVERITY" disabled="true">
+                    <crn:value xsi:type="xsd:unsignedShort">3</crn:value>
+                  </crn:parameter>
+                </crn:value>
+              </crn:parameter>
+            </crn:value>
+          </crn:parameter>
+        </crn:value>
+      </crn:parameter>
+    </crn:value>
+  </crn:parameter>
+  <!-- PLANNING: Defines the properties for the Planning.  -->
+  <crn:parameter name="PLANNING" opaque="true" disabled="true">
+    <crn:value>
+      <!-- analystMaxSize: Specifies how much memory the APL interpreter can use.  -->
+      <!-- Enter a value between 64000 and 2000000. Memory is allocated as it is needed, but
+           only up to this limit. Once allocated, the memory will not be available for other
+           applications while Analyst is running.  -->
+      <crn:parameter name="analystMaxSize" disabled="true">
+        <crn:value xsi:type="xsd:int">64000</crn:value>
+      </crn:parameter>
+      <!-- BIInstallLocation: Specifies the path to the IBM Cognos Business Intelligence installation.  -->
+      <!-- This path is specified when IBM Cognos BI is installed. This property is used by
+           Planning components that require an IBM Cognos BI installation.  -->
+      <crn:parameter name="BIInstallLocation" disabled="true">
+        <crn:value xsi:type="cfg:folderPath"></crn:value>
+      </crn:parameter>
+      <!-- PlanningServer: Defines a group of properties for planning server.  -->
+      <crn:parameter name="PlanningServer" opaque="true" disabled="true">
+        <crn:value>
+          <!-- PlanningWindowServiceListeningPort: Specifies the port the product uses to listen
+               for commands on.  -->
+          <crn:parameter name="PlanningWindowServiceListeningPort" disabled="true">
+            <crn:value xsi:type="xsd:unsignedShort">9900</crn:value>
+          </crn:parameter>
+          <!-- PlanningWindowServiceShutdownPort: Specifies the port the product uses to listen
+               for a shut down command.  -->
+          <crn:parameter name="PlanningWindowServiceShutdownPort" disabled="true">
+            <crn:value xsi:type="xsd:unsignedShort">9901</crn:value>
+          </crn:parameter>
+          <!-- OracleODBCDriver: Specifies which ODBC driver to use to connect to the Contributor
+               publish data store.  -->
+          <!-- On certain installs, the ODBC driver name for Oracle is not a default value, or more
+               than one driver could be installed. Used by the client extension and PPES admin extension.  -->
+          <crn:parameter name="OracleODBCDriver" disabled="true">
+            <crn:value xsi:type="xsd:string"></crn:value>
+          </crn:parameter>
+        </crn:value>
+      </crn:parameter>
+    </crn:value>
+  </crn:parameter>
+  <!-- AAA: Defines general properties related to authentication that apply to all users.  -->
+  <!-- Use this group of properties to set the security environment that all users share,
+       regardless of user identity or role, or authentication provider.  -->
+  <crn:parameter name="AAA" opaque="true">
+    <crn:value>
+      <!-- inactivityTimeout: Specifies the maximum number of seconds that a user's session
+           can remain inactive before they must re-authenticate.  -->
+      <!-- Use this property to automatically log off the user after a set period of inactivity.
+           Ensure that the period is appropriate for both security and convenience considerations.  -->
+      <crn:parameter name="inactivityTimeout">
+        <crn:value xsi:type="xsd:positiveInteger">3600</crn:value>
+      </crn:parameter>
+      <!-- allowSessionSharing: Specifies whether a client application can share session information
+           with another client on the same machine.  -->
+      <!-- To establish a single signon between multiple clients on the same machine, session
+           information must be shared between the applications. However, for security reasons
+           it may not be desirable to allow single signon. This parameter has no impact on integrated
+           windows authentication.  -->
+      <crn:parameter name="allowSessionSharing">
+        <crn:value xsi:type="xsd:boolean">false</crn:value>
+      </crn:parameter>
+      <!-- restrictAccessToCRN: This parameter allows administrators to restrict user access
+           to the application.  -->
+      <!-- When this parameter is enabled, users can only access the application if they belong
+           to at least one group or role within the built-in namespace (does not include the
+           group "All Authenticated Users").  -->
+      <crn:parameter name="restrictAccessToCRN">
+        <crn:value xsi:type="xsd:boolean">false</crn:value>
+      </crn:parameter>
+      <!-- renewTCFlag: Specifies whether the user's trusted credential is automatically renewed
+           after logging on.  -->
+      <!-- You can set this property off, set it to the primary namespace only, or set it to
+           all namespaces.  -->
+      <crn:parameter name="renewTCFlag">
+        <crn:value xsi:type="xsd:string">primaryNamespace</crn:value>
+      </crn:parameter>
+      <!-- advancedProperties: Specifies a set of advanced properties.  -->
+      <!-- The user needs to provide the name and the value for each advanced property.  -->
+      <crn:parameter name="advancedProperties" opaque="true">
+        <crn:value xsi:type="cfg:array"/>
+      </crn:parameter>
+      <!-- tenantIdMapping: Specifies how namespace users are mapped to tenant IDs.  -->
+      <!-- Specifying a value for this parameter enables multitenancy. The tenant ID for a user
+           can be determined using a pattern or a tenant provider class. The pattern is a AAA
+           service search path to a property which defines a tenant ID. The search path must
+           be relative to a user account. For example: '~/ancestors[2]/defaultName'. A tenant
+           provider class is Java class which implements the the ITenantProvider interface.
+           For more details please consult the installation and configuration guide.  -->
+      <crn:parameter name="tenantIdMapping" opaque="true">
+        <crn:value xsi:type="cfg:tenancyInfo">
+          <crn:item name="pattern" xsi:type="xsd:string"></crn:item>
+        </crn:value>
+      </crn:parameter>
+      <!-- tenantBoundingSetMapping: Specifies how the tenant bounding set is determined for
+           a user.  -->
+      <!-- This parameter is used when multitenancy is enabled. The tenant bounding set for
+           a user can be determined using a pattern or a tenant bounding set provider class.
+           The pattern is a AAA service search path to a property which defines a tenant bounding
+           set. The search path must be relative to a user account. For example: '˜/parameters/boundingSet'.
+           A tenant bounding set provider class is Java class which implements the the IBoundingSetProvider
+           interface. For more details please consult the installation and configuration guide.  -->
+      <crn:parameter name="tenantBoundingSetMapping" opaque="true">
+        <crn:value xsi:type="cfg:tenancyInfo">
+          <crn:item name="pattern" xsi:type="xsd:string"></crn:item>
+        </crn:value>
+      </crn:parameter>
+      <!-- authProvider: Specifies the type of security used for authenticating users.  -->
+      <!-- You cannot change the value of this property. It is automatically set when you choose
+           the namespace type in the Explorer window.  -->
+      <crn:instances name="authProvider">
+
+        <!-- Cognos: Defines a group of properties related to authentication that applies to all
+             users.  -->
+        <!-- Use this group of properties to control access to resources based on user identity.
+             Do not delete the namespace, or you will not be able to save your configuration.
+             To restore the namespace, right-click Authentication, click New, Namespace Type,
+             select the Cognos Namespace from the list of available types and specify a name.  -->
+        <crn:instance name="Cognos" class="Cognos">
+          <!-- allowAnon: Specifies whether anonymous access is allowed.  -->
+          <!-- By default, anonymous authentication process doesn't require the user to provide
+               logon credentials. The anonymous authentication uses a pre-defined account under
+               which all anonymous users are logged in.  -->
+          <crn:parameter name="allowAnon">
+            <crn:value xsi:type="xsd:boolean">true</crn:value>
+          </crn:parameter>
+          <crn:parameter name="disableCM">
+            <crn:value xsi:type="xsd:boolean">false</crn:value>
+          </crn:parameter>
+        </crn:instance>
+      </crn:instances>
+    </crn:value>
+  </crn:parameter>
+  <!-- CRYPTO: Defines a group of properties that enables secure communication between the
+       product components and data encryption.  -->
+  <!-- To use a cryptographic provider that already exists in your environment, you must
+       delete the default provider. You can only use one cryptographic provider at a time.
+       Right-click Cryptography, click New and then click Provider to use a different cryptographic
+       provider. After you select the provider, you can use this group of properties to
+       protect the information in your system from unauthorized access.  -->
+  <crn:parameter name="CRYPTO" opaque="true">
+    <crn:value>
+      <!-- cryptoStandardConformance: Specifies the cryptographic standard that IBM Cognos should
+           enforce.  -->
+      <!-- Use this property to specify what cryptographic standard should be enforced in this
+           install. This parameter may cause the save operation to fail if other parameters
+           are changed to values not allowed in the selected standard.  -->
+      <crn:parameter name="cryptoStandardConformance">
+        <crn:value xsi:type="xsd:string">IBM_Cognos</crn:value>
+      </crn:parameter>
+      <!-- localCSK: Specifies whether the common symmetric key can be stored on the local computer.  -->
+      <!-- If this value is set to false, then the Common Symmetric Key (CSK) is not stored
+           locally. In this case, each cryptographic operation requiring the CSK must fetch
+           it from the server.  -->
+      <crn:parameter name="localCSK">
+        <crn:value xsi:type="xsd:boolean">true</crn:value>
+      </crn:parameter>
+      <!-- CSKPath: Specifies the location of the common symmetric key store database.  -->
+      <!-- For distributed installations, set this property to point to the computer where you
+           created the key store. The key store is in a global location to provide access from
+           different computers.  -->
+      <crn:parameter name="CSKPath">
+        <crn:value xsi:type="cfg:folderPath">../configuration/csk</crn:value>
+      </crn:parameter>
+      <!-- CSKPathPassword: Specifies the password used to protect the common symmetric key
+           store database.  -->
+      <!-- This password provides an additional level of security not available when storing
+           keys in files. By default, this password is immediately encrypted when you save your
+           configuration.  -->
+      <crn:parameter name="CSKPathPassword">
+        <crn:value xsi:type="cfg:systemPassword"></crn:value>
+      </crn:parameter>
+      <!-- CSKLifetime: For servers running Content Manager, specifies the maximum number of
+           days that the CSK is valid.  -->
+      <!-- The validity period that you set for the CSK depends on a number of factors, such
+           as the sensitivity of your data.  -->
+      <crn:parameter name="CSKLifetime">
+        <crn:value xsi:type="xsd:long">365</crn:value>
+      </crn:parameter>
+      <!-- SSLMutualAuthentication: Specifies whether mutual authentication is required.  -->
+      <!-- Set the value of this property to 'true' if both components or computers involved
+           in the communication must prove their identity. Mutual authentication is carried
+           out by using certificates, which are exchanged by the communicating components at
+           the time they initiate connections.  -->
+      <crn:parameter name="SSLMutualAuthentication">
+        <crn:value xsi:type="xsd:boolean">false</crn:value>
+      </crn:parameter>
+      <!-- SSLConfidentiality: Specifies whether to use encryption to ensure confidentiality
+           of all transmitted information.  -->
+      <!-- If the value of this property is set to 'false', information that is transmitted
+           will not be encrypted.  -->
+      <crn:parameter name="SSLConfidentiality">
+        <crn:value xsi:type="xsd:boolean">true</crn:value>
+      </crn:parameter>
+      <!-- digestAlgorithm: Specifies the digest algorithm.  -->
+      <!-- Use this property to specify the message digest algorithm that is used when hashing
+           data.  -->
+      <crn:parameter name="digestAlgorithm">
+        <crn:value xsi:type="xsd:string">SHA-256</crn:value>
+      </crn:parameter>
+      <!-- signingKeyPairAlgorithm: Specifies the signing key pair algorithm.  -->
+      <!-- Use this property to specify the algorithm that is used when signing data.  -->
+      <crn:parameter name="signingKeyPairAlgorithm">
+        <crn:value xsi:type="xsd:string">RSA</crn:value>
+      </crn:parameter>
+      <!-- cryptoProvider: Specifies the cryptographic provider used by the product.  -->
+      <!-- The value of this property is set when you select the cryptographic provider from
+           the list of available types. You cannot change the value of this property.  -->
+      <crn:instances name="cryptoProvider">
+        <!-- Cognos: Defines a group of properties for the Cognos cryptographic provider.  -->
+        <!-- Configure these properties to set the encryption services and CA service for all
+             components accessing a single content store.  -->
+        <crn:instance name="Cognos" class="CognosCrypto">
+          <!-- certificateLocation: Specifies the location of trusted certificates.  -->
+          <crn:parameter name="certificateLocation">
+            <crn:value xsi:type="cfg:folderPath">../configuration/certs</crn:value>
+          </crn:parameter>
+          <!-- cognosCryptoConfidentialityAlgorithm: Specify the confidentiality algorithm.  -->
+          <!-- Use this property to specify the encryption algorithm when transmitting information.  -->
+          <crn:parameter name="cognosCryptoConfidentialityAlgorithm">
+            <crn:value xsi:type="xsd:string">AES</crn:value>
+          </crn:parameter>
+          <!-- cognosPDFConfidentialityAlgorithm: Specify the PDF confidentiality algorithm.  -->
+          <!-- Use this property to specify the encryption algorithm when encrypting PDF data.  -->
+          <crn:parameter name="cognosPDFConfidentialityAlgorithm">
+            <crn:value xsi:type="xsd:string">AES</crn:value>
+          </crn:parameter>
+          <!-- cognosCryptoCiphersuite: Specifies a list of supported ciphersuites in priority sequence.  -->
+          <!-- Use this property to specify what ciphersuites are acceptable in this install. The
+               selected ciphersuites are then presented to the SSL negotiation in priority sequence
+               for both client and server sides of the negotiation. At least one of the selected
+               ciphersuites between configured client and server platforms must match.  -->
+          <crn:parameter name="cognosCryptoCiphersuite" opaque="true">
+            <crn:value xsi:type="cfg:sortedArray">
+              <crn:item xsi:type="xsd:string" order="1">RSA-RSA-AES(128)CBC-SHA</crn:item>
+              <crn:item xsi:type="xsd:string" order="3">RSA-RSA-DES(168)CBC3-SHA</crn:item>
+            </crn:value>
+          </crn:parameter>
+          <!-- keystoreFilePassword: Specifies the password used to protect the key store.  -->
+          <!-- This password is required to secure the IBM Cognos keystore. It provides an extra
+               layer of security by encrypting the keystore file using a password.  -->
+          <crn:parameter name="keystoreFilePassword">
+            <crn:value xsi:type="cfg:systemPassword">NoPassWordSet</crn:value>
+          </crn:parameter>
+          <!-- serverCommonName: Specifies the common name (CN) portion of the distinguished name
+               (DN) for this computer.  -->
+          <!-- An example of a common name is the host name of the computer.  -->
+          <crn:parameter name="serverCommonName">
+            <crn:value xsi:type="xsd:string">CAMUSER</crn:value>
+          </crn:parameter>
+          <!-- distinguishedNameOrganization: Specifies the organization name (O) used in the distinguished
+               name (DN).  -->
+          <!-- An example of an organization is MyCompany.  -->
+          <crn:parameter name="distinguishedNameOrganization">
+            <crn:value xsi:type="xsd:string">Cognos</crn:value>
+          </crn:parameter>
+          <!-- distinguishedNameCountry: Specifies the two-letter country or region code used in
+               the distinguished name (DN).  -->
+          <!-- For example, the code for Japan is JP.  -->
+          <crn:parameter name="distinguishedNameCountry">
+            <crn:value xsi:type="xsd:string">CA</crn:value>
+          </crn:parameter>
+          <!-- thirdPartyCA: Specifies whether to use an external Certificate Authority.  -->
+          <!-- If this value is set to true, the IBM Cognos Certificate Authority service is not
+               used. A third party Certificate Authority will manually process certificate requests.  -->
+          <crn:parameter name="thirdPartyCA">
+            <crn:value xsi:type="xsd:boolean">false</crn:value>
+          </crn:parameter>
+          <!-- certificateAuthorityServiceCommonName: Specifies the common name (CN) portion of
+               the distinguished name (DN) for the Certificate Authority service computer.  -->
+          <!-- An example of a common name is the host name of the computer. Do not use localhost.  -->
+          <crn:parameter name="certificateAuthorityServiceCommonName">
+            <crn:value xsi:type="xsd:string">CA</crn:value>
+          </crn:parameter>
+          <!-- certificateAuthorityServicePassword: Specifies the password used to validate certificate
+               requests sent to the Certificate Authority service.  -->
+          <!-- This property must be the same for clients using the Certificate Authority and the
+               Certificate Authority service itself. For example, the password you specify for IBM
+               Cognos installations that do not have Content Manager must match the password you
+               specify for the installation that has Content Manager. The Certificate Authority
+               service is installed with the Content Manager. By default, this password is immediately
+               encrypted when you save your configuration.  -->
+          <crn:parameter name="certificateAuthorityServicePassword">
+            <crn:value xsi:type="cfg:systemPassword"></crn:value>
+          </crn:parameter>
+          <!-- certificateAuthorityServiceCertificateLifetime: Specifies the maximum number of days
+               that a certificate signed by the Certificate Authority service is valid.  -->
+          <!-- The validity period that you set for certificates depends on a number of factors,
+               such as the strength of the private key used to sign the certificate.  -->
+          <crn:parameter name="certificateAuthorityServiceCertificateLifetime">
+            <crn:value xsi:type="xsd:long">730</crn:value>
+          </crn:parameter>
+        </crn:instance>
+      </crn:instances>
+    </crn:value>
+  </crn:parameter>
+  <!-- Replication: Defines general properties related to replication of user session data.  -->
+  <!-- Use this group of properties to set the settings for IBM Cognos authentication services
+       to enable user session replication.  -->
+  <crn:parameter name="Replication" opaque="true">
+    <crn:value>
+      <!-- pdcEnableReplication: Specifies whether user session replcation is enabled.  -->
+      <!-- Use this property to enable or disable user session data replication across authentication
+           services.  -->
+      <crn:parameter name="pdcEnableReplication">
+        <crn:value xsi:type="xsd:boolean">true</crn:value>
+      </crn:parameter>
+      <!-- pdcPeerPort: Specifies the port used for peer discovery.  -->
+      <!-- A value of 0 means that the server will select an available port automatically. When
+           a value other than 0 is specified, ensure that you specify a port that is not already
+           in use. The port communication uses mutually authenticated SSL/TLS protocol.  -->
+      <crn:parameter name="pdcPeerPort">
+        <crn:value xsi:type="xsd:unsignedShort">0</crn:value>
+      </crn:parameter>
+      <!-- pdcRMIPort: Specifies the port used for RMI communication.  -->
+      <!-- A value of 0 means that the server will select an available port automatically. The
+           RMI port is the communication port used by the Java Remote Method Invocation API.
+           When a value other than 0 is specified, ensure that you specify a port that is not
+           already in use. The port communication uses mutually authenticated SSL/TLS protocol.  -->
+      <crn:parameter name="pdcRMIPort">
+        <crn:value xsi:type="xsd:unsignedShort">0</crn:value>
+      </crn:parameter>
+      <!-- advancedProperties: Specifies a set of advanced properties.  -->
+      <!-- The user needs to provide the name and the value for each advanced property.  -->
+      <crn:parameter name="advancedProperties" opaque="true">
+        <crn:value xsi:type="cfg:array"/>
+      </crn:parameter>
+    </crn:value>
+  </crn:parameter>
+  <!-- CAF: Defines a group of properties to configure the IBM Cognos Application Firewall.  -->
+  <!-- The IBM Cognos Application Firewall is an essential component of product security
+       helping to provide protection against penetration vulnerabilities. Disabling the
+       IBM Cognos Application Firewall will remove this protection; therefore, this should
+       not be done under normal circumstances.  -->
+  <crn:parameter name="CAF" opaque="true">
+    <crn:value>
+      <!-- caf_enabled: Specifies whether to enable IBM Cognos Application Firewall validation.  -->
+      <!-- The IBM Cognos Application Firewall is an essential component of product security
+           helping to provide protection against penetration vulnerabilities. Disabling the
+           IBM Cognos Application Firewall will remove this protection; therefore, this should
+           not be done under normal circumstances. In addition, if third party XSS checking
+           is enabled, CAF validation must also be enabled.  -->
+      <crn:parameter name="caf_enabled">
+        <crn:value xsi:type="xsd:boolean">true</crn:value>
+      </crn:parameter>
+      <!-- caf_validDomainList: Specifies valid domain and/or host name values for your configuration.  -->
+      <!-- The IBM Cognos Application Firewall will validate hostname and domain names used
+           or passed in a request. You may add additional host names or domain names to support
+           your configuration and system topology. For example, add .mycompany.com to allow
+           the domains from mycompany.com. You may also allow a domain and all its sub-domains
+           by adding a wildcard at the beginning of the domain such as, *.mycompany.com.  -->
+      <crn:parameter name="caf_validDomainList" opaque="true">
+        <crn:value xsi:type="cfg:array"/>
+      </crn:parameter>
+      <!-- caf_tpXSSCheckingUsed: Specifies whether CAF support for third party cross site scripting
+           checking is enabled.  -->
+      <!-- Enables CAF to support third party cross site scripting checking by encoding requests
+           to prevent discouraged characters from being rejected by the third party checking.
+           Enable this property if you have a tool that is performing XSS of GET requests. You
+           can only enable this property when CAF validation is also enabled. By default, the
+           third party XSS characters <, ' and > will be encoded.  -->
+      <crn:parameter name="caf_tpXSSCheckingUsed">
+        <crn:value xsi:type="xsd:string">false</crn:value>
+      </crn:parameter>
+    </crn:value>
+  </crn:parameter>
+  <!-- tm1Server: Defines a group of properties for the TM1 Server.  -->
+  <crn:parameter name="tm1Server" opaque="true" disabled="true">
+    <crn:value>
+      <crn:instances name="tm1ServerInstances" disabled="true">
+        <!-- SData: Defines a group of properties for a TM1 Server instance.  -->
+        <crn:instance name="SData" class="tm1ServerInstance" disabled="true">
+          <!-- tm1sConfigDirectory: Specifies the path to the TM1 configuration file.  -->
+          <!-- The TM1 Server configuration file is tm1s.cfg. It contains configuration settings
+               such as DataDirectory and ServerName. This path can be absolute or relative to the
+               IBM Cognos installation's bin directory or bin64 directory in 64-bit installations
+               (e.g. C:\Program Files\IBM\Cognos\TM1\bin).  -->
+          <crn:parameter name="tm1sConfigDirectory" disabled="true">
+            <crn:value xsi:type="cfg:folderPath">../samples/tm1/SData</crn:value>
+          </crn:parameter>
+        </crn:instance>
+        <!-- Planning Sample: Defines a group of properties for a TM1 Server instance.  -->
+        <crn:instance name="Planning Sample" class="tm1ServerInstance" disabled="true">
+          <!-- tm1sConfigDirectory: Specifies the path to the TM1 configuration file.  -->
+          <!-- The TM1 Server configuration file is tm1s.cfg. It contains configuration settings
+               such as DataDirectory and ServerName. This path can be absolute or relative to the
+               IBM Cognos installation's bin directory or bin64 directory in 64-bit installations
+               (e.g. C:\Program Files\IBM\Cognos\TM1\bin).  -->
+          <crn:parameter name="tm1sConfigDirectory" disabled="true">
+            <crn:value xsi:type="cfg:folderPath">../samples/tm1/PlanSamp</crn:value>
+          </crn:parameter>
+        </crn:instance>
+        <!-- GO_New_Stores: Defines a group of properties for a TM1 Server instance.  -->
+        <crn:instance name="GO_New_Stores" class="tm1ServerInstance" disabled="true">
+          <!-- tm1sConfigDirectory: Specifies the path to the TM1 configuration file.  -->
+          <!-- The TM1 Server configuration file is tm1s.cfg. It contains configuration settings
+               such as DataDirectory and ServerName. This path can be absolute or relative to the
+               IBM Cognos installation's bin directory or bin64 directory in 64-bit installations
+               (e.g. C:\Program Files\IBM\Cognos\TM1\bin).  -->
+          <crn:parameter name="tm1sConfigDirectory" disabled="true">
+            <crn:value xsi:type="cfg:folderPath">../samples/tm1/GO_New_Stores</crn:value>
+          </crn:parameter>
+        </crn:instance>
+        <!-- GO_Scorecards: Defines a group of properties for a TM1 Server instance.  -->
+        <crn:instance name="GO_Scorecards" class="tm1ServerInstance" disabled="true">
+          <!-- tm1sConfigDirectory: Specifies the path to the TM1 configuration file.  -->
+          <!-- The TM1 Server configuration file is tm1s.cfg. It contains configuration settings
+               such as DataDirectory and ServerName. This path can be absolute or relative to the
+               IBM Cognos installation's bin directory or bin64 directory in 64-bit installations
+               (e.g. C:\Program Files\IBM\Cognos\TM1\bin).  -->
+          <crn:parameter name="tm1sConfigDirectory" disabled="true">
+            <crn:value xsi:type="cfg:folderPath">../samples/tm1/GO_scorecards</crn:value>
+          </crn:parameter>
+        </crn:instance>
+        <!-- Proven_Techniques: Defines a group of properties for a TM1 Server instance.  -->
+        <crn:instance name="Proven_Techniques" class="tm1ServerInstance" disabled="true">
+          <!-- tm1sConfigDirectory: Specifies the path to the TM1 configuration file.  -->
+          <!-- The TM1 Server configuration file is tm1s.cfg. It contains configuration settings
+               such as DataDirectory and ServerName. This path can be absolute or relative to the
+               IBM Cognos installation's bin directory or bin64 directory in 64-bit installations
+               (e.g. C:\Program Files\IBM\Cognos\TM1\bin).  -->
+          <crn:parameter name="tm1sConfigDirectory" disabled="true">
+            <crn:value xsi:type="cfg:folderPath">../samples/tm1/Proven_Techniques</crn:value>
+          </crn:parameter>
+        </crn:instance>
+      </crn:instances>
+    </crn:value>
+  </crn:parameter>
+  <!-- mdmDB: Business Viewpoint Repository properties.  -->
+  <crn:parameter name="mdmDB" opaque="true" disabled="true">
+    <crn:value>
+      <!-- mdm_database: Specifies the database type for the Business Viewpoint repository.  -->
+      <!-- You cannot change the value of this property. It is automatically set when you choose
+           the database type for the repository in the Explorer window.  -->
+      <crn:instances name="mdm_database" disabled="true">
+        <!-- Database: Defines a group of properties used to locate an existing DB2 database.  -->
+        <!-- Ensure that the database already exists.  -->
+        <crn:instance name="Database" class="DB2" disabled="true">
+          <!-- server: Specifies the name or TCP/IP address of the database computer.  -->
+          <!-- When a value is specified, database connections are made directly to the database
+               (type 4). When the value is left blank, database connections are made through the
+               database client (type 2).  -->
+          <crn:parameter name="server" disabled="true">
+            <crn:value xsi:type="cfg:hostPort"></crn:value>
+          </crn:parameter>
+          <!-- user: Specifies the user ID and password that the product uses to connect to the
+               content store.  -->
+          <!-- This value identifies the database user who has unrestricted access to the database.
+               The product uses this account to access the content store. To secure the logon credentials,
+               you can encrypt the database logon information immediately by saving your configuration.  -->
+          <crn:parameter name="user" disabled="true">
+            <crn:value xsi:type="cfg:credential">
+              <credential>
+                <username/>
+                <password/>
+              </credential>
+            </crn:value>
+          </crn:parameter>
+          <!-- name: Specifies the name of the DB2 database.  -->
+          <!-- Enter the name of the database. The name is set when you create the database. Ensure
+               that the value for this property corresponds to the name of the database you created.
+               Otherwise, the product will not run.  -->
+          <crn:parameter name="name" disabled="true">
+            <crn:value xsi:type="xsd:string">bv</crn:value>
+          </crn:parameter>
+        </crn:instance>
+      </crn:instances>
+    </crn:value>
+  </crn:parameter>
+  <!-- mdmNotification: Defines a group of properties that provides access to a mail server
+       account.  -->
+  <!-- Use this group of properties to configure an account from which all notifications
+       are sent.  -->
+  <crn:parameter name="mdmNotification" opaque="true" disabled="true">
+    <crn:value>
+      <!-- smtpMailServer: Specifies the host name and port of the mail server computer.  -->
+      <!-- Use the following syntax to specify the location of the mail server: host:port. The
+           default SMTP port on most mail servers is 25.  -->
+      <crn:parameter name="smtpMailServer" disabled="true">
+        <crn:value xsi:type="cfg:hostPort">mailserver:25</crn:value>
+      </crn:parameter>
+      <!-- SmtpAccount: Specifies the user id and password to log on to the mail server.  -->
+      <!-- If the mail server requires authentication to send messages, enter a valid user id
+           and password. If the mail server does not require authentication, leave these values
+           empty.  -->
+      <crn:parameter name="SmtpAccount" disabled="true">
+        <crn:value xsi:type="cfg:credential">
+          <credential>
+            <username/>
+            <password/>
+          </credential>
+        </crn:value>
+      </crn:parameter>
+      <!-- DefaultSender: Specifies the email address of the sender.  -->
+      <!-- This setting specifies the email address of the 'sender' of outgoing messages. Use
+           a valid email address.  -->
+      <crn:parameter name="DefaultSender" disabled="true">
+        <crn:value xsi:type="xsd:string">user@mail</crn:value>
+      </crn:parameter>
+      <!-- defaultReplyTo: Specifies the email address for Reply-To.  -->
+      <!-- This setting specifies the email address of the 'Reply-To' of outgoing messages.
+           Use a valid email address.  -->
+      <crn:parameter name="defaultReplyTo" disabled="true">
+        <crn:value xsi:type="xsd:string">user@mail</crn:value>
+      </crn:parameter>
+    </crn:value>
+  </crn:parameter>
+  <!-- CM: Defines a component that manages content and security policies.  -->
+  <!-- Content Manager must be able to connect to an external database that stores content.  -->
+  <crn:parameter name="CM" opaque="true">
+    <crn:value>
+      <!-- outputCMReportToFile: Specifies whether to save report outputs to a file system through
+           the Content Manager Advanced Setting (i.e. CM.OUTPUTLOCATION).  -->
+      <!-- Use this flag to enable/disable the feature to save report outputs to a file system
+           by Content Manager Service. Please note that this feature is completely different
+           than the new report run option to archive a report output to a file system by Delivery
+           Service. Report output formats that you can save include: PDF, CSV, XML, Excel 2002,
+           and HTML which do not have embedded graphics. Report outputs that you cannot save
+           include: HTML fragment, XHTML, or Excel 2000 single sheet formats.  -->
+      <crn:parameter name="outputCMReportToFile">
+        <crn:value xsi:type="xsd:boolean">false</crn:value>
+      </crn:parameter>
+      <!-- advancedProperties: Specifies a set of advanced properties.  -->
+      <!-- The user needs to provide the name and the value for each advanced property.  -->
+      <crn:parameter name="advancedProperties" opaque="true">
+        <crn:value xsi:type="cfg:array"/>
+      </crn:parameter>
+      <!-- database: Specifies the database type for the content store.  -->
+      <!-- You cannot change the value of this property. It is automatically set when you choose
+           the database type for the content store in the Explorer window.  -->
+      <crn:instances name="database">
+        <!-- Content Store: Defines a group of properties used to locate an existing DB2 database.  -->
+        <!-- Ensure that the database already exists.  -->
+        <crn:instance name="Content Store" class="DB2">
+          <!-- server: Specifies the name or TCP/IP address of the database computer.  -->
+          <!-- When a value is specified, database connections are made directly to the database
+               (type 4). When the value is left blank, database connections are made through the
+               database client (type 2).  -->
+          <crn:parameter name="server">
+            <crn:value xsi:type="cfg:hostPort">localhost:50000</crn:value>
+          </crn:parameter>
+          <!-- user: Specifies the user ID and password that the product uses to connect to the
+               content store.  -->
+          <!-- This value identifies the database user who has unrestricted access to the database.
+               The product uses this account to access the content store. To secure the logon credentials,
+               you can encrypt the database logon information immediately by saving your configuration.  -->
+          <crn:parameter name="user">
+            <crn:value xsi:type="cfg:credential" encrypted="false">
+              <credential>
+                <username><%= scope['cognos::cognos_db_user'] %></username>
+                <password><%= scope['cognos::cognos_db_user_password'] %></password>
+              </credential>
+            </crn:value>
+          </crn:parameter>
+          <!-- name: Specifies the name of the DB2 database.  -->
+          <!-- Enter the name of the database.  -->
+          <crn:parameter name="name">
+            <crn:value xsi:type="xsd:string">cm</crn:value>
+          </crn:parameter>
+          <!-- SSLencryptionEnabled: Specifies whether database connection should use SSL encryption.  -->
+          <!-- Use this property to enable SSL encryption of the database connection.  -->
+          <crn:parameter name="SSLencryptionEnabled">
+            <crn:value xsi:type="xsd:boolean">false</crn:value>
+          </crn:parameter>
+        </crn:instance>
+      </crn:instances>
+    </crn:value>
+  </crn:parameter>
+  <!-- MOB: Defines a group of properties used to connect to the mobile database.  -->
+  <!-- Use these properties to specify the type of database for Mobile and the connection
+       information required to access it. Mobile supports DB2, SQL Server and Oracle. To
+       do this, right-click Mobile, click New resource, Database, select the database type
+       and then configure the resource properties.  -->
+  <crn:parameter name="MOB" opaque="true">
+    <crn:value/>
+  </crn:parameter>
+  <!-- NC: Defines a group of properties that provides access to a mail server account or
+       to IBM Cognos content.  -->
+  <!-- Use this group of properties to configure an account from which all notifications
+       are sent. The Notification component also requires access to a database that will
+       be used to store Notification content. This means that in a distributed installation
+       all Notification components must point to the same database. To do this, right-click
+       Notification, click New, Database and then type a name and select the database type.
+       If the Notification component is on the same computer as Content Manager, you are
+       not required to configure a database resource for the Notification component.  -->
+  <crn:parameter name="NC" opaque="true">
+    <crn:value>
+      <!-- smtpMailServer: Specifies the host name and port of the mail server computer.  -->
+      <!-- Use the following syntax to specify the location of the mail server: host:port. The
+           default SMTP port on most mail servers is 25.  -->
+      <crn:parameter name="smtpMailServer">
+        <crn:value xsi:type="cfg:hostPort">mailserver:25</crn:value>
+      </crn:parameter>
+      <!-- smtpAccount: Specifies the user id and password to log on to the mail server.  -->
+      <!-- If the mail server requires authentication to send messages, enter a valid user id
+           and password. If the mail server does not require authentication, leave these values
+           empty.  -->
+      <crn:parameter name="smtpAccount">
+        <crn:value xsi:type="cfg:credential">
+          <credential>
+            <username>nc_user</username>
+            <password>nc_password</password>
+          </credential>
+        </crn:value>
+      </crn:parameter>
+      <!-- defaultSender: Specifies the email address of the sender.  -->
+      <!-- This setting specifies the email address of the 'sender' of outgoing messages. Use
+           a valid email address.  -->
+      <crn:parameter name="defaultSender">
+        <crn:value xsi:type="xsd:string">notifications@cognos.ibm.com</crn:value>
+      </crn:parameter>
+      <!-- SSLencryptionEnabled: Specifies whether mail server connection should use SSL encryption.  -->
+      <!-- Use this property to enable SSL encryption for mail server connection.  -->
+      <crn:parameter name="SSLencryptionEnabled">
+        <crn:value xsi:type="xsd:boolean">false</crn:value>
+      </crn:parameter>
+    </crn:value>
+  </crn:parameter>
+  <!-- HTS: Defines a group of properties that provides access to Human Task and Annotation
+       Services content.  -->
+  <!-- Use this group of properties to configure the access to the database that will be
+       used to store Human Task and Annotation Services content.  -->
+  <crn:parameter name="HTS" opaque="true">
+    <crn:value/>
+  </crn:parameter>
+  <!-- PLACDS: Defines a group of properties that provide access to IBM Cognos Planning
+       content.  -->
+  <!-- Use this group of properties to configure the access to Planning Contributor Data
+       Server and Planning content store. A database resource component that points to the
+       Planning Store is required when the planning server is installed. If the planning
+       server component is installed on the same computer as Content Manager, the database
+       resource can point to the same database that's used for Content Manager.  -->
+  <crn:parameter name="PLACDS" opaque="true">
+    <crn:value>
+      <!-- ContributorDataServer: Defines the properties for the Planning Contributor Data Server.  -->
+      <crn:parameter name="ContributorDataServer" opaque="true">
+        <crn:value>
+          <!-- PLACDS_sharedSecret: Specifies the password that enables secure communication between
+               IBM Cognos servers and Contributor Data Server for scheduled reports and agents.  -->
+          <!-- The password is case-sensitive and must match the Signature password property that
+               you configure in IBM Cognos Series 7, Configuration Manager, IBM Cognos Planning
+               / IBM Cognos - Contributor Data Server / General properties.  -->
+          <crn:parameter name="PLACDS_sharedSecret">
+            <crn:value xsi:type="cfg:systemPassword">NoPassWordSet</crn:value>
+          </crn:parameter>
+        </crn:value>
+      </crn:parameter>
+      <!-- pla_database: Specifies the database type for the content store.  -->
+      <!-- You cannot change the value of this property. It is automatically set when you choose
+           the database type for the content store in the Explorer window.  -->
+      <crn:instances name="pla_database" disabled="true">
+        <!-- Planning Store: Defines a group of properties used to locate an existing DB2 database.  -->
+        <!-- Ensure that the database already exists.  -->
+        <crn:instance name="Planning Store" class="DB2" disabled="true">
+          <!-- server: Specifies the name or TCP/IP address of the database computer.  -->
+          <!-- When a value is specified, database connections are made directly to the database
+               (type 4). When the value is left blank, database connections are made through the
+               database client (type 2).  -->
+          <crn:parameter name="server">
+            <crn:value xsi:type="cfg:hostPort"></crn:value>
+          </crn:parameter>
+          <!-- user: Specifies the user ID and password that the product uses to connect to the
+               Planning database.  -->
+          <!-- This value identifies the database user who has unrestricted access to the database.
+               The product uses this account to access the content store. To secure the logon credentials,
+               you can encrypt the database logon information immediately by saving your configuration.  -->
+          <crn:parameter name="user">
+            <crn:value xsi:type="cfg:credential">
+              <credential>
+                <username/>
+                <password/>
+              </credential>
+            </crn:value>
+          </crn:parameter>
+          <!-- name: Specifies the name of the database used as the content store.  -->
+          <!-- Enter the name of the database. The name is set when you create the database. Ensure
+               that the value for this property corresponds to the name of the database you created.
+               Otherwise, the product will not run.  -->
+          <crn:parameter name="name">
+            <crn:value xsi:type="xsd:string">ps</crn:value>
+          </crn:parameter>
+          <!-- SSLencryptionEnabled: Specifies whether database connection should use SSL encryption.  -->
+          <!-- Use this property to enable SSL encryption of the database connection.  -->
+          <crn:parameter name="SSLencryptionEnabled">
+            <crn:value xsi:type="xsd:boolean">false</crn:value>
+          </crn:parameter>
+        </crn:instance>
+      </crn:instances>
+    </crn:value>
+  </crn:parameter>
+</crn:parameters>
diff --git a/templates/cognos_11.rsp.erb b/templates/cognos_11.rsp.erb
new file mode 100644
index 0000000..43db8b3
--- /dev/null
+++ b/templates/cognos_11.rsp.erb
@@ -0,0 +1,8 @@
+BISRVR_CA_INSTALL=1
+BISRVR_CA_TOOLS_INSTALL=0
+USER_INSTALL_DIR=<%= scope['cognos::installer_target_dir'] %>
+BISRVR_CUSTOM_FIRST=1
+BISRVR_CUSTOM_EXPAND=0
+BISRVR_FEATURE_APPTIER=<%= scope['install_app_tier_int'] %>
+BISRVR_FEATURE_GATEWAY=<%= scope['install_gateway_int'] %>
+BISRVR_FEATURE_SAMPLES=1
diff --git a/templates/create_cognos_db.sql.erb b/templates/create_cognos_db.sql.erb
new file mode 100644
index 0000000..2c872a2
--- /dev/null
+++ b/templates/create_cognos_db.sql.erb
@@ -0,0 +1,44 @@
+-- Licensed Materials - Property of IBM
+--
+-- BI and PM: CM
+--
+-- (C) Copyright IBM Corp. 2010
+--
+-- US Government Users Restricted Rights - Use, duplication or disclosure
+-- restricted by GSA ADP Schedule Contract with IBM Corp.
+
+-- Copyright (C) 2008 Cognos ULC, an IBM Company. All rights reserved.
+-- Cognos (R) is a trademark of Cognos ULC, (formerly Cognos Incorporated).
+-- Use this template to create the IBM Cognos content database. Replace these variables:
+-- cm : Database name
+-- <%= scope['cognos::cognos_db_user'] %> : User ID, this account is used by the product to connect to the content store
+-- This script must be run as a user that has sufficient privileges to access and create the database.
+-- The database user account needs to exist for the product to function.
+
+CREATE DATABASE cm AUTOMATIC STORAGE YES ALIAS cm USING CODESET UTF-8 TERRITORY US COLLATE USING SYSTEM PAGESIZE 8192;
+CHANGE DATABASE cm COMMENT WITH 'IBM Cognos Content Store';
+CONNECT TO cm;
+UPDATE DATABASE CONFIGURATION USING APPLHEAPSZ 1024 DEFERRED;
+UPDATE DATABASE CONFIGURATION USING LOCKTIMEOUT 240 DEFERRED;
+CONNECT RESET;
+
+CONNECT TO cm;
+CREATE BUFFERPOOL cm_08KBP IMMEDIATE SIZE 1000 PAGESIZE 8K;
+CREATE BUFFERPOOL cm_32KBP IMMEDIATE SIZE 1000 PAGESIZE 32K;
+CONNECT RESET;
+
+CONNECT TO cm;
+CREATE SYSTEM TEMPORARY TABLESPACE TSN_SYS_cm IN DATABASE PARTITION GROUP IBMTEMPGROUP PAGESIZE 32K BUFFERPOOL cm_32KBP;
+CREATE USER TEMPORARY TABLESPACE TSN_USR_cm IN DATABASE PARTITION GROUP IBMDEFAULTGROUP PAGESIZE 8K BUFFERPOOL IBMDEFAULTBP;
+CREATE REGULAR TABLESPACE TSN_REG_cm IN DATABASE PARTITION GROUP IBMDEFAULTGROUP PAGESIZE 8K BUFFERPOOL cm_08KBP;
+DROP TABLESPACE USERSPACE1;
+CONNECT RESET;
+
+CONNECT TO cm;
+CREATE SCHEMA db2COGNOS AUTHORIZATION <%= scope['cognos::cognos_db_user'] %>;
+COMMENT ON SCHEMA db2COGNOS IS 'IBM Cognos Content Store';
+GRANT CREATETAB,BINDADD,CONNECT,IMPLICIT_SCHEMA ON DATABASE  TO USER <%= scope['cognos::cognos_db_user'] %>;
+GRANT CREATEIN,DROPIN,ALTERIN ON SCHEMA DB2COGNOS TO USER <%= scope['cognos::cognos_db_user'] %>;
+GRANT USE OF TABLESPACE TSN_USR_cm TO USER <%= scope['cognos::cognos_db_user'] %>;
+GRANT USE OF TABLESPACE TSN_REG_cm TO USER <%= scope['cognos::cognos_db_user'] %>;
+CONNECT RESET;
diff --git a/tests/init.pp b/tests/init.pp
new file mode 100644
index 0000000..9aa8e73
--- /dev/null
+++ b/tests/init.pp
@@ -0,0 +1,12 @@
+# The baseline for module testing used by Puppet Labs is that each manifest
+# should have a corresponding test manifest that declares that class or defined
+# type.
+#
+# Tests are then run by using puppet apply --noop (to check for compilation
+# errors and view a log of events) or by fully applying the test in a virtual
+# environment (to compare the resulting system state to the desired state).
+#
+# Learn more about module testing here:
+# http://docs.puppetlabs.com/guides/tests_smoke.html
+#
+include cognos