From 71069ed3ddadc5591b9e10944d56cc4a6ddd4f5e Mon Sep 17 00:00:00 2001
From: "john.puskar" <jpuskar@us.ibm.com>
Date: Fri, 2 Jun 2017 22:14:25 -0400
Subject: [PATCH] Initial commit.

---
 .fixtures.yml                      |    7 +
 .gitignore                         |    6 +
 Gemfile                            |   41 +
 Gemfile.lock                       |  397 ++++++
 README.md                          |   54 +
 Rakefile                           |   12 +
 Vagrantfile                        |   38 +
 manifests/cm_db/db2.pp             |   36 +
 manifests/config.pp                |  124 ++
 manifests/init.pp                  |   52 +
 manifests/install/main.pp          |   92 ++
 manifests/install/prep.pp          |   35 +
 manifests/install/prereqs.pp       |   27 +
 manifests/install/service.pp       |   18 +
 metadata.json                      |   16 +
 spec/classes/init_spec.rb          |   42 +
 spec/spec_helper.rb                |    2 +
 templates/cognos.service.erb       |   25 +
 templates/cognos11_config.xml.erb  | 1896 ++++++++++++++++++++++++++++
 templates/cognos_11.rsp.erb        |    8 +
 templates/create_cognos_db.sql.erb |   44 +
 tests/init.pp                      |   12 +
 22 files changed, 2984 insertions(+)
 create mode 100644 .fixtures.yml
 create mode 100644 .gitignore
 create mode 100644 Gemfile
 create mode 100644 Gemfile.lock
 create mode 100644 README.md
 create mode 100644 Rakefile
 create mode 100644 Vagrantfile
 create mode 100644 manifests/cm_db/db2.pp
 create mode 100644 manifests/config.pp
 create mode 100644 manifests/init.pp
 create mode 100644 manifests/install/main.pp
 create mode 100644 manifests/install/prep.pp
 create mode 100644 manifests/install/prereqs.pp
 create mode 100644 manifests/install/service.pp
 create mode 100644 metadata.json
 create mode 100644 spec/classes/init_spec.rb
 create mode 100644 spec/spec_helper.rb
 create mode 100644 templates/cognos.service.erb
 create mode 100644 templates/cognos11_config.xml.erb
 create mode 100644 templates/cognos_11.rsp.erb
 create mode 100644 templates/create_cognos_db.sql.erb
 create mode 100644 tests/init.pp

diff --git a/.fixtures.yml b/.fixtures.yml
new file mode 100644
index 0000000..c269a20
--- /dev/null
+++ b/.fixtures.yml
@@ -0,0 +1,7 @@
+# ref: https://github.com/puppetlabs/puppetlabs_spec_helper#fixtures-examples
+# the symlinks are relative to the fixtures directory, hence all the '..'
+fixtures:
+  repositories:
+    stdlib: "git://github.com/puppetlabs/puppetlabs-stdlib"
+    firewalld: "git://github.com/crayfishx/puppet-firewalld"
+    #db2: "git://github.com/jpuskar/puppet-db2"
diff --git a/.gitignore b/.gitignore
new file mode 100644
index 0000000..51af1ec
--- /dev/null
+++ b/.gitignore
@@ -0,0 +1,6 @@
+# Created by .ignore support plugin (hsz.mobi)
+.idea/
+.vagrant/
+vagrant/
+custom
+cognos_11_installer.properties
\ No newline at end of file
diff --git a/Gemfile b/Gemfile
new file mode 100644
index 0000000..42ff184
--- /dev/null
+++ b/Gemfile
@@ -0,0 +1,41 @@
+source 'https://rubygems.org'
+
+# NOTE: Relying on the controlrepo gem in jenkins will end up with over 100 gems
+# installed as dependencies.  When running in CI, this can be unnecessarily time
+# consuming, especially if only RSpec tests are being exercised.  Consuder using
+# the controlrepo gem when integration and system level tests are exericsed, but
+# for now I recommend only using it in development, not when testing in CI.
+
+group :development do
+  # controlrepo is a helper tool to setup spec and integration testing inside of a
+  # Puppet control repository.  We're not using the rake rakes, but instead
+  # directly invoking `rspec spec` in an effort to cut down on the amount of
+  # implicit, magic behavior.  The controlrepo gem provides value in the form of
+  # an updated set of depenencies suitable for spec testing using rspec-puppet.
+  #
+  # https://github.com/jeffmccune/controlrepo_gem
+  gem 'controlrepo'
+  # Interactive debugger and REPL breakpoint tool
+  # See http://pryrepl.org/
+  gem 'pry'
+  gem 'pry-stack_explorer'
+end
+
+group :test, :development do
+  gem 'puppet', '4.9.4'
+  # should be 3.7.2 but not available on rubygems
+  gem 'facter'
+  gem 'hiera', '3.3.1'
+  gem 'hiera-eyaml', '2.1.0'
+  gem 'parallel_tests'
+
+  # other testing gems we want
+  gem 'rspec-puppet'
+  gem 'puppetlabs_spec_helper'
+  gem 'rake-notes'
+
+  # pinning specific versions
+  gem 'puppet-lint', '~> 2.1'
+
+end
+
diff --git a/Gemfile.lock b/Gemfile.lock
new file mode 100644
index 0000000..748e18c
--- /dev/null
+++ b/Gemfile.lock
@@ -0,0 +1,397 @@
+GEM
+  remote: https://rubygems.org/
+  specs:
+    CFPropertyList (2.3.5)
+    addressable (2.5.1)
+      public_suffix (~> 2.0, >= 2.0.2)
+    aws-sdk-v1 (1.67.0)
+      json (~> 1.4)
+      nokogiri (~> 1)
+    beaker (3.17.0)
+      aws-sdk-v1 (~> 1.57)
+      beaker-hiera (~> 0.0)
+      beaker-hostgenerator
+      docker-api
+      fission (~> 0.4)
+      fog (~> 1.38)
+      google-api-client (~> 0.9)
+      hocon (~> 1.0)
+      in-parallel (~> 0.1)
+      inifile (~> 3.0)
+      minitar (~> 0.5.4)
+      minitest (~> 5.4)
+      net-scp (~> 1.2)
+      net-ssh (~> 4.0)
+      open_uri_redirections (~> 0.2.1)
+      rbvmomi (~> 1.9)
+      rsync (~> 1.0.9)
+      stringify-hash (~> 0.0)
+      thor (~> 0.19)
+      unf (~> 0.1)
+    beaker-hiera (0.1.1)
+      stringify-hash (~> 0.0.0)
+    beaker-hostgenerator (0.8.4)
+      deep_merge (~> 1.0)
+      stringify-hash (~> 0.0.0)
+    beaker-rspec (6.1.0)
+      beaker (~> 3.0)
+      rspec (~> 3.0)
+      serverspec (~> 2)
+      specinfra (~> 2)
+    binding_of_caller (0.7.2)
+      debug_inspector (>= 0.0.1)
+    builder (3.2.3)
+    coderay (1.1.1)
+    colored (1.2)
+    controlrepo (2.0.10)
+      beaker-rspec
+      bundler
+      git
+      json (>= 1.8.2)
+      puppet
+      puppetlabs_spec_helper (>= 0.4.0)
+      r10k (>= 2.1.0)
+      rake (>= 10.0.0)
+      rspec (>= 3.0.0)
+      rspec-puppet
+    cri (2.6.1)
+      colored (~> 1.2)
+    debug_inspector (0.0.3)
+    declarative (0.0.9)
+    declarative-option (0.1.0)
+    deep_merge (1.1.1)
+    diff-lcs (1.3)
+    docker-api (1.33.4)
+      excon (>= 0.38.0)
+      json
+    excon (0.56.0)
+    facter (3.6.4)
+    faraday (0.9.2)
+      multipart-post (>= 1.2, < 3)
+    faraday_middleware (0.10.1)
+      faraday (>= 0.7.4, < 1.0)
+    fast_gettext (1.1.0)
+    fission (0.5.0)
+      CFPropertyList (~> 2.2)
+    fog (1.40.0)
+      fog-aliyun (>= 0.1.0)
+      fog-atmos
+      fog-aws (>= 0.6.0)
+      fog-brightbox (~> 0.4)
+      fog-cloudatcost (~> 0.1.0)
+      fog-core (~> 1.43)
+      fog-digitalocean (>= 0.3.0)
+      fog-dnsimple (~> 1.0)
+      fog-dynect (~> 0.0.2)
+      fog-ecloud (~> 0.1)
+      fog-google (<= 0.1.0)
+      fog-json
+      fog-local
+      fog-openstack
+      fog-powerdns (>= 0.1.1)
+      fog-profitbricks
+      fog-rackspace
+      fog-radosgw (>= 0.0.2)
+      fog-riakcs
+      fog-sakuracloud (>= 0.0.4)
+      fog-serverlove
+      fog-softlayer
+      fog-storm_on_demand
+      fog-terremark
+      fog-vmfusion
+      fog-voxel
+      fog-vsphere (>= 0.4.0)
+      fog-xenserver
+      fog-xml (~> 0.1.1)
+      ipaddress (~> 0.5)
+      json (>= 1.8, < 2.0)
+    fog-aliyun (0.1.0)
+      fog-core (~> 1.27)
+      fog-json (~> 1.0)
+      ipaddress (~> 0.8)
+      xml-simple (~> 1.1)
+    fog-atmos (0.1.0)
+      fog-core
+      fog-xml
+    fog-aws (1.3.0)
+      fog-core (~> 1.38)
+      fog-json (~> 1.0)
+      fog-xml (~> 0.1)
+      ipaddress (~> 0.8)
+    fog-brightbox (0.11.0)
+      fog-core (~> 1.22)
+      fog-json
+      inflecto (~> 0.0.2)
+    fog-cloudatcost (0.1.2)
+      fog-core (~> 1.36)
+      fog-json (~> 1.0)
+      fog-xml (~> 0.1)
+      ipaddress (~> 0.8)
+    fog-core (1.44.3)
+      builder
+      excon (~> 0.49)
+      formatador (~> 0.2)
+    fog-digitalocean (0.3.0)
+      fog-core (~> 1.42)
+      fog-json (>= 1.0)
+      fog-xml (>= 0.1)
+      ipaddress (>= 0.5)
+    fog-dnsimple (1.0.0)
+      fog-core (~> 1.38)
+      fog-json (~> 1.0)
+    fog-dynect (0.0.3)
+      fog-core
+      fog-json
+      fog-xml
+    fog-ecloud (0.3.0)
+      fog-core
+      fog-xml
+    fog-google (0.1.0)
+      fog-core
+      fog-json
+      fog-xml
+    fog-json (1.0.2)
+      fog-core (~> 1.0)
+      multi_json (~> 1.10)
+    fog-local (0.3.1)
+      fog-core (~> 1.27)
+    fog-openstack (0.1.21)
+      fog-core (>= 1.40)
+      fog-json (>= 1.0)
+      ipaddress (>= 0.8)
+    fog-powerdns (0.1.1)
+      fog-core (~> 1.27)
+      fog-json (~> 1.0)
+      fog-xml (~> 0.1)
+    fog-profitbricks (3.0.0)
+      fog-core (~> 1.42)
+      fog-json (~> 1.0)
+    fog-rackspace (0.1.5)
+      fog-core (>= 1.35)
+      fog-json (>= 1.0)
+      fog-xml (>= 0.1)
+      ipaddress (>= 0.8)
+    fog-radosgw (0.0.5)
+      fog-core (>= 1.21.0)
+      fog-json
+      fog-xml (>= 0.0.1)
+    fog-riakcs (0.1.0)
+      fog-core
+      fog-json
+      fog-xml
+    fog-sakuracloud (1.7.5)
+      fog-core
+      fog-json
+    fog-serverlove (0.1.2)
+      fog-core
+      fog-json
+    fog-softlayer (1.1.4)
+      fog-core
+      fog-json
+    fog-storm_on_demand (0.1.1)
+      fog-core
+      fog-json
+    fog-terremark (0.1.0)
+      fog-core
+      fog-xml
+    fog-vmfusion (0.1.0)
+      fission
+      fog-core
+    fog-voxel (0.1.0)
+      fog-core
+      fog-xml
+    fog-vsphere (1.10.0)
+      fog-core
+      rbvmomi (~> 1.9)
+    fog-xenserver (0.3.0)
+      fog-core
+      fog-xml
+    fog-xml (0.1.3)
+      fog-core
+      nokogiri (>= 1.5.11, < 2.0.0)
+    formatador (0.2.5)
+    gettext (3.2.2)
+      locale (>= 2.0.5)
+      text (>= 1.3.0)
+    gettext-setup (0.25)
+      fast_gettext (~> 1.1.0)
+      gettext (>= 3.0.2)
+      locale
+    git (1.3.0)
+    google-api-client (0.11.3)
+      addressable (>= 2.5.1)
+      googleauth (~> 0.5)
+      httpclient (>= 2.8.1, < 3.0)
+      mime-types (>= 3.0)
+      representable (~> 3.0)
+      retriable (>= 2.0, < 4.0)
+    googleauth (0.5.1)
+      faraday (~> 0.9)
+      jwt (~> 1.4)
+      logging (~> 2.0)
+      memoist (~> 0.12)
+      multi_json (~> 1.11)
+      os (~> 0.9)
+      signet (~> 0.7)
+    hiera (3.3.1)
+    hiera-eyaml (2.1.0)
+      highline (~> 1.6.19)
+      trollop (~> 2.0)
+    highline (1.6.21)
+    hocon (1.2.5)
+    httpclient (2.8.3)
+    in-parallel (0.1.17)
+    inflecto (0.0.2)
+    inifile (3.0.0)
+    ipaddress (0.8.3)
+    json (1.8.6)
+    json_pure (1.8.6)
+    jwt (1.5.6)
+    little-plugger (1.1.4)
+    locale (2.1.2)
+    log4r (1.1.10)
+    logging (2.2.2)
+      little-plugger (~> 1.1)
+      multi_json (~> 1.10)
+    memoist (0.15.0)
+    metaclass (0.0.4)
+    method_source (0.8.2)
+    mime-types (3.1)
+      mime-types-data (~> 3.2015)
+    mime-types-data (3.2016.0521)
+    mini_portile2 (2.1.0)
+    minitar (0.5.4)
+    minitest (5.10.2)
+    mocha (1.2.1)
+      metaclass (~> 0.0.1)
+    multi_json (1.12.1)
+    multipart-post (2.0.0)
+    net-scp (1.2.1)
+      net-ssh (>= 2.6.5)
+    net-ssh (4.1.0)
+    net-telnet (0.1.1)
+    nokogiri (1.7.2)
+      mini_portile2 (~> 2.1.0)
+    open_uri_redirections (0.2.1)
+    os (0.9.6)
+    parallel (1.11.2)
+    parallel_tests (2.14.1)
+      parallel
+    pry (0.10.4)
+      coderay (~> 1.1.0)
+      method_source (~> 0.8.1)
+      slop (~> 3.4)
+    pry-stack_explorer (0.4.9.2)
+      binding_of_caller (>= 0.7)
+      pry (>= 0.9.11)
+    public_suffix (2.0.5)
+    puppet (4.9.4)
+      facter (> 2.0, < 4)
+      gettext-setup (>= 0.10, < 1)
+      hiera (>= 2.0, < 4)
+      json_pure (~> 1.8)
+      locale (~> 2.1)
+    puppet-lint (2.2.1)
+    puppet-syntax (2.4.0)
+      rake
+    puppet_forge (2.2.4)
+      faraday (~> 0.9.0)
+      faraday_middleware (>= 0.9.0, < 0.11.0)
+      gettext-setup (~> 0.11)
+      minitar
+      semantic_puppet (~> 0.1.0)
+    puppetlabs_spec_helper (2.1.3)
+      mocha (~> 1.0)
+      puppet-lint (~> 2.0)
+      puppet-syntax (~> 2.0)
+      rspec-puppet (~> 2.0)
+    r10k (2.5.4)
+      colored (= 1.2)
+      cri (~> 2.6.1)
+      gettext-setup (~> 0.5)
+      log4r (= 1.1.10)
+      minitar (= 0.5.4)
+      multi_json (~> 1.10)
+      puppet_forge (~> 2.2)
+      semantic_puppet (~> 0.1.0)
+    rake (12.0.0)
+    rake-notes (0.2.0)
+      colored
+      rake
+    rbvmomi (1.11.2)
+      builder (~> 3.0)
+      json (>= 1.8)
+      nokogiri (~> 1.5)
+      trollop (~> 2.1)
+    representable (3.0.4)
+      declarative (< 0.1.0)
+      declarative-option (< 0.2.0)
+      uber (< 0.2.0)
+    retriable (3.0.2)
+    rspec (3.6.0)
+      rspec-core (~> 3.6.0)
+      rspec-expectations (~> 3.6.0)
+      rspec-mocks (~> 3.6.0)
+    rspec-core (3.6.0)
+      rspec-support (~> 3.6.0)
+    rspec-expectations (3.6.0)
+      diff-lcs (>= 1.2.0, < 2.0)
+      rspec-support (~> 3.6.0)
+    rspec-its (1.2.0)
+      rspec-core (>= 3.0.0)
+      rspec-expectations (>= 3.0.0)
+    rspec-mocks (3.6.0)
+      diff-lcs (>= 1.2.0, < 2.0)
+      rspec-support (~> 3.6.0)
+    rspec-puppet (2.5.0)
+      rspec
+    rspec-support (3.6.0)
+    rsync (1.0.9)
+    semantic_puppet (0.1.4)
+      gettext-setup (>= 0.3)
+    serverspec (2.39.1)
+      multi_json
+      rspec (~> 3.0)
+      rspec-its
+      specinfra (~> 2.68)
+    sfl (2.3)
+    signet (0.7.3)
+      addressable (~> 2.3)
+      faraday (~> 0.9)
+      jwt (~> 1.5)
+      multi_json (~> 1.10)
+    slop (3.6.0)
+    specinfra (2.68.0)
+      net-scp
+      net-ssh (>= 2.7, < 5.0)
+      net-telnet
+      sfl
+    stringify-hash (0.0.2)
+    text (1.3.1)
+    thor (0.19.4)
+    trollop (2.1.2)
+    uber (0.1.0)
+    unf (0.1.4)
+      unf_ext
+    unf_ext (0.0.7.4)
+    xml-simple (1.1.5)
+
+PLATFORMS
+  ruby
+
+DEPENDENCIES
+  controlrepo
+  facter
+  hiera (= 3.3.1)
+  hiera-eyaml (= 2.1.0)
+  parallel_tests
+  pry
+  pry-stack_explorer
+  puppet (= 4.9.4)
+  puppet-lint (~> 2.1)
+  puppetlabs_spec_helper
+  rake-notes
+  rspec-puppet
+
+BUNDLED WITH
+   1.14.6
diff --git a/README.md b/README.md
new file mode 100644
index 0000000..5d5629f
--- /dev/null
+++ b/README.md
@@ -0,0 +1,54 @@
+# cognos
+
+#### Table of Contents
+
+1. [Description](#description)
+1. [Setup - The basics of getting started with cognos](#setup)
+    * [Setup requirements](#setup-requirements)
+1. [Usage - Configuration options and additional functionality](#usage)
+1. [Reference - An under-the-hood peek at what the module is doing and how](#reference)
+1. [Limitations - OS compatibility, etc.](#limitations)
+1. [Development - Guide for contributing to the module](#development)
+
+## Description
+
+This module installs and configures a basic cognos server using db2.
+
+## Setup
+
+### Setup Requirements
+
+The cognos and db2 v10.1 install binaries must be pre-staged, and the parameter named 'installer_source_dir' configured.
+
+## Usage
+The param 'installer_source_dir' expects to find the folder ./exp.
+For example, if "/root" is specified, than this should exist: "/root/exp/db2"
+
+
+```puppet
+class {'cognos':
+  cognos_user_password    => 'mypass',
+  cognos_db_user_password => 'mypass',
+  cog_users_password_salt => 'random phrase',
+  installer_source_dir    => '/root',
+  installer_filename      => 'ca_srv_lnxi38664_11.0.5.16111917.bin',
+}
+```
+## Reference
+
+Please see the individual manifest files for additional parameters.
+
+## Limitations
+
+This module has only been tested with Cognos 11.0.5 using DB2 Express V10.1 on Centos 7.3.
+
+In addition, it currently does not support:
++ Content Managers other than DB2 running on localhost.
++ Multiple servers / tires.
++ Authentication providers of any kind.
+## Development
+
+This module includes a Vagrantfile for easy testing. Just install vagrant and virtualbox, clone this repo, and 'vagrant up'.
+
+To stage the DB2 media, make a folder in the repo root called "vagrant", and ensure that the folder structure looks like: "./puppet-cognos/vagrant/exp/db2".
+The cognos installer file must also reside in "./puppet-cognos/vagrant".
diff --git a/Rakefile b/Rakefile
new file mode 100644
index 0000000..b549d7d
--- /dev/null
+++ b/Rakefile
@@ -0,0 +1,12 @@
+require 'rubygems'
+require 'puppetlabs_spec_helper/rake_tasks'
+require 'puppet-lint/tasks/puppet-lint'
+PuppetLint.configuration.send('disable_80chars')
+PuppetLint.configuration.ignore_paths = ["spec/**/*.pp", "pkg/**/*.pp"]
+
+# Forsake support for Puppet 2.6.2 for the benefit of cleaner code.
+# http://puppet-lint.com/checks/class_inherits_from_params_class/
+PuppetLint.configuration.send('disable_class_inherits_from_params_class')
+
+desc "Run all tests"
+task :test => [:lint, :validate, :spec]
diff --git a/Vagrantfile b/Vagrantfile
new file mode 100644
index 0000000..d787ef4
--- /dev/null
+++ b/Vagrantfile
@@ -0,0 +1,38 @@
+# -*- mode: ruby -*-
+
+Vagrant.configure("2") do |config|
+    # Every Vagrant virtual environment requires a box to build off of.
+    config.vm.box = "puppetlabs/centos-7.2-64-puppet"
+
+    # Assign this VM to a host-only network IP, allowing you to access it
+    # via the IP.
+    config.vm.provider 'virtualbox' do |vb|
+        vb.customize ["modifyvm", :id, "--natnet1", "172.31.9/24"]
+        vb.gui = false
+        vb.memory = 6144
+        vb.customize ["modifyvm", :id, "--ioapic", "on"]
+        vb.customize ["modifyvm", :id, "--hpet", "on"]
+    end
+
+    # Second network interface, vm's will all exist on this network
+    ip = "192.168.44.35"
+    config.vm.network :private_network, ip: ip
+    config.vm.network :forwarded_port, guest: 9300, host: 9393
+
+    $script = <<SCRIPT
+echo I am provisioning...
+export FACTER_is_vagrant='true'
+[ -d /tmp/modules/cognos ] || mkdir -p /tmp/modules/cognos
+mount | grep /tmp/modules/cognos || mount --bind /vagrant /tmp/modules/cognos
+puppet module install puppetlabs-stdlib
+puppet module install crayfishx-firewalld
+puppet module install puppet-selinux
+puppet module install puppet-nginx
+puppet module install jpuskar-db2
+puppet apply --modulepath '/tmp/modules:/etc/puppetlabs/code/environments/production/modules' -e "include '::db2'"
+puppet apply --modulepath '/tmp/modules:/etc/puppetlabs/code/environments/production/modules' -e "include '::cognos'"
+SCRIPT
+
+    config.vm.provision "shell", inline: $script
+
+end
diff --git a/manifests/cm_db/db2.pp b/manifests/cm_db/db2.pp
new file mode 100644
index 0000000..533096d
--- /dev/null
+++ b/manifests/cm_db/db2.pp
@@ -0,0 +1,36 @@
+#
+class cognos::cm_db::db2 {
+
+  # Cognos DB2 CM SQL File
+  $cognos_db_file = "/home/${cognos::cognos_db_instance_user}/create_cognos_db.sql"
+  file{$cognos_db_file:
+    content => template('cognos/create_cognos_db.sql.erb'),
+    mode    => '0755',
+    owner   => $cognos::cognos_db_instance_user,
+    group   => $cognos::cognos_db_instance_user,
+  }
+
+  # Configure Cognos ContentDb
+  exec{'configure_cognos_db2_cm_db':
+    command => "${cognos::db2_install_path}/bin/db2 -tvf ${cognos_db_file}",
+    user    => $cognos::cognos_db_instance_user,
+    cwd     => "/home/${cognos::cognos_db_instance_user}",
+    timeout => 600,
+    unless  => "${cognos::db2_install_path}/bin/db2 list db directory | grep \"Database name\" | grep \"= CM\"",
+    require => File[$cognos_db_file],
+  }
+
+  # DB2 drivers
+  exec{'install_db2_java_driver_cognos':
+    command  => "cp ${cognos::db2_install_path}/java/db2jcc.jar ${cognos::installer_target_dir}/drivers",
+    unless   => "test -f ${cognos::installer_target_dir}/drivers/db2jcc.jar",
+    provider => 'shell',
+  }
+  -> file{"${cognos::installer_target_dir}/drivers/db2jcc.jar":
+    mode    => '0775',
+    owner   => $cognos::cognos_user,
+    group   => $cognos::cognos_user,
+    require => Exec['install_db2_java_driver_cognos'],
+  }
+
+}
\ No newline at end of file
diff --git a/manifests/config.pp b/manifests/config.pp
new file mode 100644
index 0000000..798bea4
--- /dev/null
+++ b/manifests/config.pp
@@ -0,0 +1,124 @@
+#
+class cognos::config{
+  # Startup wait times. If unset, Cognos may fail to start.
+  file_line { 'Cognos_ServiceMaxTries':
+    ensure => present,
+    path   => '/opt/ibm/cognos/analytics/configuration/cogconfig.prefs',
+    line   => "ServiceMaxTries=${cognos::service_max_tries}",
+    match  => '^ServiceMaxTries*',
+  }
+  file_line { 'Cognos_ServiceWaitInverval':
+    ensure => present,
+    path   => '/opt/ibm/cognos/analytics/configuration/cogconfig.prefs',
+    line   => "ServiceWaitInterval=${cognos::service_wait_interval}",
+    match  => '^ServiceWaitInterval*',
+  }
+
+  if $cognos::enable_debug_logging {
+    file_line { 'cognos_log4j_axis_debug':
+      ensure => present,
+      path   => '/opt/ibm/cognos/analytics/bin/log4j.properties',
+      line   => 'log4j.logger.org.apache.axis=DEBUG, CONSOLE',
+      match  => '^log4j\.logger\.org\.apache\.axis=+',
+    }
+    file_line { 'cognos_log4j_axis_enterprise_debug':
+      ensure => present,
+      path   => '/opt/ibm/cognos/analytics/bin/log4j.properties',
+      line   => 'log4j.logger.org.apache.axis.enterprise=DEBUG, CONSOLE',
+      match  => '^log4j\.logger\.org\.apache\.axis\.enterprise=+',
+    }
+    file_line { 'cognos_log4j_appender_console_debug':
+      ensure => present,
+      path   => '/opt/ibm/cognos/analytics/bin/log4j.properties',
+      line   => 'log4j.appender.CONSOLE.Threshold=DEBUG',
+      match  => '^log4j\.appender\.CONSOLE\.Threshold=+',
+    }
+    file_line { 'cognos_log4j_appender_logfile_debug':
+      ensure => present,
+      path   => '/opt/ibm/cognos/analytics/bin/log4j.properties',
+      line   => 'log4j.appender.LOGFILE.Threshold=DEBUG',
+      match  => '^log4j\.appender\.LOGFILE\.Threshold=+',
+    }
+    file_line { 'cognos_cogconfigipf_info':
+      ensure   => present,
+      path     => '/opt/ibm/cognos/analytics/configuration/cogconfigipf.xml',
+      line     => '                <level value="info"/>',
+      match    => '^(\s)+\<level\ value=',
+      multiple => true,
+    }
+  }
+
+  if $cognos::manage_firewall {
+    include '::firewalld'
+    firewalld_port { 'Open port 8080 in the public zone':
+      ensure   => present,
+      zone     => 'public',
+      port     => 9300,
+      protocol => 'tcp',
+    }
+
+    # firewall { '1205 [cognos::config] allow cognos gateway https inbound':
+    #   chain  => 'INPUT',
+    #   proto  => 'tcp',
+    #   dport  => 443,
+    #   state  => 'NEW',
+    #   action => 'accept',
+    # }
+    #
+    # firewall { '3505 [cognos::config] allow cognos gateway https outbound':
+    #   chain  => 'OUTPUT',
+    #   proto  => 'tcp',
+    #   dport  => 443,
+    #   state  => 'NEW',
+    #   action => 'accept',
+    # }
+  }
+
+  # Cognos config file
+  file{"${cognos::installer_target_dir}/configuration/cogstartup.puppet.xml":
+    content => template('cognos/cognos11_config.xml.erb'),
+    mode    => '0755',
+    before  => Exec['apply_new_cognos_config'],
+    notify  => Exec['apply_new_cognos_config'],
+  }
+
+  # Configure Cognos
+  $cog_conf_cmd = @("END_COG_CONF_CMD"/$)
+systemctl stop cognos || true
+cp ${cognos::installer_target_dir}/configuration/cogstartup.puppet.xml \
+  ${cognos::installer_target_dir}/configuration/cogstartup.xml
+chown ${cognos::cognos_user}:${cognos::cognos_user} \
+  ${cognos::installer_target_dir}/configuration/cogstartup.xml
+  | END_COG_CONF_CMD
+
+  exec{'apply_new_cognos_config':
+    command     => $cog_conf_cmd,
+    provider    => 'shell',
+    refreshonly => true,
+    notify      => Service['cognos'],
+  }
+
+  # Add symlinks for intuitive log and config locations
+  if $cognos::install_symlinks {
+    file { '/etc/cognos':
+      ensure => 'directory',
+    }
+    -> file { '/etc/cognos/configuration':
+      ensure => 'link',
+      target => '/opt/ibm/cognos/analytics/configuration',
+    }
+
+    file { '/var/log/cognos':
+      ensure => 'directory',
+    }
+    -> file { '/var/log/cognos/common':
+      ensure => 'link',
+      target => '/opt/ibm/cognos/analytics/logs',
+    }
+    -> file { '/var/log/cognos/wlp':
+      ensure => 'link',
+      target => '/opt/ibm/cognos/analytics/wlp/usr/servers/cognosserver/logs',
+    }
+  }
+
+}
\ No newline at end of file
diff --git a/manifests/init.pp b/manifests/init.pp
new file mode 100644
index 0000000..701937d
--- /dev/null
+++ b/manifests/init.pp
@@ -0,0 +1,52 @@
+# Class: cognos
+# ===========================
+#
+class cognos(
+  $installer_target_dir         = '/opt/ibm/cognos/analytics',
+  $installer_source_dir         = '/vagrant',
+  $installer_filename           = 'ca_srv_lnxi38664_11.0.5.16111917.bin',
+  $installer_timeout            = 600,
+  $install_app_tier             = true,
+  $install_gateway              = true,
+  $install_prereq_packages      = true,
+  $install_symlinks             = true,
+  $cognos_user                  = 'cognos',
+  $cognos_user_uid              = '4979',
+  $cognos_user_password         = 'vagrant',
+  $cognos_db_user               = 'cog_db2',
+  $cognos_db_user_uid           = '4980',
+  $cognos_db_user_password      = 'vagrant',
+  $cog_users_password_salt      = 'vagrant',
+  $cognos_db_instance_user      = 'db2inst1',
+  $pmp_max_memory               = 1024,
+  $dispatcher_max_memory        = 4096,
+  $sort_memory                  = 32,
+  $external_dispatcher_uri_port = 443,
+  $service_max_tries            = 600,
+  $service_wait_interval        = 10000,
+  $manage_firewall              = true,
+  $configure_db2_cm_db          = true,
+  $db2_install_path             = '/opt/ibm/db2/V10.1',
+  $enable_debug_logging         = true,
+  $enable_delivery_service      = false,
+) {
+  # TODO: cognos::config - file for cogstartup.puppet.xml should be set to root-only.
+
+  # Prereq packages
+  if $cognos::install_prereq_packages {
+    class {'cognos::install::prereqs':}
+  }
+
+  # Other prep items
+  -> class {'cognos::install::prep':}
+
+  # Main install
+  -> class {'cognos::install::main':}
+
+  # Config
+  -> class {'cognos::config':}
+  -> if $cognos::configure_db2_cm_db {
+    class {'cognos::cm_db::db2':}
+  }
+  -> class {'cognos::install::service':}
+}
diff --git a/manifests/install/main.pp b/manifests/install/main.pp
new file mode 100644
index 0000000..a99d311
--- /dev/null
+++ b/manifests/install/main.pp
@@ -0,0 +1,92 @@
+#
+class cognos::install::main {
+
+  # variables for response file
+  if $cognos::install_app_tier {
+    $install_app_tier_int = 1
+  } else {
+    $install_app_tier_int = 0
+  }
+  if $cognos::install_gateway {
+    $install_gateway_int = 1
+  } else {
+    $install_gateway_int = 0
+  }
+
+  # Input validation
+  # TODO: swap to validate_legacy()
+  #validate_legacy(Optional[String], 'validate_re', $db2::instance_user_password, ['^(?!vagrant$).*$'])
+  validate_legacy(
+    Optional[String],
+    'validate_re',
+    $cognos::cognos_user,
+    '^[a-zA-Z0-9]{1,8}$',   # CHAR(8) && !/w && ![A-Z]
+  )
+  validate_legacy(
+    Optional[String],
+    'validate_re',
+    $cognos::cognos_db_user,
+    '^[a-zA-Z0-9_]{1,8}$',   # CHAR(8) && !/w && ![A-Z]
+  )
+
+  # If we're not in vagrant, then assert that our passwords aren't 'vagrant'.
+  if $::is_vagrant != 'true' { # lint:ignore:quoted_booleans
+    validate_legacy(
+      Optional[String],
+      'validate_re',
+      $cognos::cognos_user,
+      '^(?!vagrant$).*$',
+    )
+
+    validate_legacy(
+      Optional[String],
+      'validate_re',
+      $cognos::cognos_db_user,
+      '^(?!vagrant$).*$',
+    )
+
+    validate_legacy(
+      Optional[String],
+      'validate_re',
+      $cognos::cog_users_password_salt,
+      '^(?!vagrant$).*$',
+    )
+  }
+
+  # Cognos response file
+  $response_file_name = "${cognos::installer_source_dir}/cognos_11_installer.properties"
+  file{$response_file_name:
+    content => template('cognos/cognos_11.rsp.erb'),
+    mode    => '0755',
+  }
+
+  # Install Cognos
+  $cog_install_cmd = @("END_COG_INSTALL_CMD"/$)
+export LAX_DEBUG=true
+./${cognos::installer_source_dir}/${cognos::installer_filename} -f ${response_file_name} -i silent
+  | END_COG_INSTALL_CMD
+
+  $cog_unless_cmd = @("END_COG_UNLESS_CMD"/$)
+  test -f ${cognos::installer_target_dir}/cmplst.txt && \
+  cat ${cognos::installer_target_dir}/cmplst.txt | grep -i PSPORTLETS_name=IBM\ Cognos\ Portal\ Services
+  | END_COG_UNLESS_CMD
+
+  exec{'install_cognos':
+    command  => $cog_install_cmd,
+    provider => 'shell',
+    cwd      => $cognos::installer_source_dir,
+    timeout  => $cognos::installer_timeout,
+    unless   => $cog_unless_cmd,
+    require  => [
+      File[$response_file_name],
+    ],
+    before   => Exec['chown_cognos_install_dir'],
+  }
+
+  exec{'chown_cognos_install_dir':
+    command  => "chown -R ${cognos::cognos_user}:${cognos::cognos_user} /opt/ibm/cognos",
+    unless   => "ls -l ${cognos::installer_target_dir} | grep \"${cognos::cognos_user}\\:${cognos::cognos_user}\"",
+    provider => 'shell',
+  }
+
+}
diff --git a/manifests/install/prep.pp b/manifests/install/prep.pp
new file mode 100644
index 0000000..a58312d
--- /dev/null
+++ b/manifests/install/prep.pp
@@ -0,0 +1,35 @@
+#
+class cognos::install::prep {
+
+  group{$cognos::cognos_user:
+    gid => $cognos::cognos_user_uid,
+  }
+
+  group{$cognos::cognos_db_user:
+    gid => $cognos::cognos_db_user_uid,
+  }
+
+  user{$cognos::cognos_user:
+    uid      => $cognos::cognos_user_uid,
+    groups   => $cognos::cognos_user,
+    password => pw_hash($cognos::cognos_user_password,'SHA-512', $cognos::cog_users_password_salt),
+    require  => Group[$cognos::cognos_user],
+  }
+
+  user{$cognos::cognos_db_user:
+    uid      => $cognos::cognos_db_user_uid,
+    groups   => $cognos::cognos_db_user,
+    password => pw_hash($cognos::cognos_db_user_password,'sha-512', $cognos::cog_users_password_salt),
+    shell    => '/bin/bash',
+    comment  => 'cognos db2 user',
+    require  => Group[$cognos::cognos_db_user],
+  }
+
+  # Cognos won't start without this host entry
+  ensure_resource(
+    'host',
+    $::fqdn,
+    { ip => '127.0.0.1' }
+  )
+
+}
\ No newline at end of file
diff --git a/manifests/install/prereqs.pp b/manifests/install/prereqs.pp
new file mode 100644
index 0000000..5f71f85
--- /dev/null
+++ b/manifests/install/prereqs.pp
@@ -0,0 +1,27 @@
+#
+class cognos::install::prereqs{
+
+  # centos 7
+  $prereq_packages = [
+    'unzip',
+    'glibc.i686',
+    'glibc.x86_64',
+    'nspr.x86_64',
+    'nss.x86_64',
+    'motif.i686',
+    'motif.x86_64',
+    'libstdc++',
+    'nss-tools',
+  ]
+
+  $prereq_packages.each | $pkg_name | {
+    if($pkg_name) {
+      ensure_resource(
+        'package',
+        $pkg_name,
+        { ensure => 'present' },
+      )
+    }
+  }
+
+}
\ No newline at end of file
diff --git a/manifests/install/service.pp b/manifests/install/service.pp
new file mode 100644
index 0000000..3c0a0cb
--- /dev/null
+++ b/manifests/install/service.pp
@@ -0,0 +1,18 @@
+#
+class cognos::install::service {
+  # Cognos unit file
+  file{'/etc/systemd/system/cognos.service':
+    content => template('cognos/cognos.service.erb'),
+    mode    => '0644',
+    notify  => Exec['cognos_reload_systemd_units'],
+  }
+  exec{'cognos_reload_systemd_units':
+    command     => 'systemctl daemon-reload',
+    refreshonly => true,
+    provider    => 'shell',
+  }
+  ~> service{'cognos':
+    ensure => running,
+    enable => true,
+  }
+}
diff --git a/metadata.json b/metadata.json
new file mode 100644
index 0000000..460b900
--- /dev/null
+++ b/metadata.json
@@ -0,0 +1,16 @@
+{
+  "name": "puppet-cognos",
+  "version": "0.1.0",
+  "author": "jpuskar",
+  "summary": "Installs and configures Cognos.",
+  "license": "Apache-2.0",
+  "source": "https://github.com/jpuskar/puppet-cognos",
+  "project_page": "https://github.com/jpuskar/puppet-cognos",
+  "issues_url": "https://github.com/jpuskar/puppet-cognos/issues",
+  "dependencies": [
+    {"name":"puppetlabs-stdlib","version_requirement":">= 4.13.0"},
+    {"name":"crayfishx-firewalld","version_requirement":">=3.3.1"},
+    {"name":"puppet-selinux","version_requirement":">= 0.8.0"}
+  ],
+  "data_provider": null
+}
diff --git a/spec/classes/init_spec.rb b/spec/classes/init_spec.rb
new file mode 100644
index 0000000..6db6548
--- /dev/null
+++ b/spec/classes/init_spec.rb
@@ -0,0 +1,42 @@
+require 'spec_helper'
+
+describe 'cognos' do
+
+  context 'on CentOS 7' do
+    describe 'without any parameters' do
+      let(:facts) {{
+        :osfamily => 'RedHat',
+        :operatingsystem => 'CentOS',
+        :operatingsystemmajrelease => '7',
+        :is_vagrant => 'true',
+      }}
+      let(:params) {{ }}
+
+      it { is_expected.to compile.with_all_deps }
+      it { is_expected.to contain_class('cognos::cm_db::db2') }
+      it { is_expected.to contain_class('cognos::install::main') }
+      it { is_expected.to contain_class('cognos::install::prep') }
+      it { is_expected.to contain_class('cognos::install::prereqs') }
+      it { is_expected.to contain_class('cognos::install::service') }
+      it { is_expected.to contain_class('cognos::config') }
+
+      it { is_expected.to contain_file('/home/db2inst1/create_cognos_db.sql') }
+      it { is_expected.to contain_file('/opt/ibm/cognos/analytics/drivers/db2jcc.jar') }
+      it { is_expected.to contain_file('/vagrant/cognos_11_installer.properties') }
+      it { is_expected.to contain_file('/etc/systemd/system/cognos.service') }
+      it { is_expected.to contain_file('/opt/ibm/cognos/analytics/configuration/cogstartup.puppet.xml') }
+      it { is_expected.to contain_file('/etc/cognos') }
+      it { is_expected.to contain_file('/var/log/cognos') }
+      it { is_expected.to contain_file('/var/log/cognos/common') }
+      it { is_expected.to contain_file('/var/log/cognos/wlp') }
+
+      it { is_expected.to contain_user('cognos') }
+      it { is_expected.to contain_user('cog_db2') }
+      it { is_expected.to contain_group('cognos') }
+      it { is_expected.to contain_group('cog_db2') }
+
+    end
+  end
+
+end
+
diff --git a/spec/spec_helper.rb b/spec/spec_helper.rb
new file mode 100644
index 0000000..479ed69
--- /dev/null
+++ b/spec/spec_helper.rb
@@ -0,0 +1,2 @@
+require 'rubygems'
+require 'puppetlabs_spec_helper/module_spec_helper'
\ No newline at end of file
diff --git a/templates/cognos.service.erb b/templates/cognos.service.erb
new file mode 100644
index 0000000..c05ae4b
--- /dev/null
+++ b/templates/cognos.service.erb
@@ -0,0 +1,25 @@
+[Unit]
+Description=Cognos Analytics
+# TODO: if using db2: After=db2inst1.service
+# TODO: if using nginx: After=nginx.service
+
+[Service]
+Type=oneshot
+RemainAfterExit=yes
+User=<%= scope['cognos::cognos_user'] %>
+LimitNOFILE=65536
+CPUAccounting=1
+MemoryAccounting=1
+BlockIOAccounting=1
+#Slice=workload-application.slice
+Environment=LD_LIBRARY_PATH=<%= scope['cognos::installer_target_dir'] %>/cgi-bin
+# TODO: if using db2, append to LD_LIBRARY_PATH: :<%= scope['cognos::db2_instance_dir'] %>/sqllib/lib32/
+Environment=JAVA_HOME=<%= scope['cognos::installer_target_dir'] %>/jre
+ExecStart=<%= scope['cognos::installer_target_dir'] %>/bin64/cogconfig.sh -s -d
+ExecStop=<%= scope['cognos::installer_target_dir'] %>/bin64/cogconfig.sh -stop
+RestartSec=900
+#Restart=always
+
+[Install]
+WantedBy=multi-user.target
+
diff --git a/templates/cognos11_config.xml.erb b/templates/cognos11_config.xml.erb
new file mode 100644
index 0000000..898ffd6
--- /dev/null
+++ b/templates/cognos11_config.xml.erb
@@ -0,0 +1,1896 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!--
+===============================================================================================
+	Licensed Materials - Property of IBM
+	IBM Cognos Products: cnfg
+	(C) Copyright IBM Corp. 2016
+	US Government Users Restricted Rights - Use, duplication or disclosure restricted by GSA ADP Schedule Contract with IBM Corp.
+
+
+Master configuration file for all IBM Cognos components.
+===============================================================================================
+ -->
+<crn:parameters xmlns:crn="http://developer.cognos.com/schemas/crconfig/1/" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:cfg="http://developer.cognos.com/schemas/configparams/XMLSchema/1/" version="166.0" xsi:schemaLocation="http://developer.cognos.com/schemas/crconfig/1/ cogstartup.xsd">
+  <crn:parameter name="edition">
+    <crn:value xsi:type="xsd:string">enterprise</crn:value>
+  </crn:parameter>
+  <crn:parameter name="releaseType">
+    <crn:value xsi:type="xsd:string">ga</crn:value>
+  </crn:parameter>
+  <crn:parameter name="licenseType">
+    <crn:value xsi:type="xsd:string">production</crn:value>
+  </crn:parameter>
+  <!-- advancedProperties: Specifies a set of advanced properties.  -->
+  <!-- The user needs to provide the name and the value for each advanced property.  -->
+  <crn:parameter name="advancedProperties" opaque="true">
+    <crn:value xsi:type="cfg:array"/>
+  </crn:parameter>
+  <!-- serverLocale: Specifies the server locale.  -->
+  <!-- The server locale is set using the language selected during installation, but can
+       be changed. This property ensures all log messages are written in one language determined
+       by server locale. If the data in the log is in multiple languages, you may want to
+       override this value so that messages are logged using UTF8 encoding. To do this,
+       set the value of the UTF8 encoding property to true for the Logging component.  -->
+  <crn:parameter name="serverLocale">
+    <crn:value xsi:type="xsd:language">en</crn:value>
+  </crn:parameter>
+  <!-- serverTimeZoneID: Specifies the time zone used by Content Manager.  -->
+  <!-- Use this property to identify the time zone used by Content Manager. Time zones are
+       used as the time reference in schedules and other system times.  -->
+  <crn:parameter name="serverTimeZoneID">
+    <crn:value xsi:type="cfg:timeZone">Europe/Dublin</crn:value>
+  </crn:parameter>
+  <!-- defaultFont: Specifies the font used in PDF reports when no fonts can be found in
+       the stylesheet to display the data.  -->
+  <!-- Use one of the globally supported font names.  -->
+  <crn:parameter name="defaultFont">
+    <crn:value xsi:type="xsd:string">Andale WT</crn:value>
+  </crn:parameter>
+  <!-- emailEncoding: Specifies the email encoding.  -->
+  <!-- The specified encoding will be used for subject and body text when sending email.
+       This has no effect on attachments or the HTML body.  -->
+  <crn:parameter name="emailEncoding">
+    <crn:value xsi:type="xsd:string">utf-8</crn:value>
+  </crn:parameter>
+  <!-- bvMaxAttachmentSize: This parameter specifies the maximum size of a file attachment
+       that can be uploaded to the Business Viewpoint server.  -->
+  <!-- A value of 0 indicates that the maximum size is unlimited.  -->
+  <crn:parameter name="bvMaxAttachmentSize" disabled="true">
+    <crn:value xsi:type="xsd:unsignedShort">1024</crn:value>
+  </crn:parameter>
+  <!-- deploymentPath: Specifies the location where deployment archives are stored.  -->
+  <!-- Because a deployment archive can contain sensitive information, for security reasons
+       you may wish to restrict access to this location.  -->
+  <crn:parameter name="deploymentPath">
+    <crn:value xsi:type="cfg:folderPath">../deployment</crn:value>
+  </crn:parameter>
+  <crn:parameter name="doReportSpecUpgrade">
+    <crn:value xsi:type="xsd:boolean">false</crn:value>
+  </crn:parameter>
+  <!-- data: Specifies the location where data files created by the product components are
+       stored.  -->
+  <!-- You can't delete these files. These files remain on your computer until they are
+       no longer required by the component that created them.  -->
+  <crn:parameter name="data">
+    <crn:value xsi:type="cfg:folderPath">../data</crn:value>
+  </crn:parameter>
+  <!-- mapFileLocation: Specifies the location of the folder that contains the IBM Cognos
+       map files (*.cmf).  -->
+  <!-- IBM Cognos map files contain drawing information and localized strings used when
+       rendering maps.  -->
+  <crn:parameter name="mapFileLocation">
+    <crn:value xsi:type="cfg:folderPath">../maps</crn:value>
+  </crn:parameter>
+  <!-- temp: Specifies the location of the folder that contains recently viewed reports.  -->
+  <!-- The product creates temporary files each time you open a report. The product stores
+       these temporary files in the location you specify. The product may not delete all
+       temporary files when it closes and they may remain on your computer until you delete
+       them.  -->
+  <crn:parameter name="temp">
+    <crn:value xsi:type="cfg:folderPath">../temp</crn:value>
+  </crn:parameter>
+  <!-- encryptTemporaryFiles: Specifies whether the content of temporary files is encrypted.  -->
+  <!-- If recently viewed reports contain sensitive data, set the value of this property
+       to 'true' to encrypt the content of temporary files.  -->
+  <crn:parameter name="encryptTemporaryFiles">
+    <crn:value xsi:type="xsd:boolean">false</crn:value>
+  </crn:parameter>
+  <!-- formatSpecificationLocation: Specifies the name and location of a file that contains
+       format specifications.  -->
+  <crn:parameter name="formatSpecificationLocation">
+    <crn:value xsi:type="cfg:filePath">../configuration/cogformat.xml</crn:value>
+  </crn:parameter>
+  <!-- sortMemory: Specifies the sort buffer size to use for local processing.  -->
+  <!-- Queries which are not processed entirely within a database server may require local
+       processing that involves sorting. Sorting operations use a memory buffer which will
+       overflow to temporary storage for larger sort operations. Increasing the sort memory
+       can improve performance by reducing the number of read and write operations to the
+       temporary storage. Allocating too much memory to concurrent sorting operations may
+       impact the memory management of the operating system.  -->
+  <crn:parameter name="sortMemory">
+    <crn:value xsi:type="xsd:unsignedInt"><%= scope['cognos::sort_memory'] %></crn:value>
+  </crn:parameter>
+  <!-- networkConfiguration: Specifies the IP version for host name resolution.  -->
+  <!-- Use this property to specify the internet protocol version for host name resolution.  -->
+  <crn:parameter name="networkConfiguration">
+    <crn:value xsi:type="xsd:string">IPv4</crn:value>
+  </crn:parameter>
+  <!-- gateway: Specifies the URI to the gateway.  -->
+  <!-- Use the 'https' or 'http' protocol to select SSL or non-SSL communication. The host
+       name portion of the gateway URI must be changed from localhost to an IP address or
+       a network host name.  -->
+  <crn:parameter name="gateway">
+    <crn:value xsi:type="xsd:anyURI">http://<%= @fqdn %>:9300/bi/v1/disp</crn:value>
+  </crn:parameter>
+  <!-- gatewayNamespace: Specifies the Namespace ID of the authentication provider to which
+       the gateway connects to verify user credentials.  -->
+  <!-- Use this property so that the gateway connects to one namespace. Users logged onto
+       the Web server where the gateway is located are not prompted to choose an authentication
+       source. By default, the gateway uses all configured namespaces and you are prompted
+       to select a namespace.  -->
+  <crn:parameter name="gatewayNamespace">
+    <crn:value xsi:type="xsd:string"></crn:value>
+  </crn:parameter>
+  <!-- gatewayCMSPNName: Specifies the sAMAccountName of the user running Content Manager.  -->
+  <!-- This value must be set if you are using kerberos authentication with constrained
+       delegation and IBM Cognos BI is installed on Microsoft Windows operating systems.  -->
+  <crn:parameter name="gatewayCMSPNName">
+    <crn:value xsi:type="xsd:string"></crn:value>
+  </crn:parameter>
+  <!-- overrideNamespace: Setting this property to true authenticates requests from the
+       Portal Services portlets against the specified namespace for the third-party portal.  -->
+  <!-- When integrating IBM Cognos portlets within a third-party portal, it is often a requirement
+       to enable single signon to automatically authenticate users. When enabling single
+       signon, the Allow Namespace Override parameter in IBM Cognos Configuration must be
+       set to true. Additionally, within the third-party portal, a parameter must be set
+       in the IBM Cognos portlets to explicitly point to one distinct namespace ID. The
+       Allow Namespace Override parameter notifies the IBM Cognos portlets to use the namespace
+       defined within the third-party portal for single signon. If you are not using IBM
+       Cognos' portlets within a third-party portal, this setting should remain false. For
+       more information on how to enable single signon for third-party portals, see the
+       Portal Services Administration chapter of the IBM Cognos Administration and Security
+       Guide.  -->
+  <crn:parameter name="overrideNamespace">
+    <crn:value xsi:type="xsd:boolean">false</crn:value>
+  </crn:parameter>
+  <!-- gatewayDispatcherURIList: Specifies one or more URIs to Dispatchers that the Gateway
+       may use.  -->
+  <!-- This property is used by the gateway to send requests to IBM Cognos. The first dispatcher
+       in the list is the default dispatcher to which requests will be sent. If the first
+       dispatcher becomes unreachable, the second dispatcher in the list becomes the default
+       dispatcher, and so on. The URI values must match External dispatcher URI of dispatchers
+       in your installation except they must also have '/ext' at the end. They must specify
+       a network host name or IP address rather than 'localhost'.  -->
+  <crn:parameter name="gatewayDispatcherURIList" opaque="true">
+    <crn:value xsi:type="cfg:sortedArray">
+      <crn:item xsi:type="xsd:anyURI" order="0">http://127.0.0.1:9300/bi/v1/disp</crn:item>
+    </crn:value>
+  </crn:parameter>
+  <!-- controllerServerURI: Specifies the URI to the IBM Cognos Controller server, if present.  -->
+  <!-- This property is used by the gateway to send requests to IBM Cognos Controller server.  -->
+  <crn:parameter name="controllerServerURI">
+    <crn:value xsi:type="xsd:anyURI">http://127.0.0.1:80/ibmcognos/controllerServer</crn:value>
+  </crn:parameter>
+  <!-- externalDispatcher: Specifies the URI to the dispatcher that processes requests from
+       a gateway or service on a remote computer.  -->
+  <!-- This property defines the HTTP endpoint through which the dispatcher receives requests
+       that originate on other computers. It identifies this dispatcher to other dispatchers
+       that are part of the same installation. Use the 'https' or 'http' protocol to select
+       SSL or non-SSL communication. Specify a vacant port number. The dispatcher will use
+       the computer's network hostname by default. In some cases it may be necessary to
+       specify the network host name or an IP address. If the host name portion of the URI
+       is set to 'localhost', ensure that 'localhost' is defined on the computer.  -->
+  <crn:parameter name="externalDispatcher">
+    <crn:value xsi:type="cfg:localURI">http://127.0.0.1:9300/p2pd/servlet/dispatch</crn:value>
+  </crn:parameter>
+  <!-- internalDispatcher: Specifies the URI to the dispatcher that processes requests from
+       services on the same computer.  -->
+  <!-- This property defines the HTTP endpoint through which the dispatcher receives requests
+       from the local computer. It must have the same value as External dispatcher URI unless
+       you choose to use SSL only for external requests. In that case, External dispatcher
+       URI will specify 'https' and Internal dispatcher URI will specify 'http', and the
+       port numbers must be different. The hostname portion of the URI must refer to the
+       local computer. If the host name portion of the URI is set to 'localhost', ensure
+       that 'localhost' is defined on the computer.  -->
+  <crn:parameter name="internalDispatcher">
+    <crn:value xsi:type="cfg:localURI">http://127.0.0.1:9300/p2pd/servlet/dispatch</crn:value>
+  </crn:parameter>
+  <!-- disp_sharedsecret: Specifies the password that enables secure communication between
+       Dispatchers.  -->
+  <!-- This property is case-sensitive.  -->
+  <crn:parameter name="disp_sharedsecret">
+    <crn:value xsi:type="cfg:systemPassword">NoPassWordSet</crn:value>
+  </crn:parameter>
+  <!-- jmxPort: Specifies the port number to the JMX administration interface.  -->
+  <!-- Set the value to 0 to disable the interface.  -->
+  <crn:parameter name="jmxPort">
+    <crn:value xsi:type="xsd:int">0</crn:value>
+  </crn:parameter>
+  <!-- jmxCredential: Specifies a username and password for securing the JMX administration
+       interface.  -->
+  <!-- Be sure to configure a port in addition to setting a username and password.  -->
+  <crn:parameter name="jmxCredential">
+    <crn:value xsi:type="cfg:credential">
+      <credential>
+        <username/>
+        <password/>
+      </credential>
+    </crn:value>
+  </crn:parameter>
+  <!-- rsvpExecutionMode: Specifies the Report Server execution mode.  -->
+  <!-- The 64-bit mode is applicable only to 64-bit installations.  -->
+  <crn:parameter name="rsvpExecutionMode">
+    <crn:value xsi:type="xsd:string">64-bit</crn:value>
+  </crn:parameter>
+  <!-- sdk: Specifies the URI used by the Framework Manager, Metrics Designer, Dynamic Query
+       Analyzer or SDK to send requests to IBM Cognos.  -->
+  <!-- The value typically corresponds to the External dispatcher URI of one of the dispatchers
+       in your installation. It must use the real network host name or IP address instead
+       of localhost. If Framework Manager, Metrics Designer, Dynamic Query Analyzer or SDK
+       clients connect to IBM Cognos through an intermediary like a load balancer or proxy,
+       specify the host and port of the intermediary. This property is used by Framework
+       Manager when publishing models, by Metrics Designer when creating metrics, by Dynamic
+       Query Analyer when querying Content Manager or send request to Dynamic Query Cube,
+       and by SDK developers when querying Content Manager for output. IBM Cognos must be
+       able to locate a gateway or dispatcher running on a Web server that supports chunking
+       and attachments to handle large volumes of data. If there is no firewall between
+       Framework Manager, Metrics Designer, Dynamic Query Analyzer or SDK users and IBM
+       Cognos, components use the default setting. If there is a firewall, you must have
+       access to at least one Web server that supports chunking outside of the firewall.
+       The http or https protocol prefix indicates if SSL is required.  -->
+  <crn:parameter name="sdk">
+    <crn:value xsi:type="xsd:anyURI">http://<%= @fqdn %>:<%= scope['cognos::external_dispatcher_uri_port'] %>/bi/v1/disp</crn:value>
+  </crn:parameter>
+  <!-- contentManagers: Specifies one or more URIs to the Content Manager.  -->
+  <!-- Use the 'https' or 'http' protocol to select SSL or non-SSL communication. This property
+       is used by dispatchers and services to send requests to the Content Manager. If you
+       are using Standby Content Manager functionality, enter the URIs of all Content Managers.
+       If the host name portion of the URI is set to 'localhost', ensure that 'localhost'
+       is defined on the computer.  -->
+  <crn:parameter name="contentManagers" opaque="true">
+    <crn:value xsi:type="cfg:array">
+      <crn:item xsi:type="xsd:anyURI">http://<%= @fqdn %>:9300/p2pd/servlet</crn:item>
+    </crn:value>
+  </crn:parameter>
+  <crn:parameter name="retrieveConfigUser">
+    <crn:value xsi:type="xsd:string"></crn:value>
+  </crn:parameter>
+  <crn:parameter name="retrieveConfigPassword">
+    <crn:value xsi:type="cfg:systemPassword"></crn:value>
+  </crn:parameter>
+  <crn:parameter name="retrieveConfigNamespaceID">
+    <crn:value xsi:type="xsd:string"></crn:value>
+  </crn:parameter>
+  <!-- DSSOAPServerURI: Specifies the URI to the Data Manager SOAP Server.  -->
+  <crn:parameter name="DSSOAPServerURI" disabled="true">
+    <crn:value xsi:type="cfg:localURI">http://localhost:9300/axis</crn:value>
+  </crn:parameter>
+  <!-- fontPaths: Specifies the locations of font files.  -->
+  <crn:parameter name="fontPaths">
+    <crn:value xsi:type="xsd:string">../bin/fonts</crn:value>
+  </crn:parameter>
+  <!-- brsPDFEmbeddableFonts: Specifies the fonts that may be embedded in a PDF document
+       by the batch report service.  -->
+  <!-- The decision to always or never embed a font in a PDF document is based on whether
+       embedding was allowed and if the document used characters that are not part of the
+       windows-1252 character encoding.  -->
+  <crn:parameter name="brsPDFEmbeddableFonts">
+    <crn:value xsi:type="cfg:fontsEmbed"></crn:value>
+  </crn:parameter>
+  <!-- brsPDFNonEmbeddableFonts: Specifies the fonts that may not be embedded in a PDF document
+       by the batch report service.  -->
+  <!-- The decision to not embed a font in a PDF document is based on whether the embedding
+       was allowed and if the document used characters that are not part of the windows-1252
+       character encoding.  -->
+  <crn:parameter name="brsPDFNonEmbeddableFonts">
+    <crn:value xsi:type="cfg:fontsEmbed"></crn:value>
+  </crn:parameter>
+  <!-- rsPDFEmbeddableFonts: Specifies the fonts that may be embedded in a PDF document
+       by the report service.  -->
+  <!-- The decision to always or never embed a font in a PDF document is based on whether
+       embedding was allowed and if the document used characters that are not part of the
+       windows-1252 character encoding.  -->
+  <crn:parameter name="rsPDFEmbeddableFonts">
+    <crn:value xsi:type="cfg:fontsEmbed"></crn:value>
+  </crn:parameter>
+  <!-- rsPDFNonEmbeddableFonts: Specifies the fonts that may not be embedded in a PDF document
+       by the report service.  -->
+  <!-- The decision to not embed a font in a PDF document is based on whether the embedding
+       was allowed and if the document used characters that are not part of the windows-1252
+       character encoding.  -->
+  <crn:parameter name="rsPDFNonEmbeddableFonts">
+    <crn:value xsi:type="cfg:fontsEmbed"></crn:value>
+  </crn:parameter>
+  <crn:parameter name="feedbackPort">
+    <crn:value xsi:type="xsd:unsignedShort">9363</crn:value>
+  </crn:parameter>
+  <!-- CFS: Defines the properties for the configuration group.  -->
+  <crn:parameter name="CFS" opaque="true">
+    <crn:value>
+      <!-- configGroupName: Specifies the name of the configuraiton group.  -->
+      <!-- A name that defines a group of installs/servers that share configuration in a configuration
+           group. This value must be the same for all servers in the configuration group, and
+           must be unique for each group. Different configuration groups must have a different
+           name. A descriptive name like "inventory_production" is recommended  -->
+      <crn:parameter name="configGroupName">
+        <crn:value xsi:type="xsd:string">GRP_<%= @hostname %></crn:value>
+      </crn:parameter>
+      <!-- configGroupPassword: Specifies the password that enables secure communication between
+           members of configuration group.  -->
+      <!-- The password must be the same for all members of the group.  -->
+      <crn:parameter name="configGroupPassword">
+        <crn:value xsi:type="cfg:systemPassword"></crn:value>
+      </crn:parameter>
+      <!-- configGroupContactPort: Specifies the port number used for group communication and
+           coordination on the primary configuration group member.  -->
+      <!-- Other CA installs use this port and group contact host as the initial way to join
+           the configuration group  -->
+      <crn:parameter name="configGroupContactPort">
+        <crn:value xsi:type="xsd:int">5701</crn:value>
+      </crn:parameter>
+      <!-- configGroupContactHost: Specifies the host name of the primary configuration group
+           member. It should be the same host as primary Content Manager install.  -->
+      <crn:parameter name="configGroupContactHost">
+        <crn:value xsi:type="xsd:string"><%= @fqdn %></crn:value>
+      </crn:parameter>
+      <!-- configGroupMemberSyncPort: Specifies the local port number used for network communication
+           that transfers and synchronizes configuration information from one server to another.  -->
+      <!-- It can be any free port  -->
+      <crn:parameter name="configGroupMemberSyncPort">
+        <crn:value xsi:type="xsd:int">4300</crn:value>
+      </crn:parameter>
+      <!-- configGroupMemberCoordinationPort: Specifies the local port number used for network
+           communication for group coordination.  -->
+      <!-- This port is used to discover and join a group, and to maintain an up to date list
+           of configuration group members. On the primary CM install group contact port is the
+           same port.  -->
+      <crn:parameter name="configGroupMemberCoordinationPort">
+        <crn:value xsi:type="xsd:int">5701</crn:value>
+      </crn:parameter>
+    </crn:value>
+  </crn:parameter>
+  <!-- pmpService: Defines a group of properties for the TM1 Application Server.  -->
+  <crn:parameter name="pmpService" opaque="true" disabled="true">
+    <crn:value>
+      <!-- pmpMaxMemory: Specifies the maximum amount of memory in MB that can be used by the
+           process.  -->
+      <!-- This value determines the amount of memory used by the Java Virtual Machine and depends
+           on how much memory is available. If this value is too high, the process will fail
+           to start and no log information will be generated.  -->
+      <crn:parameter name="pmpMaxMemory" disabled="true">
+        <crn:value xsi:type="xsd:unsignedInt"><%= scope['cognos::pmp_max_memory'] %></crn:value>
+      </crn:parameter>
+      <!-- pmpShutdownPort: Specifies the port the product uses to listen for a shutdown command.  -->
+      <!-- The port number is used by Tomcat. When you change the port, it is automatically
+           updated in the server.xml file located in the cognos_location/tomcat/conf directory.  -->
+      <crn:parameter name="pmpShutdownPort" disabled="true">
+        <crn:value xsi:type="xsd:unsignedShort">9513</crn:value>
+      </crn:parameter>
+      <!-- pmpGatewayURI: Specifies the URI to the gateway.  -->
+      <!-- The gateway must be located on the same computer as a Web server.  -->
+      <crn:parameter name="pmpGatewayURI" disabled="true">
+        <crn:value xsi:type="xsd:anyURI">http://localhost:9510/pmpsvc</crn:value>
+      </crn:parameter>
+      <!-- pmpExternalURI: Specifies the external URI used to access the service.  -->
+      <!-- Specifies the external URI used to access the service when it is placed behind a
+           firewall. This element will default to the internal service URI.  -->
+      <crn:parameter name="pmpExternalURI" disabled="true">
+        <crn:value xsi:type="cfg:hostportURI">http://localhost:9510</crn:value>
+      </crn:parameter>
+      <!-- pmpSessionTimeout: Planning service portal session timeout.  -->
+      <!-- Specifies the length of idle time permitted before a session is terminated.  -->
+      <crn:parameter name="pmpSessionTimeout" disabled="true">
+        <crn:value xsi:type="xsd:string">60</crn:value>
+      </crn:parameter>
+      <!-- pmpForceQualifiedPaths: Force qualified paths.  -->
+      <!-- Force qualified paths.  -->
+      <crn:parameter name="pmpForceQualifiedPaths" disabled="true">
+        <crn:value xsi:type="xsd:boolean">true</crn:value>
+      </crn:parameter>
+      <!-- pmpNotificationsProvider: Specifies the Notifications provider.  -->
+      <!-- Specifies the Notifications provider, used to control the delivery of notifications.
+           DLS: Emails will be sent (if a mail server is configured), but no notifications will
+           appear in the Cognos Inbox. HTS: Notifications will be sent to the Cognos Inbox,
+           and emails will also be sent if a mail server is configured.  -->
+      <crn:parameter name="pmpNotificationsProvider" disabled="true">
+        <crn:value xsi:type="xsd:string"></crn:value>
+      </crn:parameter>
+      <!-- pmpBVEnable: Enable Business Viewpoint.  -->
+      <!-- Enable Business Viewpoint.  -->
+      <crn:parameter name="pmpBVEnable" disabled="true">
+        <crn:value xsi:type="xsd:boolean">false</crn:value>
+      </crn:parameter>
+      <!-- pmpBVURI: Specifies Business Viewpoint URI.  -->
+      <!-- Specifies Business Viewpoint URI.  -->
+      <crn:parameter name="pmpBVURI" disabled="true">
+        <crn:value xsi:type="xsd:anyURI">http://localhost:9510/bv</crn:value>
+      </crn:parameter>
+      <!-- pmpSCEnable: Enable Scorecarding.  -->
+      <!-- Enable Scorecarding.  -->
+      <crn:parameter name="pmpSCEnable" disabled="true">
+        <crn:value xsi:type="xsd:boolean">true</crn:value>
+      </crn:parameter>
+      <!-- pmpBIFolderName: Specify the default name of the Cognos 10 folder.  -->
+      <!-- Used to specify the default name of the Cognos 10 folder which will be created at
+           the Public Folders level to contain URL objects.  -->
+      <crn:parameter name="pmpBIFolderName" disabled="true">
+        <crn:value xsi:type="xsd:string">IBM Cognos TM1 Application - My Applications</crn:value>
+      </crn:parameter>
+      <!-- pmpAppDefPath: The path to the location of the TM1 Application definitions. This
+           may be a UNC reference.  -->
+      <!-- Used to specify the location of the application definition files.  -->
+      <crn:parameter name="pmpAppDefPath" disabled="true">
+        <crn:value xsi:type="cfg:folderPath"></crn:value>
+      </crn:parameter>
+      <!-- pmpUserPrefPath: The path to the location of the User preference files.  -->
+      <!-- Used to specify the location of the user preference files. This only applies to TM1
+           servers authenticated using Native TM1 security.  -->
+      <crn:parameter name="pmpUserPrefPath" disabled="true">
+        <crn:value xsi:type="cfg:folderPath"></crn:value>
+      </crn:parameter>
+      <!-- pmpResourcePath: Specifies the location of the string xml files that store the TM1
+           Application Server configuration.  -->
+      <!-- Specifies the name of the folder where the string xml files are located.  -->
+      <crn:parameter name="pmpResourcePath" disabled="true">
+        <crn:value xsi:type="cfg:folderPath"></crn:value>
+      </crn:parameter>
+      <!-- pmpDispatcherURI: Specifies the URI to the dispatcher that processes requests from
+           services on the same computer.  -->
+      <crn:parameter name="pmpDispatcherURI" disabled="true">
+        <crn:value xsi:type="xsd:anyURI">http://localhost:9510/pmpsvc/dispatcher/servlet</crn:value>
+      </crn:parameter>
+      <!-- pmpTrustedUser: Specifies the user ID and password.  -->
+      <!-- This value identifies the planning user that has access privileges to the planning
+           server. Services use this account to authenticate with the planning server.  -->
+      <crn:parameter name="pmpTrustedUser" disabled="true">
+        <crn:value xsi:type="cfg:credential">
+          <credential>
+            <username/>
+            <password/>
+          </credential>
+        </crn:value>
+      </crn:parameter>
+      <!-- pmpNamespace: Specifies the namespace information.  -->
+      <!-- This property is optional. It specifies the namespace information required for authentication.  -->
+      <crn:parameter name="pmpNamespace" disabled="true">
+        <crn:value xsi:type="xsd:string"></crn:value>
+      </crn:parameter>
+      <!-- pmpTm1Clients: Configuration settings for TM1 Clients  -->
+      <crn:parameter name="pmpTm1Clients" opaque="true" disabled="true">
+        <crn:value>
+          <!-- pmpProvisionURI: Specifies the URI of provisioning site.  -->
+          <!-- Specifies the URI of provisioning site. This element will default to planning service
+               application URI.  -->
+          <crn:parameter name="pmpProvisionURI" disabled="true">
+            <crn:value xsi:type="xsd:anyURI"></crn:value>
+          </crn:parameter>
+          <!-- pmpProvisionAllowInstall: Specifies whether clients may be provisioned from the TM1
+               Application Server.  -->
+          <!-- Specifies whether client software may be provisioned to end user machines.  -->
+          <crn:parameter name="pmpProvisionAllowInstall" disabled="true">
+            <crn:value xsi:type="xsd:boolean">true</crn:value>
+          </crn:parameter>
+          <!-- pmpProvisionAllowUpdate: Specifies whether existing clients may be updated from the
+               TM1 Application Server.  -->
+          <!-- Specifies whether existing client software on end user machines may be updated if
+               the TM1 Application Server is updated.  -->
+          <crn:parameter name="pmpProvisionAllowUpdate" disabled="true">
+            <crn:value xsi:type="xsd:boolean">true</crn:value>
+          </crn:parameter>
+          <!-- pmpInsightPublishEnable: Enable publish from Cognos Insight.  -->
+          <!-- Enable publish from Cognos Insight.  -->
+          <crn:parameter name="pmpInsightPublishEnable" disabled="true">
+            <crn:value xsi:type="xsd:boolean">true</crn:value>
+          </crn:parameter>
+          <!-- pmpsvcPingTime: Specifies the frequency that the Cognos Insight pings TM1 Application
+               Server.  -->
+          <!-- Specifies the frequency that the Cognos Insight client, in 'Contributor mode' pings
+               the TM1 Application Server. Default is 30 seconds.  -->
+          <crn:parameter name="pmpsvcPingTime" disabled="true">
+            <crn:value xsi:type="xsd:string">30</crn:value>
+          </crn:parameter>
+        </crn:value>
+      </crn:parameter>
+    </crn:value>
+  </crn:parameter>
+  <!-- tm1ExcelService: Defines a group of properties for the TM1 Excel service  -->
+  <!-- TM1 Excel service support TM1 Web with Export to Excel capabilities.  -->
+  <crn:parameter name="tm1ExcelService" opaque="true" disabled="true">
+    <crn:value>
+      <!-- advancedProperties: Specifies a set of advanced properties.  -->
+      <!-- The user needs to provide the name and the value for each advanced property.  -->
+      <crn:parameter name="advancedProperties" opaque="true" disabled="true">
+        <crn:value xsi:type="cfg:array"/>
+      </crn:parameter>
+    </crn:value>
+  </crn:parameter>
+  <!-- tm1AdminServer: Defines a group of properties for the TM1 Admin Server.  -->
+  <crn:parameter name="tm1AdminServer" opaque="true" disabled="true">
+    <crn:value>
+      <!-- tm1AdminNonSSLPortNumber: Specifies the TCP port number used by TM1 Admin Server
+           for unsecured communication.  -->
+      <crn:parameter name="tm1AdminNonSSLPortNumber" disabled="true">
+        <crn:value xsi:type="xsd:unsignedShort">5495</crn:value>
+      </crn:parameter>
+      <!-- tm1AdminSSLPortNumber: Specifies the TCP port number used by TM1 Admin Server for
+           secured (SSL) communication.  -->
+      <crn:parameter name="tm1AdminSSLPortNumber" disabled="true">
+        <crn:value xsi:type="xsd:unsignedShort">5498</crn:value>
+      </crn:parameter>
+      <!-- tm1AdminSupportNonSSLClients: Specifies if the TM1 Admin Server supports non-SSL
+           TM1 clients.  -->
+      <!-- Set the parameter to true to configure TM1 Admin Server to support non-SSL clients
+           and to listen for client connections on both secured (SSL) and unsecured ports. If
+           set to false TM1 Admin Server will support only SSL client connections on the secured
+           port.  -->
+      <crn:parameter name="tm1AdminSupportNonSSLClients" disabled="true">
+        <crn:value xsi:type="xsd:boolean">false</crn:value>
+      </crn:parameter>
+      <!-- tm1AdminDHFile2048: Specifies the location of the Diffie-Hellman 2048 bit key file.  -->
+      <!-- The full path of the file that contains a pre-generated Diffie-Hellman 2048 bit key.
+           The generation of Diffie-Hellman parameters can be computationally expensive. To
+           minimize the consumption of resources and to reduce the amount of time required to
+           load the TM1 server, the Diffie-Hellman 2048 bit key should be pre-generated and
+           stored in a file that is read when the TM1 Admin Server starts.  -->
+      <crn:parameter name="tm1AdminDHFile2048" disabled="true">
+        <crn:value xsi:type="cfg:filePath"></crn:value>
+      </crn:parameter>
+      <!-- tm1AdminDHFile1024: Specifies the location of the Diffie-Hellman 1024 bit key file.  -->
+      <!-- The full path of the file that contains a pre-generated Diffie-Hellman 1024 bit key.
+           The generation of Diffie-Hellman parameters can be computationally expensive. To
+           minimize the consumption of resources and to reduce the amount of time required to
+           load the TM1 server, the Diffie-Hellman 1024 bit key should be pre-generated and
+           stored in a file that is read when the TM1 Admin Server starts.  -->
+      <crn:parameter name="tm1AdminDHFile1024" disabled="true">
+        <crn:value xsi:type="cfg:filePath"></crn:value>
+      </crn:parameter>
+      <!-- tm1AdminDHFile512: Specifies the location of the Diffie-Hellman 512 bit key file.  -->
+      <!-- The full path of the file that contains a pre-generated Diffie-Hellman 512 bit key.
+           The generation of Diffie-Hellman parameters can be computationally expensive. To
+           minimize the consumption of resources and to reduce the amount of time required to
+           load the TM1 server, the Diffie-Hellman 512 bit key should be pre-generated and stored
+           in a file that is read when the TM1 Admin Server starts.  -->
+      <crn:parameter name="tm1AdminDHFile512" disabled="true">
+        <crn:value xsi:type="cfg:filePath"></crn:value>
+      </crn:parameter>
+      <!-- tm1AdminSSLCertificate: Specifies the location of the certificate file.  -->
+      <!-- The full path of the TM1 Admin Server certificate file, which contains the public/private
+           key pair.  -->
+      <crn:parameter name="tm1AdminSSLCertificate" disabled="true">
+        <crn:value xsi:type="cfg:filePath"></crn:value>
+      </crn:parameter>
+      <!-- tm1AdminSSLCertRevocationFile: Specifies the location of the certificate revocation
+           file.  -->
+      <!-- The full path of the TM1 Admin Server certificate revocation file. A certificate
+           revocation file will only exist in the event a certificate had been revoked.  -->
+      <crn:parameter name="tm1AdminSSLCertRevocationFile" disabled="true">
+        <crn:value xsi:type="cfg:filePath"></crn:value>
+      </crn:parameter>
+      <!-- tm1AdminExportSvrSSLCert: Specifies whether the TM1 Admin Server certificate should
+           be exported from the Windows certificate store.  -->
+      <!-- If the parameter value is true the TM1 Admin Server certificate is exported from
+           the Windows certificate store when the certificate is requested by the TM1 Admin
+           Server. You must also set the following TM1 Admin Server parameters: 'TM1 Admin Server
+           export key ID', 'TM1 Admin Server certificate ID', 'TM1 Admin Server private key
+           password file location', 'TM1 Admin Server password key file location', 'TM1 Admin
+           Server certificate authority file location'. For details on using your own security
+           certificates and exporting certificates from the Windows certificate store, see Using
+           Independent Certificates topic in TM1 Operation Guide.  -->
+      <crn:parameter name="tm1AdminExportSvrSSLCert" disabled="true">
+        <crn:value xsi:type="xsd:boolean">false</crn:value>
+      </crn:parameter>
+      <!-- tm1AdminSvrSSLExportKeyID: Specifies the identity key used to export the TM1 Admin
+           Server certificate from the Windows certificate store.  -->
+      <!-- This parameter is used only if you use the certificate store.  -->
+      <crn:parameter name="tm1AdminSvrSSLExportKeyID" disabled="true">
+        <crn:value xsi:type="xsd:string"></crn:value>
+      </crn:parameter>
+      <!-- tm1AdminSSLCertificateID: Specifies the name of the principal to whom the TM1 Admin
+           Server certificate is issued.  -->
+      <crn:parameter name="tm1AdminSSLCertificateID" disabled="true">
+        <crn:value xsi:type="xsd:string"></crn:value>
+      </crn:parameter>
+      <!-- tm1AdminSSLPrivateKeyPwdFile: Specifies the location of the private key password
+           file.  -->
+      <!-- The full path of the file that contains the encrypted password for the TM1 Admin
+           Server private key.  -->
+      <crn:parameter name="tm1AdminSSLPrivateKeyPwdFile" disabled="true">
+        <crn:value xsi:type="cfg:filePath"></crn:value>
+      </crn:parameter>
+      <!-- tm1AdminSSLPwdKeyFile: Specifies the location of the password key file.  -->
+      <!-- The full path of the file that contains the key used to encrypt and decrypt the password
+           for the private key.  -->
+      <crn:parameter name="tm1AdminSSLPwdKeyFile" disabled="true">
+        <crn:value xsi:type="cfg:filePath"></crn:value>
+      </crn:parameter>
+      <!-- tm1AdminSSLCertAuthority: Specifies the full path to the certificate authority file.  -->
+      <crn:parameter name="tm1AdminSSLCertAuthority" disabled="true">
+        <crn:value xsi:type="cfg:filePath"></crn:value>
+      </crn:parameter>
+      <!-- tm1AdminIPVersion: Specifies the Internet Protocol(s) which the TM1 Admin Server
+           will support.  -->
+      <crn:parameter name="tm1AdminIPVersion" disabled="true">
+        <crn:value xsi:type="xsd:string">IPv4</crn:value>
+      </crn:parameter>
+      <!-- tm1AdminActivityInterval: Specifies the interval in seconds wherein the TM1 Server
+           will notify the TM1 Admin Server that it is active.  -->
+      <crn:parameter name="tm1AdminActivityInterval" disabled="true">
+        <crn:value xsi:type="xsd:positiveInteger">10</crn:value>
+      </crn:parameter>
+      <!-- tm1AdminInactivityTimeout: Specifies the interval in seconds that the TM1 Server
+           is allowed to be inactive before it is removed from the TM1 Admin Server.  -->
+      <crn:parameter name="tm1AdminInactivityTimeout" disabled="true">
+        <crn:value xsi:type="xsd:positiveInteger">10</crn:value>
+      </crn:parameter>
+      <!-- tm1AdminSvrCertificateVersion: Specifies which version of the TM1 generated SSL certificates
+           to use.  -->
+      <!-- By default, the 1024-bit encryption version of the TM1 generated certificates is
+           used. Change this parameter only if you want to use the new 2048-bit encryption version
+           of the default certificates. You can use the new version with old and new TM1 clients,
+           but you must configure the clients to use the new certificate authority file. This
+           parameter does not apply if you are using your own SSL certificates. Valid values
+           include: 1 = certificate authority to enable 1024-bit encryption with sha-1 (default
+           value); 2 = certificate authority to enable 2048-bit encryption with sha-256.  -->
+      <crn:parameter name="tm1AdminSvrCertificateVersion" disabled="true">
+        <crn:value xsi:type="xsd:int">1</crn:value>
+      </crn:parameter>
+    </crn:value>
+  </crn:parameter>
+  <!-- mdmService: Defines a group of properties for the Tomcat application server.  -->
+  <!-- Business Viewpoint web application runs under the Tomcat server.  -->
+  <crn:parameter name="mdmService" opaque="true" disabled="true">
+    <crn:value>
+      <!-- mdmDefaultPort: Specifies the TCP port number on which the Tomcat server listens
+           for client connections.  -->
+      <crn:parameter name="mdmDefaultPort" disabled="true">
+        <crn:value xsi:type="xsd:unsignedShort">9410</crn:value>
+      </crn:parameter>
+      <!-- mdmSSLPort: Specifies the TCP port number on which the Tomcat server listens for
+           SSL client connections.  -->
+      <crn:parameter name="mdmSSLPort" disabled="true">
+        <crn:value xsi:type="xsd:unsignedShort">9443</crn:value>
+      </crn:parameter>
+      <!-- mdmUseSSL: Specifies if all requests sent to the default port have to be rerouted
+           to SSL port  -->
+      <crn:parameter name="mdmUseSSL" disabled="true">
+        <crn:value xsi:type="xsd:boolean">false</crn:value>
+      </crn:parameter>
+      <!-- mdmShutdownPort: Specifies the TCP port number on which the Tomcat server listens
+           for a shutdown request.  -->
+      <crn:parameter name="mdmShutdownPort" disabled="true">
+        <crn:value xsi:type="xsd:unsignedShort">9489</crn:value>
+      </crn:parameter>
+      <!-- mdmSessionTimeout: Specifies the time between client requests before the servlet
+           container invalidates the session.  -->
+      <!-- A value of -1 indicates the session should never timeout.  -->
+      <crn:parameter name="mdmSessionTimeout" disabled="true">
+        <crn:value xsi:type="xsd:int">60</crn:value>
+      </crn:parameter>
+    </crn:value>
+  </crn:parameter>
+  <!-- MDCSettings: Defines a group of properties for IBM Cognos Business Viewpoint server.  -->
+  <!-- Use these properties to specify connection information for the main Business Viewpoint
+       server.  -->
+  <crn:parameter name="MDCSettings" opaque="true" disabled="true">
+    <crn:value>
+      <!-- mdcServerHost: Specifies the name of the Business Viewpoint server machine.  -->
+      <crn:parameter name="mdcServerHost" disabled="true">
+        <crn:value xsi:type="cfg:hostOnly"></crn:value>
+      </crn:parameter>
+      <!-- mdcServerPort: Specifies the TCP port number on which the Business Viewpoint server
+           listens for client connections.  -->
+      <crn:parameter name="mdcServerPort" disabled="true">
+        <crn:value xsi:type="xsd:unsignedShort">9410</crn:value>
+      </crn:parameter>
+    </crn:value>
+  </crn:parameter>
+  <!-- MDCAdapters: Defines the adapters for IBM Cognos Business Viewpoint Client.  -->
+  <!-- Use these properties to configure the Business Viewpoint Client adapters.  -->
+  <crn:parameter name="MDCAdapters" opaque="true" disabled="true">
+    <crn:value>
+      <!-- mdc_adapter: Specifies the adapter type.  -->
+      <!-- You cannot change the value of this property. It is automatically set when you choose
+           the type of a new adapter.  -->
+      <crn:instances name="mdc_adapter" disabled="true">
+        <!-- Relational Database: Defines a group of properties for the Business Viewpoint Client
+             Relational Database adapter.  -->
+        <crn:instance name="Relational Database" class="mdcAdapterRelationalDB" disabled="true">
+          <!-- mdcAdapterEnabled: Use this flag to enable or disable this adapter.  -->
+          <crn:parameter name="mdcAdapterEnabled" disabled="true">
+            <crn:value xsi:type="xsd:boolean">true</crn:value>
+          </crn:parameter>
+          <!-- mdcAdapterId: Specifies the unique ID of this adapter.  -->
+          <!-- The IDs of all adapter configuration instances must be unique among all adapter instances
+               that are connected to the same Business Viewpoint server. This includes adapter instances
+               on other computers that are connected to the same server.  -->
+          <crn:parameter name="mdcAdapterId" disabled="true">
+            <crn:value xsi:type="xsd:int">100</crn:value>
+          </crn:parameter>
+        </crn:instance>
+      </crn:instances>
+    </crn:value>
+  </crn:parameter>
+  <!-- IPF: Defines a group of properties for the log server.  -->
+  <!-- Use this group of properties to provide access to the log server and specify where
+       the log server sends log messages. The log server can direct messages to any number
+       of destinations of any available type, such as a file, a database or a remote log
+       server.  -->
+  <crn:parameter name="IPF" opaque="true">
+    <crn:value>
+      <!-- logServerPort: Specifies the port used by the local log server.  -->
+      <!-- Ensure that you specify a port that is not already in use.  -->
+      <crn:parameter name="logServerPort">
+        <crn:value xsi:type="xsd:unsignedShort">9362</crn:value>
+      </crn:parameter>
+      <!-- enableTCPConnection: Specifies whether to use TCP protocol for communication between
+           the product components and the log server.  -->
+      <!-- If you set the value of this property to true, a TCP (Transmission Control Protocol)
+           connection is used to communicate with the log server. TCP guarantees the delivery
+           of packets in the same order in which they were sent. If you set this property to
+           false, UDP (User Datagram Protocol) connection is used.  -->
+      <crn:parameter name="enableTCPConnection">
+        <crn:value xsi:type="xsd:boolean">false</crn:value>
+      </crn:parameter>
+      <!-- workerThreads: Specifies the maximum number of threads available on the local log
+           server to manage incoming log messages.  -->
+      <!-- Enter a value between 1 and 20. The higher the number of threads, the more memory
+           allocated to processing messages.  -->
+      <crn:parameter name="workerThreads">
+        <crn:value xsi:type="xsd:unsignedShort">10</crn:value>
+      </crn:parameter>
+      <!-- appender: Specifies a unique instance of a device to which the log server directs
+           messages.  -->
+      <!-- The value of this property specifies the destination to which the log server directs
+           messages generated by the product. You cannot change the value of this property.
+           It is automatically set when you choose the destination type for logging in the Explorer
+           window.  -->
+      <crn:instances name="appender">
+        <!-- File: Defines a group of properties that allows the log server to direct messages
+             to a file.  -->
+        <!-- By default, all log messages are directed by the log server to a file stored on the
+             local computer. Not all log statements or messages indicate problems; some messages
+             are purely informational, while others help diagnose problems.  -->
+        <crn:instance name="File" class="file">
+          <!-- appenderName: Specifies the name and location of a file that contains log statements
+               or messages.  -->
+          <crn:parameter name="appenderName">
+            <crn:value xsi:type="cfg:filePath">../logs/cogserver.log</crn:value>
+          </crn:parameter>
+          <!-- appenderMaxSize: Specifies the maximum size of the log file in MB.  -->
+          <!-- When this limit is exceeded, a new backup file is created. Enter a number between
+               1 and 50.  -->
+          <crn:parameter name="appenderMaxSize">
+            <crn:value xsi:type="xsd:positiveInteger">10</crn:value>
+          </crn:parameter>
+          <!-- appenderRollOver: Specifies the maximum number of backup log files.  -->
+          <!-- When the limit is exceeded, the oldest log file is deleted. Each backup file is created
+               using a sequential file extension. For example, 'filename.1', 'filename.2'.  -->
+          <crn:parameter name="appenderRollOver">
+            <crn:value xsi:type="xsd:positiveInteger">10</crn:value>
+          </crn:parameter>
+          <!-- useUTF8Encoding: Specifies whether to use UTF-8 character set encoding for log messages.  -->
+          <!-- Set this value to true to use UTF-8 encoding. Otherwise, native encoding is used.  -->
+          <crn:parameter name="useUTF8Encoding">
+            <crn:value xsi:type="xsd:boolean">true</crn:value>
+          </crn:parameter>
+        </crn:instance>
+      </crn:instances>
+    </crn:value>
+  </crn:parameter>
+  <!-- CBS: Defines a group of properties for the IBM Cognos services.  -->
+  <!-- Use these properties to specify the amount of resources that the IBM Cognos services
+       use.  -->
+  <crn:parameter name="CBS" opaque="true">
+    <crn:value>
+      <!-- asvIsEnabled: Specifies whether the agent service is enabled.  -->
+      <!-- Use this property to enable or disable the agent service on the local computer. The
+           agent service executes agents. If the conditions for an agent are met, the agent
+           service signals the monitor service to execute the tasks. By default the agent service
+           is enabled.  -->
+      <crn:parameter name="asvIsEnabled">
+        <crn:value xsi:type="xsd:boolean">true</crn:value>
+      </crn:parameter>
+      <!-- ansIsEnabled: Specifies whether the annotation service is enabled.  -->
+      <!-- Use this property to enable or disable the annotation service on the local computer.
+           This service allows the ability to add commentary to reports. By default the annotation
+           service is enabled.  -->
+      <crn:parameter name="ansIsEnabled">
+        <crn:value xsi:type="xsd:boolean">true</crn:value>
+      </crn:parameter>
+      <!-- brsIsEnabled: Specifies whether the batch report service is enabled.  -->
+      <!-- Use this property to enable or disable the batch report service on the local computer.
+           The batch report service handles background requests for report executions and provides
+           output, on behalf of the monitor service. The batch report service works the same
+           as the report service, except it handles only background executions. By default the
+           batch report service is enabled.  -->
+      <crn:parameter name="brsIsEnabled">
+        <crn:value xsi:type="xsd:boolean">true</crn:value>
+      </crn:parameter>
+      <!-- cmIsEnabled: Specifies whether the Content Manager service is enabled.  -->
+      <!-- Use this property to enable or disable the Content Manager service on the local computer.
+           The Content Manager service is a service used by other services to store, organize,
+           and retrieve application data such as system configuration, models, report specifications,
+           report outputs, schedules, user accounts, groups, contacts, distribution lists and
+           data sources. A distributed installation may have one active Content Manager service,
+           and one or more standby Content Manager services. By default the Content Manager
+           service is enabled.  -->
+      <crn:parameter name="cmIsEnabled">
+        <crn:value xsi:type="xsd:boolean">true</crn:value>
+      </crn:parameter>
+      <!-- disIsEnabled: Specifies whether the data integration service is enabled.  -->
+      <!-- Use this property to enable or disable the data integration service on the local
+           computer. The data integration service manages the tasks that obtain data from data
+           sources, extract information from data stores, recalculate and transform data, and
+           load content for use by Metrics Manager in the portal. By default the data integration
+           service is enabled.  -->
+      <crn:parameter name="disIsEnabled" disabled="true">
+        <crn:value xsi:type="xsd:boolean">true</crn:value>
+      </crn:parameter>
+      <!-- dssoapIsEnabled: Specifies whether the Data Manager SOAP service is enabled.  -->
+      <!-- Use this property to enable or disable Data Manager SOAP service on the local computer.
+           By default Data Manager SOAP service is enabled.  -->
+      <crn:parameter name="dssoapIsEnabled" disabled="true">
+        <crn:value xsi:type="xsd:boolean">true</crn:value>
+      </crn:parameter>
+      <!-- dmsIsEnabled: Specifies whether the data movement service is enabled.  -->
+      <!-- Use this property to enable or disable the data movement service on the local computer.
+           The data movement service is used for CEBA-based requests for data movement tasks.
+           By default, the data movement service is enabled.  -->
+      <crn:parameter name="dmsIsEnabled" disabled="true">
+        <crn:value xsi:type="xsd:boolean">true</crn:value>
+      </crn:parameter>
+      <!-- dlsIsEnabled: Specifies whether the delivery service is enabled.  -->
+      <!-- Use this property to enable or disable the delivery service on the local computer.
+           The delivery service sends emails on behalf of other services, such as the report
+           service, job service or agent service. By default the delivery service is enabled.  -->
+      <crn:parameter name="dlsIsEnabled">
+        <crn:value xsi:type="xsd:boolean"><%= scope['cognos::enable_delivery_service'] %></crn:value>
+      </crn:parameter>
+      <!-- dispIsEnabled: Specifies whether the dispatcher related services are enabled.  -->
+      <!-- Use this property to enable or disable a number of services on the local computer.
+           Currently these are the batch report service, report service, data movement service,
+           metadata service and presentation service. By default these services are disabled
+           on computers where Content Manager is the only component that is installed. Please
+           note that the dispatcher itself will not be disabled.  -->
+      <crn:parameter name="dispIsEnabled">
+        <crn:value xsi:type="xsd:boolean">true</crn:value>
+      </crn:parameter>
+      <!-- emIsEnabled: Specifies whether the event management service is enabled.  -->
+      <!-- Use this property to enable or disable the event management service on the local
+           computer. The event management service manages scheduled task executions. When a
+           scheduled task execution begins, the event management service signals the monitor
+           service to begin the execution of the task. By default the event management service
+           is enabled.  -->
+      <crn:parameter name="emIsEnabled">
+        <crn:value xsi:type="xsd:boolean">true</crn:value>
+      </crn:parameter>
+      <!-- gsIsEnabled: Specifies whether the graphics service is enabled.  -->
+      <!-- Use this property to enable or disable the graphics service on the local computer.
+           The graphics service produces charts and graphics on behalf of the report service.
+           By default the graphics service is enabled.  -->
+      <crn:parameter name="gsIsEnabled">
+        <crn:value xsi:type="xsd:boolean">true</crn:value>
+      </crn:parameter>
+      <!-- htsIsEnabled: Specifies whether the human task service is enabled.  -->
+      <!-- Use this property to enable or disable the human task service on the local computer.
+           This service enables the ability to create and manage human tasks. A human task,
+           such as a report approval, can be assigned to individuals or groups on an ad-hoc
+           basis or by any of the other services. By default the human task service is enabled.  -->
+      <crn:parameter name="htsIsEnabled">
+        <crn:value xsi:type="xsd:boolean">true</crn:value>
+      </crn:parameter>
+      <!-- idVizIsEnabled: Specifies whether the interactive discovery visualization service
+           is enabled.  -->
+      <!-- Use this property to enable or disable the interactive discovery visualization service
+           on the local computer. The interactive discovery visualization service provides content
+           to IBM Cognos products to support interactive discovery and visualization functionality.
+           By default the interactive discovery visualization service is enabled.  -->
+      <crn:parameter name="idVizIsEnabled">
+        <crn:value xsi:type="xsd:boolean">true</crn:value>
+      </crn:parameter>
+      <!-- jsIsEnabled: Specifies whether the job service is enabled.  -->
+      <!-- Use this property to enable or disable the job service on the local computer. The
+           job service executes jobs and signals the monitor service to execute job steps in
+           the background. By default the job service is enabled.  -->
+      <crn:parameter name="jsIsEnabled">
+        <crn:value xsi:type="xsd:boolean">true</crn:value>
+      </crn:parameter>
+      <!-- mdsIsEnabled: Specifies whether the metadata service is enabled.  -->
+      <!-- Use this property to enable or disable the metadata service on the local computer.
+           The metadata service handles metadata requests including lineage, queryMetadata,
+           updateMetadata and testDataSourceConnection. By default, the metadata service is
+           enabled.  -->
+      <crn:parameter name="mdsIsEnabled">
+        <crn:value xsi:type="xsd:boolean">true</crn:value>
+      </crn:parameter>
+      <!-- cmmIsEnabled: Specifies whether Metrics Manager service is enabled.  -->
+      <!-- Use this property to enable or disable Metrics Manager service on the local computer.
+           The Metrics Manager service manages application requests, such as requests for Web
+           pages or application configuration information. By default the Metrics Manager service
+           is enabled.  -->
+      <crn:parameter name="cmmIsEnabled" disabled="true">
+        <crn:value xsi:type="xsd:boolean">true</crn:value>
+      </crn:parameter>
+      <!-- migsrvIsEnabled: Specifies whether the migration service is enabled.  -->
+      <!-- Use this property to enable or disable the migration service on the local computer.
+           The migration service is used to migrate PowerPlay content. By default the migration
+           service is disabled on computers where Content Manager is not installed.  -->
+      <crn:parameter name="migsrvIsEnabled" disabled="true">
+        <crn:value xsi:type="xsd:boolean">true</crn:value>
+      </crn:parameter>
+      <!-- mobIsEnabled: Specifies whether the mobile service is enabled.  -->
+      <!-- Use this property to enable or disable the mobile service on the local computer.
+           The mobile service allows content to be sent to mobile devices, and handles requests
+           from mobile devices. By default the mobile service is enabled.  -->
+      <crn:parameter name="mobIsEnabled">
+        <crn:value xsi:type="xsd:boolean">true</crn:value>
+      </crn:parameter>
+      <!-- msIsEnabled: Specifies whether the monitor service is enabled.  -->
+      <!-- Use this property to enable or disable the monitor service on the local computer.
+           The monitor service signals a target service to handle a task, then monitors the
+           execution of the task and collects and saves history information for the execution
+           of the task. The monitor service can also take control of asynchronous service conversations
+           on behalf of the client. By default the monitor service is enabled.  -->
+      <crn:parameter name="msIsEnabled">
+        <crn:value xsi:type="xsd:boolean">true</crn:value>
+      </crn:parameter>
+      <!-- pasIsEnabled: Specifies whether the planning administration console service is enabled.  -->
+      <!-- Use this property to enable or disable the planning administration console service
+           on the local computer. By default the planning administration console service is
+           enabled.  -->
+      <crn:parameter name="pasIsEnabled" disabled="true">
+        <crn:value xsi:type="xsd:boolean">true</crn:value>
+      </crn:parameter>
+      <!-- pdsIsEnabled: Specifies whether the planning data service is enabled.  -->
+      <!-- Use this property to enable or disable the planning data service on the local computer.
+           The planning data service manages report queries against IBM Cognos Planning - Contributor
+           data sources. By default, the planning data service is enabled.  -->
+      <crn:parameter name="pdsIsEnabled" disabled="true">
+        <crn:value xsi:type="xsd:boolean">true</crn:value>
+      </crn:parameter>
+      <!-- pjsIsEnabled: Specifies whether the planning job Data Manager service is enabled.  -->
+      <!-- Use this property to enable or disable the planning job service on the local computer.
+           By default the planning job service is enabled.  -->
+      <crn:parameter name="pjsIsEnabled" disabled="true">
+        <crn:value xsi:type="xsd:boolean">true</crn:value>
+      </crn:parameter>
+      <!-- pwsIsEnabled: Specifies whether the planning Web service is enabled.  -->
+      <!-- Use this property to enable or disable the planning Web service on the local computer.
+           By default the planning Web service is enabled.  -->
+      <crn:parameter name="pwsIsEnabled" disabled="true">
+        <crn:value xsi:type="xsd:boolean">true</crn:value>
+      </crn:parameter>
+      <!-- ppesIsEnabled: Specifies whether the PowerPlay service is enabled.  -->
+      <!-- Use this property to enable or disable the PowerPlay service on the local computer.
+           By default the PowerPlay service is enabled.  -->
+      <crn:parameter name="ppesIsEnabled" disabled="true">
+        <crn:value xsi:type="xsd:boolean">true</crn:value>
+      </crn:parameter>
+      <!-- xtscrnIsEnabled: Specifies whether the presentation service is enabled.  -->
+      <!-- Use this property to enable or disable the presentation service on the local computer.
+           The presentation service handles requests for IBM Cognos Connection, Query Studio,
+           and Event Studio. By default the presentation service is disabled on computers where
+           Content Manager is the only component that is installed.  -->
+      <crn:parameter name="xtscrnIsEnabled">
+        <crn:value xsi:type="xsd:boolean">true</crn:value>
+      </crn:parameter>
+      <!-- qsIsEnabled: Specifies whether the query service is enabled.  -->
+      <!-- Use this property to enable or disable the query service on the local computer. By
+           default the query service is enabled.  -->
+      <crn:parameter name="qsIsEnabled">
+        <crn:value xsi:type="xsd:boolean">true</crn:value>
+      </crn:parameter>
+      <!-- ccsIsEnabled: Specifies whether the report data service is enabled.  -->
+      <!-- Use this property to enable or disable the report data service on the local computer.
+           The report data service manages external client requests such as IBM Cognos BI for
+           Microsoft Office. By default the report data service is enabled.  -->
+      <crn:parameter name="ccsIsEnabled">
+        <crn:value xsi:type="xsd:boolean">true</crn:value>
+      </crn:parameter>
+      <!-- warpIsEnabled: Specifies whether the report service is enabled.  -->
+      <!-- Use this property to enable or disable the report service on the local computer.
+           The report service handles interactive requests for report executions and generates
+           output for a user in IBM Cognos Connection or one of the studios. By default the
+           report service is enabled.  -->
+      <crn:parameter name="warpIsEnabled">
+        <crn:value xsi:type="xsd:boolean">true</crn:value>
+      </crn:parameter>
+      <!-- repoIsEnabled: Specifies whether the repository service is enabled.  -->
+      <!-- Use this property to enable or disable the repository service on the local computer.
+           By default the repository service is enabled.  -->
+      <crn:parameter name="repoIsEnabled">
+        <crn:value xsi:type="xsd:boolean">true</crn:value>
+      </crn:parameter>
+      <!-- rmdsIsEnabled: Specifies whether the relational metadata service is enabled.  -->
+      <!-- Use this property to enable or disable the relational metadata service on the local
+           computer. By default the relational metadata service is enabled.  -->
+      <crn:parameter name="rmdsIsEnabled">
+        <crn:value xsi:type="xsd:boolean">true</crn:value>
+      </crn:parameter>
+      <!-- vgsIsEnabled: Specifies whether the visualization gallery service is enabled.  -->
+      <!-- Use this property to enable or disable the visualization gallery service on the local
+           computer. By default the visualization gallery service is enabled.  -->
+      <crn:parameter name="vgsIsEnabled">
+        <crn:value xsi:type="xsd:boolean">true</crn:value>
+      </crn:parameter>
+      <!-- cbs: Specifies the template used to configure the IBM Cognos service.  -->
+      <!-- This property is automatically set when you select a template for the IBM Cognos
+           service. You cannot change the value of this property in this window. If you want
+           to use another template, in the Explorer window, right-click the service and click
+           Delete. Right-click IBM Cognos service, click New resource, Configuration. Enter
+           a resource name and then select a template from the list.  -->
+      <crn:instances name="cbs">
+        <!-- IBM Cognos: Defines a group of properties for a configuration template used for WebSphere
+             Liberty Profile.  -->
+        <crn:instance name="IBM Cognos" class="WebSphereLiberty">
+          <!-- dispatcherPingTimeout: Specifies the maximum number of seconds to wait for a response
+               to a ping.  -->
+          <!-- If the ping is not responded to within the specified time interval, the process is
+               automatically restarted.  -->
+          <crn:parameter name="dispatcherPingTimeout">
+            <crn:value xsi:type="xsd:unsignedShort">240</crn:value>
+          </crn:parameter>
+          <!-- dispatcherStopWaitTime: Specifies the maximum number of seconds that the IBM Cognos
+               service waits for the process to stop.  -->
+          <!-- After this amount of time, the process is automatically stopped.  -->
+          <crn:parameter name="dispatcherStopWaitTime">
+            <crn:value xsi:type="xsd:unsignedShort">60</crn:value>
+          </crn:parameter>
+          <!-- dispatcherMaxMemory: Specifies the maximum amount of memory in MB that can be used
+               by the process.  -->
+          <!-- This value determines the amount of memory used by the Java Virtual Machine and depends
+               on how much memory is available. If this value is too high, the process will fail
+               to start and no log information will be generated. Invoke the test action to determine
+               if this value is valid.  -->
+          <crn:parameter name="dispatcherMaxMemory">
+            <crn:value xsi:type="xsd:unsignedInt"><%= scope['cognos::dispatcher_max_memory'] %></crn:value>
+          </crn:parameter>
+          <!-- wlpProperties: These properties are used to tune the WebSphere Liberty Profile (WLP)
+               server.  -->
+          <!-- The property value of 'coreThreads' represents the number of threads that the WLP
+               server starts up with. The 'maxThreads' value represents the maximum number of threads
+               that can be associated with the WLP server. Customize these values according to the
+               hardware resources available. For more information, refer to the WLP server documentation
+               (http://www-01.ibm.com/support/knowledgecenter/?lang=en#!/SSEQTP_8.5.5/com.ibm.websphere.wlp.doc/ae/twlp_tun.html?cp=SSEQTP_8.5.5%2F1-3-11-0-7).  -->
+          <crn:parameter name="wlpProperties" opaque="true">
+            <crn:value xsi:type="cfg:array">
+              <crn:parameter name="coreThreads">
+                <crn:value xsi:type="xsd:string">100</crn:value>
+              </crn:parameter>
+              <crn:parameter name="maxThreads">
+                <crn:value xsi:type="xsd:string">1500</crn:value>
+              </crn:parameter>
+            </crn:value>
+          </crn:parameter>
+        </crn:instance>
+      </crn:instances>
+    </crn:value>
+  </crn:parameter>
+  <!-- CPS: Defines the properties for the portal services.  -->
+  <crn:parameter name="CPS" opaque="true">
+    <crn:value>
+      <!-- webcontent: Specifies the URI of the portal services Web content.  -->
+      <!-- No value is required when the Web content, represented by the portal services portlets,
+           is used in IBM Cognos Connection. When the portlets are deployed to a third-party
+           portal, this value can optionally be used to specify an alternate Web content URI
+           where portal users can access portal services images and Web content. For example,
+           http://MyPortalImageServer/ibmcognos/.  -->
+      <crn:parameter name="webcontent">
+        <crn:value xsi:type="xsd:anyURI"></crn:value>
+      </crn:parameter>
+      <!-- applications: Specifies the URI or local file path of the applications.xml file.  -->
+      <!-- If your environment includes more than one instance of IBM Cognos, and you configure
+           different instances to use different applications.xml locations, each location must
+           contain the same version of the applications.xml file.  -->
+      <crn:parameter name="applications">
+        <crn:value xsi:type="xsd:string">http://localhost:9300/samples/cps4/applications.xml</crn:value>
+      </crn:parameter>
+      <!-- cps_namespaceID: Specifies the authentication namespace ID.  -->
+      <!-- Enter the value of an existing authentication namespace.  -->
+      <crn:parameter name="cps_namespaceID">
+        <crn:value xsi:type="xsd:string"></crn:value>
+      </crn:parameter>
+      <!-- cps_sharedSecret: Specifies the value of a key for single signon using the shared
+           secret method.  -->
+      <!-- This property is case-sensitive.  -->
+      <crn:parameter name="cps_sharedSecret">
+        <crn:value xsi:type="xsd:string"></crn:value>
+      </crn:parameter>
+    </crn:value>
+  </crn:parameter>
+  <!-- CDS: Defines a group of properties for Data Manager.  -->
+  <crn:parameter name="CDS" opaque="true" disabled="true">
+    <crn:value>
+      <!-- DS_DATA_DIR: Specifies the directory that Data Manager delivers text data files and
+           metadata files to.  -->
+      <crn:parameter name="DS_DATA_DIR" disabled="true">
+        <crn:value xsi:type="cfg:folderPath">../datamanager/data</crn:value>
+      </crn:parameter>
+      <!-- DS_LOG_DIR: Specifies the directory that Data Manager writes log files to when you
+           execute builds from a catalog.  -->
+      <crn:parameter name="DS_LOG_DIR" disabled="true">
+        <crn:value xsi:type="cfg:folderPath">../datamanager/log</crn:value>
+      </crn:parameter>
+      <!-- CDSNet: Defines a group of properties for Data Manager network services.  -->
+      <crn:parameter name="CDSNet" opaque="true" disabled="true">
+        <crn:value>
+          <!-- DS_NET_LOG_DIR: Specifies the directory that Data Manager network services writes
+               log files to.  -->
+          <crn:parameter name="DS_NET_LOG_DIR" disabled="true">
+            <crn:value xsi:type="cfg:folderPath">../datamanager/dsnetlog</crn:value>
+          </crn:parameter>
+          <!-- CDSNetClient: Defines a group of properties for Data Manager server connections.  -->
+          <crn:parameter name="CDSNetClient" opaque="true" disabled="true">
+            <crn:value>
+              <!-- DSNET_CLIENT_LOG_SEVERITY: Specifies the level of logging on the client. 1 = least
+                   verbose, 5 = most verbose.  -->
+              <crn:parameter name="DSNET_CLIENT_LOG_SEVERITY" disabled="true">
+                <crn:value xsi:type="xsd:unsignedShort">3</crn:value>
+              </crn:parameter>
+              <!-- DS_NET_DEFAULT_PORT: Specifies the default port for the remote connection.  -->
+              <crn:parameter name="DS_NET_DEFAULT_PORT" disabled="true">
+                <crn:value xsi:type="xsd:unsignedShort">9300</crn:value>
+              </crn:parameter>
+              <!-- DS_NET_DEFAULT_PROTOCOL: The default protocol used for remote connection.  -->
+              <!-- Use this property to specify the protocol for the remote connection.  -->
+              <crn:parameter name="DS_NET_DEFAULT_PROTOCOL" disabled="true">
+                <crn:value xsi:type="xsd:string">SOAP</crn:value>
+              </crn:parameter>
+              <!-- DSNET_DFLT_PWD: The default service access password for remote Data Manager Network
+                   servers.  -->
+              <!-- This password is used if no matched server connection entry is found for given host
+                   / port / protocol.  -->
+              <crn:parameter name="DSNET_DFLT_PWD" disabled="true">
+                <crn:value xsi:type="cfg:systemPassword">NoPassWordSet</crn:value>
+              </crn:parameter>
+              <crn:instances name="DS_NET_CONNECTION" disabled="true">
+                <!-- localhost: Defines a group of properties used to define a server connection.  -->
+                <!-- Ensure that the server exists and that the resource name is the host name of the
+                     remote server.  -->
+                <crn:instance name="localhost" class="DS_NET_SERVERCONNECTION" disabled="true">
+                  <!-- DS_NET_PORT: Specifies the port of the remote connection.  -->
+                  <crn:parameter name="DS_NET_PORT" disabled="true">
+                    <crn:value xsi:type="xsd:unsignedShort">9300</crn:value>
+                  </crn:parameter>
+                  <!-- DS_NET_PROTOCOL: The protocol used for remote connection.  -->
+                  <!-- Use this property to specify the protocol for the remote connection.  -->
+                  <crn:parameter name="DS_NET_PROTOCOL" disabled="true">
+                    <crn:value xsi:type="xsd:string">SOAP</crn:value>
+                  </crn:parameter>
+                  <!-- DS_NET_PWD: The service access password for the Data Manager network server.  -->
+                  <crn:parameter name="DS_NET_PWD" disabled="true">
+                    <crn:value xsi:type="cfg:systemPassword">NoPassWordSet</crn:value>
+                  </crn:parameter>
+                </crn:instance>
+              </crn:instances>
+            </crn:value>
+          </crn:parameter>
+          <!-- CDSNetServer: Defines a group of properties for Data Manager servers.  -->
+          <crn:parameter name="CDSNetServer" opaque="true" disabled="true">
+            <crn:value>
+              <!-- CDSNetSOAPServer: Defines a group of properties for Data Manager network services
+                   SOAP Server.  -->
+              <crn:parameter name="CDSNetSOAPServer" opaque="true" disabled="true">
+                <crn:value>
+                  <!-- DSNET_SOAP_SERVER_LOG_SEVERITY: Specifies the level of logging on the server. 1 =
+                       least verbose, 5 = most verbose.  -->
+                  <crn:parameter name="DSNET_SOAP_SERVER_LOG_SEVERITY" disabled="true">
+                    <crn:value xsi:type="xsd:unsignedShort">3</crn:value>
+                  </crn:parameter>
+                </crn:value>
+              </crn:parameter>
+              <!-- CDSNetSocketServer: Defines a group of properties for Data Manager network services
+                   Socket Server.  -->
+              <crn:parameter name="CDSNetSocketServer" opaque="true" disabled="true">
+                <crn:value>
+                  <!-- DSNET_PWD: The service access password for the Data Manager network server.  -->
+                  <crn:parameter name="DSNET_PWD" disabled="true">
+                    <crn:value xsi:type="cfg:systemPassword">NoPassWordSet</crn:value>
+                  </crn:parameter>
+                  <!-- DS_NET_SOCK_PORT: Specifies the port for the Socket Server.  -->
+                  <crn:parameter name="DS_NET_SOCK_PORT" disabled="true">
+                    <crn:value xsi:type="xsd:unsignedShort">9310</crn:value>
+                  </crn:parameter>
+                  <!-- DSNET_SOCKET_SERVER_LOG_SEVERITY: Specifies the level of logging on the server. 1
+                       = least verbose, 5 = most verbose.  -->
+                  <crn:parameter name="DSNET_SOCKET_SERVER_LOG_SEVERITY" disabled="true">
+                    <crn:value xsi:type="xsd:unsignedShort">3</crn:value>
+                  </crn:parameter>
+                </crn:value>
+              </crn:parameter>
+            </crn:value>
+          </crn:parameter>
+        </crn:value>
+      </crn:parameter>
+    </crn:value>
+  </crn:parameter>
+  <!-- PLANNING: Defines the properties for the Planning.  -->
+  <crn:parameter name="PLANNING" opaque="true" disabled="true">
+    <crn:value>
+      <!-- analystMaxSize: Specifies how much memory the APL interpreter can use.  -->
+      <!-- Enter a value between 64000 and 2000000. Memory is allocated as it is needed, but
+           only up to this limit. Once allocated, the memory will not be available for other
+           applications while Analyst is running.  -->
+      <crn:parameter name="analystMaxSize" disabled="true">
+        <crn:value xsi:type="xsd:int">64000</crn:value>
+      </crn:parameter>
+      <!-- BIInstallLocation: Specifies the path to the IBM Cognos Business Intelligence installation.  -->
+      <!-- This path is specified when IBM Cognos BI is installed. This property is used by
+           Planning components that require an IBM Cognos BI installation.  -->
+      <crn:parameter name="BIInstallLocation" disabled="true">
+        <crn:value xsi:type="cfg:folderPath"></crn:value>
+      </crn:parameter>
+      <!-- PlanningServer: Defines a group of properties for planning server.  -->
+      <crn:parameter name="PlanningServer" opaque="true" disabled="true">
+        <crn:value>
+          <!-- PlanningWindowServiceListeningPort: Specifies the port the product uses to listen
+               for commands on.  -->
+          <crn:parameter name="PlanningWindowServiceListeningPort" disabled="true">
+            <crn:value xsi:type="xsd:unsignedShort">9900</crn:value>
+          </crn:parameter>
+          <!-- PlanningWindowServiceShutdownPort: Specifies the port the product uses to listen
+               for a shut down command.  -->
+          <crn:parameter name="PlanningWindowServiceShutdownPort" disabled="true">
+            <crn:value xsi:type="xsd:unsignedShort">9901</crn:value>
+          </crn:parameter>
+          <!-- OracleODBCDriver: Specifies which ODBC driver to use to connect to the Contributor
+               publish data store.  -->
+          <!-- On certain installs, the ODBC driver name for Oracle is not a default value, or more
+               than one driver could be installed. Used by the client extension and PPES admin extension.  -->
+          <crn:parameter name="OracleODBCDriver" disabled="true">
+            <crn:value xsi:type="xsd:string"></crn:value>
+          </crn:parameter>
+        </crn:value>
+      </crn:parameter>
+    </crn:value>
+  </crn:parameter>
+  <!-- AAA: Defines general properties related to authentication that apply to all users.  -->
+  <!-- Use this group of properties to set the security environment that all users share,
+       regardless of user identity or role, or authentication provider.  -->
+  <crn:parameter name="AAA" opaque="true">
+    <crn:value>
+      <!-- inactivityTimeout: Specifies the maximum number of seconds that a user's session
+           can remain inactive before they must re-authenticate.  -->
+      <!-- Use this property to automatically log off the user after a set period of inactivity.
+           Ensure that the period is appropriate for both security and convenience considerations.  -->
+      <crn:parameter name="inactivityTimeout">
+        <crn:value xsi:type="xsd:positiveInteger">3600</crn:value>
+      </crn:parameter>
+      <!-- allowSessionSharing: Specifies whether a client application can share session information
+           with another client on the same machine.  -->
+      <!-- To establish a single signon between multiple clients on the same machine, session
+           information must be shared between the applications. However, for security reasons
+           it may not be desirable to allow single signon. This parameter has no impact on integrated
+           windows authentication.  -->
+      <crn:parameter name="allowSessionSharing">
+        <crn:value xsi:type="xsd:boolean">false</crn:value>
+      </crn:parameter>
+      <!-- restrictAccessToCRN: This parameter allows administrators to restrict user access
+           to the application.  -->
+      <!-- When this parameter is enabled, users can only access the application if they belong
+           to at least one group or role within the built-in namespace (does not include the
+           group "All Authenticated Users").  -->
+      <crn:parameter name="restrictAccessToCRN">
+        <crn:value xsi:type="xsd:boolean">false</crn:value>
+      </crn:parameter>
+      <!-- renewTCFlag: Specifies whether the user's trusted credential is automatically renewed
+           after logging on.  -->
+      <!-- You can set this property off, set it to the primary namespace only, or set it to
+           all namespaces.  -->
+      <crn:parameter name="renewTCFlag">
+        <crn:value xsi:type="xsd:string">primaryNamespace</crn:value>
+      </crn:parameter>
+      <!-- advancedProperties: Specifies a set of advanced properties.  -->
+      <!-- The user needs to provide the name and the value for each advanced property.  -->
+      <crn:parameter name="advancedProperties" opaque="true">
+        <crn:value xsi:type="cfg:array"/>
+      </crn:parameter>
+      <!-- tenantIdMapping: Specifies how namespace users are mapped to tenant IDs.  -->
+      <!-- Specifying a value for this parameter enables multitenancy. The tenant ID for a user
+           can be determined using a pattern or a tenant provider class. The pattern is a AAA
+           service search path to a property which defines a tenant ID. The search path must
+           be relative to a user account. For example: '~/ancestors[2]/defaultName'. A tenant
+           provider class is Java class which implements the the ITenantProvider interface.
+           For more details please consult the installation and configuration guide.  -->
+      <crn:parameter name="tenantIdMapping" opaque="true">
+        <crn:value xsi:type="cfg:tenancyInfo">
+          <crn:item name="pattern" xsi:type="xsd:string"></crn:item>
+        </crn:value>
+      </crn:parameter>
+      <!-- tenantBoundingSetMapping: Specifies how the tenant bounding set is determined for
+           a user.  -->
+      <!-- This parameter is used when multitenancy is enabled. The tenant bounding set for
+           a user can be determined using a pattern or a tenant bounding set provider class.
+           The pattern is a AAA service search path to a property which defines a tenant bounding
+           set. The search path must be relative to a user account. For example: '˜/parameters/boundingSet'.
+           A tenant bounding set provider class is Java class which implements the the IBoundingSetProvider
+           interface. For more details please consult the installation and configuration guide.  -->
+      <crn:parameter name="tenantBoundingSetMapping" opaque="true">
+        <crn:value xsi:type="cfg:tenancyInfo">
+          <crn:item name="pattern" xsi:type="xsd:string"></crn:item>
+        </crn:value>
+      </crn:parameter>
+      <!-- authProvider: Specifies the type of security used for authenticating users.  -->
+      <!-- You cannot change the value of this property. It is automatically set when you choose
+           the namespace type in the Explorer window.  -->
+      <crn:instances name="authProvider">
+
+        <!-- Cognos: Defines a group of properties related to authentication that applies to all
+             users.  -->
+        <!-- Use this group of properties to control access to resources based on user identity.
+             Do not delete the namespace, or you will not be able to save your configuration.
+             To restore the namespace, right-click Authentication, click New, Namespace Type,
+             select the Cognos Namespace from the list of available types and specify a name.  -->
+        <crn:instance name="Cognos" class="Cognos">
+          <!-- allowAnon: Specifies whether anonymous access is allowed.  -->
+          <!-- By default, anonymous authentication process doesn't require the user to provide
+               logon credentials. The anonymous authentication uses a pre-defined account under
+               which all anonymous users are logged in.  -->
+          <crn:parameter name="allowAnon">
+            <crn:value xsi:type="xsd:boolean">true</crn:value>
+          </crn:parameter>
+          <crn:parameter name="disableCM">
+            <crn:value xsi:type="xsd:boolean">false</crn:value>
+          </crn:parameter>
+        </crn:instance>
+      </crn:instances>
+    </crn:value>
+  </crn:parameter>
+  <!-- CRYPTO: Defines a group of properties that enables secure communication between the
+       product components and data encryption.  -->
+  <!-- To use a cryptographic provider that already exists in your environment, you must
+       delete the default provider. You can only use one cryptographic provider at a time.
+       Right-click Cryptography, click New and then click Provider to use a different cryptographic
+       provider. After you select the provider, you can use this group of properties to
+       protect the information in your system from unauthorized access.  -->
+  <crn:parameter name="CRYPTO" opaque="true">
+    <crn:value>
+      <!-- cryptoStandardConformance: Specifies the cryptographic standard that IBM Cognos should
+           enforce.  -->
+      <!-- Use this property to specify what cryptographic standard should be enforced in this
+           install. This parameter may cause the save operation to fail if other parameters
+           are changed to values not allowed in the selected standard.  -->
+      <crn:parameter name="cryptoStandardConformance">
+        <crn:value xsi:type="xsd:string">IBM_Cognos</crn:value>
+      </crn:parameter>
+      <!-- localCSK: Specifies whether the common symmetric key can be stored on the local computer.  -->
+      <!-- If this value is set to false, then the Common Symmetric Key (CSK) is not stored
+           locally. In this case, each cryptographic operation requiring the CSK must fetch
+           it from the server.  -->
+      <crn:parameter name="localCSK">
+        <crn:value xsi:type="xsd:boolean">true</crn:value>
+      </crn:parameter>
+      <!-- CSKPath: Specifies the location of the common symmetric key store database.  -->
+      <!-- For distributed installations, set this property to point to the computer where you
+           created the key store. The key store is in a global location to provide access from
+           different computers.  -->
+      <crn:parameter name="CSKPath">
+        <crn:value xsi:type="cfg:folderPath">../configuration/csk</crn:value>
+      </crn:parameter>
+      <!-- CSKPathPassword: Specifies the password used to protect the common symmetric key
+           store database.  -->
+      <!-- This password provides an additional level of security not available when storing
+           keys in files. By default, this password is immediately encrypted when you save your
+           configuration.  -->
+      <crn:parameter name="CSKPathPassword">
+        <crn:value xsi:type="cfg:systemPassword"></crn:value>
+      </crn:parameter>
+      <!-- CSKLifetime: For servers running Content Manager, specifies the maximum number of
+           days that the CSK is valid.  -->
+      <!-- The validity period that you set for the CSK depends on a number of factors, such
+           as the sensitivity of your data.  -->
+      <crn:parameter name="CSKLifetime">
+        <crn:value xsi:type="xsd:long">365</crn:value>
+      </crn:parameter>
+      <!-- SSLMutualAuthentication: Specifies whether mutual authentication is required.  -->
+      <!-- Set the value of this property to 'true' if both components or computers involved
+           in the communication must prove their identity. Mutual authentication is carried
+           out by using certificates, which are exchanged by the communicating components at
+           the time they initiate connections.  -->
+      <crn:parameter name="SSLMutualAuthentication">
+        <crn:value xsi:type="xsd:boolean">false</crn:value>
+      </crn:parameter>
+      <!-- SSLConfidentiality: Specifies whether to use encryption to ensure confidentiality
+           of all transmitted information.  -->
+      <!-- If the value of this property is set to 'false', information that is transmitted
+           will not be encrypted.  -->
+      <crn:parameter name="SSLConfidentiality">
+        <crn:value xsi:type="xsd:boolean">true</crn:value>
+      </crn:parameter>
+      <!-- digestAlgorithm: Specifies the digest algorithm.  -->
+      <!-- Use this property to specify the message digest algorithm that is used when hashing
+           data.  -->
+      <crn:parameter name="digestAlgorithm">
+        <crn:value xsi:type="xsd:string">SHA-256</crn:value>
+      </crn:parameter>
+      <!-- signingKeyPairAlgorithm: Specifies the signing key pair algorithm.  -->
+      <!-- Use this property to specify the algorithm that is used when signing data.  -->
+      <crn:parameter name="signingKeyPairAlgorithm">
+        <crn:value xsi:type="xsd:string">RSA</crn:value>
+      </crn:parameter>
+      <!-- cryptoProvider: Specifies the cryptographic provider used by the product.  -->
+      <!-- The value of this property is set when you select the cryptographic provider from
+           the list of available types. You cannot change the value of this property.  -->
+      <crn:instances name="cryptoProvider">
+        <!-- Cognos: Defines a group of properties for the Cognos cryptographic provider.  -->
+        <!-- Configure these properties to set the encryption services and CA service for all
+             components accessing a single content store.  -->
+        <crn:instance name="Cognos" class="CognosCrypto">
+          <!-- certificateLocation: Specifies the location of trusted certificates.  -->
+          <crn:parameter name="certificateLocation">
+            <crn:value xsi:type="cfg:folderPath">../configuration/certs</crn:value>
+          </crn:parameter>
+          <!-- cognosCryptoConfidentialityAlgorithm: Specify the confidentiality algorithm.  -->
+          <!-- Use this property to specify the encryption algorithm when transmitting information.  -->
+          <crn:parameter name="cognosCryptoConfidentialityAlgorithm">
+            <crn:value xsi:type="xsd:string">AES</crn:value>
+          </crn:parameter>
+          <!-- cognosPDFConfidentialityAlgorithm: Specify the PDF confidentiality algorithm.  -->
+          <!-- Use this property to specify the encryption algorithm when encrypting PDF data.  -->
+          <crn:parameter name="cognosPDFConfidentialityAlgorithm">
+            <crn:value xsi:type="xsd:string">AES</crn:value>
+          </crn:parameter>
+          <!-- cognosCryptoCiphersuite: Specifies a list of supported ciphersuites in priority sequence.  -->
+          <!-- Use this property to specify what ciphersuites are acceptable in this install. The
+               selected ciphersuites are then presented to the SSL negotiation in priority sequence
+               for both client and server sides of the negotiation. At least one of the selected
+               ciphersuites between configured client and server platforms must match.  -->
+          <crn:parameter name="cognosCryptoCiphersuite" opaque="true">
+            <crn:value xsi:type="cfg:sortedArray">
+              <crn:item xsi:type="xsd:string" order="1">RSA-RSA-AES(128)CBC-SHA</crn:item>
+              <crn:item xsi:type="xsd:string" order="3">RSA-RSA-DES(168)CBC3-SHA</crn:item>
+            </crn:value>
+          </crn:parameter>
+          <!-- keystoreFilePassword: Specifies the password used to protect the key store.  -->
+          <!-- This password is required to secure the IBM Cognos keystore. It provides an extra
+               layer of security by encrypting the keystore file using a password.  -->
+          <crn:parameter name="keystoreFilePassword">
+            <crn:value xsi:type="cfg:systemPassword">NoPassWordSet</crn:value>
+          </crn:parameter>
+          <!-- serverCommonName: Specifies the common name (CN) portion of the distinguished name
+               (DN) for this computer.  -->
+          <!-- An example of a common name is the host name of the computer.  -->
+          <crn:parameter name="serverCommonName">
+            <crn:value xsi:type="xsd:string">CAMUSER</crn:value>
+          </crn:parameter>
+          <!-- distinguishedNameOrganization: Specifies the organization name (O) used in the distinguished
+               name (DN).  -->
+          <!-- An example of an organization is MyCompany.  -->
+          <crn:parameter name="distinguishedNameOrganization">
+            <crn:value xsi:type="xsd:string">Cognos</crn:value>
+          </crn:parameter>
+          <!-- distinguishedNameCountry: Specifies the two-letter country or region code used in
+               the distinguished name (DN).  -->
+          <!-- For example, the code for Japan is JP.  -->
+          <crn:parameter name="distinguishedNameCountry">
+            <crn:value xsi:type="xsd:string">CA</crn:value>
+          </crn:parameter>
+          <!-- thirdPartyCA: Specifies whether to use an external Certificate Authority.  -->
+          <!-- If this value is set to true, the IBM Cognos Certificate Authority service is not
+               used. A third party Certificate Authority will manually process certificate requests.  -->
+          <crn:parameter name="thirdPartyCA">
+            <crn:value xsi:type="xsd:boolean">false</crn:value>
+          </crn:parameter>
+          <!-- certificateAuthorityServiceCommonName: Specifies the common name (CN) portion of
+               the distinguished name (DN) for the Certificate Authority service computer.  -->
+          <!-- An example of a common name is the host name of the computer. Do not use localhost.  -->
+          <crn:parameter name="certificateAuthorityServiceCommonName">
+            <crn:value xsi:type="xsd:string">CA</crn:value>
+          </crn:parameter>
+          <!-- certificateAuthorityServicePassword: Specifies the password used to validate certificate
+               requests sent to the Certificate Authority service.  -->
+          <!-- This property must be the same for clients using the Certificate Authority and the
+               Certificate Authority service itself. For example, the password you specify for IBM
+               Cognos installations that do not have Content Manager must match the password you
+               specify for the installation that has Content Manager. The Certificate Authority
+               service is installed with the Content Manager. By default, this password is immediately
+               encrypted when you save your configuration.  -->
+          <crn:parameter name="certificateAuthorityServicePassword">
+            <crn:value xsi:type="cfg:systemPassword"></crn:value>
+          </crn:parameter>
+          <!-- certificateAuthorityServiceCertificateLifetime: Specifies the maximum number of days
+               that a certificate signed by the Certificate Authority service is valid.  -->
+          <!-- The validity period that you set for certificates depends on a number of factors,
+               such as the strength of the private key used to sign the certificate.  -->
+          <crn:parameter name="certificateAuthorityServiceCertificateLifetime">
+            <crn:value xsi:type="xsd:long">730</crn:value>
+          </crn:parameter>
+        </crn:instance>
+      </crn:instances>
+    </crn:value>
+  </crn:parameter>
+  <!-- Replication: Defines general properties related to replication of user session data.  -->
+  <!-- Use this group of properties to set the settings for IBM Cognos authentication services
+       to enable user session replication.  -->
+  <crn:parameter name="Replication" opaque="true">
+    <crn:value>
+      <!-- pdcEnableReplication: Specifies whether user session replcation is enabled.  -->
+      <!-- Use this property to enable or disable user session data replication across authentication
+           services.  -->
+      <crn:parameter name="pdcEnableReplication">
+        <crn:value xsi:type="xsd:boolean">true</crn:value>
+      </crn:parameter>
+      <!-- pdcPeerPort: Specifies the port used for peer discovery.  -->
+      <!-- A value of 0 means that the server will select an available port automatically. When
+           a value other than 0 is specified, ensure that you specify a port that is not already
+           in use. The port communication uses mutually authenticated SSL/TLS protocol.  -->
+      <crn:parameter name="pdcPeerPort">
+        <crn:value xsi:type="xsd:unsignedShort">0</crn:value>
+      </crn:parameter>
+      <!-- pdcRMIPort: Specifies the port used for RMI communication.  -->
+      <!-- A value of 0 means that the server will select an available port automatically. The
+           RMI port is the communication port used by the Java Remote Method Invocation API.
+           When a value other than 0 is specified, ensure that you specify a port that is not
+           already in use. The port communication uses mutually authenticated SSL/TLS protocol.  -->
+      <crn:parameter name="pdcRMIPort">
+        <crn:value xsi:type="xsd:unsignedShort">0</crn:value>
+      </crn:parameter>
+      <!-- advancedProperties: Specifies a set of advanced properties.  -->
+      <!-- The user needs to provide the name and the value for each advanced property.  -->
+      <crn:parameter name="advancedProperties" opaque="true">
+        <crn:value xsi:type="cfg:array"/>
+      </crn:parameter>
+    </crn:value>
+  </crn:parameter>
+  <!-- CAF: Defines a group of properties to configure the IBM Cognos Application Firewall.  -->
+  <!-- The IBM Cognos Application Firewall is an essential component of product security
+       helping to provide protection against penetration vulnerabilities. Disabling the
+       IBM Cognos Application Firewall will remove this protection; therefore, this should
+       not be done under normal circumstances.  -->
+  <crn:parameter name="CAF" opaque="true">
+    <crn:value>
+      <!-- caf_enabled: Specifies whether to enable IBM Cognos Application Firewall validation.  -->
+      <!-- The IBM Cognos Application Firewall is an essential component of product security
+           helping to provide protection against penetration vulnerabilities. Disabling the
+           IBM Cognos Application Firewall will remove this protection; therefore, this should
+           not be done under normal circumstances. In addition, if third party XSS checking
+           is enabled, CAF validation must also be enabled.  -->
+      <crn:parameter name="caf_enabled">
+        <crn:value xsi:type="xsd:boolean">true</crn:value>
+      </crn:parameter>
+      <!-- caf_validDomainList: Specifies valid domain and/or host name values for your configuration.  -->
+      <!-- The IBM Cognos Application Firewall will validate hostname and domain names used
+           or passed in a request. You may add additional host names or domain names to support
+           your configuration and system topology. For example, add .mycompany.com to allow
+           the domains from mycompany.com. You may also allow a domain and all its sub-domains
+           by adding a wildcard at the beginning of the domain such as, *.mycompany.com.  -->
+      <crn:parameter name="caf_validDomainList" opaque="true">
+        <crn:value xsi:type="cfg:array"/>
+      </crn:parameter>
+      <!-- caf_tpXSSCheckingUsed: Specifies whether CAF support for third party cross site scripting
+           checking is enabled.  -->
+      <!-- Enables CAF to support third party cross site scripting checking by encoding requests
+           to prevent discouraged characters from being rejected by the third party checking.
+           Enable this property if you have a tool that is performing XSS of GET requests. You
+           can only enable this property when CAF validation is also enabled. By default, the
+           third party XSS characters <, ' and > will be encoded.  -->
+      <crn:parameter name="caf_tpXSSCheckingUsed">
+        <crn:value xsi:type="xsd:string">false</crn:value>
+      </crn:parameter>
+    </crn:value>
+  </crn:parameter>
+  <!-- tm1Server: Defines a group of properties for the TM1 Server.  -->
+  <crn:parameter name="tm1Server" opaque="true" disabled="true">
+    <crn:value>
+      <crn:instances name="tm1ServerInstances" disabled="true">
+        <!-- SData: Defines a group of properties for a TM1 Server instance.  -->
+        <crn:instance name="SData" class="tm1ServerInstance" disabled="true">
+          <!-- tm1sConfigDirectory: Specifies the path to the TM1 configuration file.  -->
+          <!-- The TM1 Server configuration file is tm1s.cfg. It contains configuration settings
+               such as DataDirectory and ServerName. This path can be absolute or relative to the
+               IBM Cognos installation's bin directory or bin64 directory in 64-bit installations
+               (e.g. C:\Program Files\IBM\Cognos\TM1\bin).  -->
+          <crn:parameter name="tm1sConfigDirectory" disabled="true">
+            <crn:value xsi:type="cfg:folderPath">../samples/tm1/SData</crn:value>
+          </crn:parameter>
+        </crn:instance>
+        <!-- Planning Sample: Defines a group of properties for a TM1 Server instance.  -->
+        <crn:instance name="Planning Sample" class="tm1ServerInstance" disabled="true">
+          <!-- tm1sConfigDirectory: Specifies the path to the TM1 configuration file.  -->
+          <!-- The TM1 Server configuration file is tm1s.cfg. It contains configuration settings
+               such as DataDirectory and ServerName. This path can be absolute or relative to the
+               IBM Cognos installation's bin directory or bin64 directory in 64-bit installations
+               (e.g. C:\Program Files\IBM\Cognos\TM1\bin).  -->
+          <crn:parameter name="tm1sConfigDirectory" disabled="true">
+            <crn:value xsi:type="cfg:folderPath">../samples/tm1/PlanSamp</crn:value>
+          </crn:parameter>
+        </crn:instance>
+        <!-- GO_New_Stores: Defines a group of properties for a TM1 Server instance.  -->
+        <crn:instance name="GO_New_Stores" class="tm1ServerInstance" disabled="true">
+          <!-- tm1sConfigDirectory: Specifies the path to the TM1 configuration file.  -->
+          <!-- The TM1 Server configuration file is tm1s.cfg. It contains configuration settings
+               such as DataDirectory and ServerName. This path can be absolute or relative to the
+               IBM Cognos installation's bin directory or bin64 directory in 64-bit installations
+               (e.g. C:\Program Files\IBM\Cognos\TM1\bin).  -->
+          <crn:parameter name="tm1sConfigDirectory" disabled="true">
+            <crn:value xsi:type="cfg:folderPath">../samples/tm1/GO_New_Stores</crn:value>
+          </crn:parameter>
+        </crn:instance>
+        <!-- GO_Scorecards: Defines a group of properties for a TM1 Server instance.  -->
+        <crn:instance name="GO_Scorecards" class="tm1ServerInstance" disabled="true">
+          <!-- tm1sConfigDirectory: Specifies the path to the TM1 configuration file.  -->
+          <!-- The TM1 Server configuration file is tm1s.cfg. It contains configuration settings
+               such as DataDirectory and ServerName. This path can be absolute or relative to the
+               IBM Cognos installation's bin directory or bin64 directory in 64-bit installations
+               (e.g. C:\Program Files\IBM\Cognos\TM1\bin).  -->
+          <crn:parameter name="tm1sConfigDirectory" disabled="true">
+            <crn:value xsi:type="cfg:folderPath">../samples/tm1/GO_scorecards</crn:value>
+          </crn:parameter>
+        </crn:instance>
+        <!-- Proven_Techniques: Defines a group of properties for a TM1 Server instance.  -->
+        <crn:instance name="Proven_Techniques" class="tm1ServerInstance" disabled="true">
+          <!-- tm1sConfigDirectory: Specifies the path to the TM1 configuration file.  -->
+          <!-- The TM1 Server configuration file is tm1s.cfg. It contains configuration settings
+               such as DataDirectory and ServerName. This path can be absolute or relative to the
+               IBM Cognos installation's bin directory or bin64 directory in 64-bit installations
+               (e.g. C:\Program Files\IBM\Cognos\TM1\bin).  -->
+          <crn:parameter name="tm1sConfigDirectory" disabled="true">
+            <crn:value xsi:type="cfg:folderPath">../samples/tm1/Proven_Techniques</crn:value>
+          </crn:parameter>
+        </crn:instance>
+      </crn:instances>
+    </crn:value>
+  </crn:parameter>
+  <!-- mdmDB: Business Viewpoint Repository properties.  -->
+  <crn:parameter name="mdmDB" opaque="true" disabled="true">
+    <crn:value>
+      <!-- mdm_database: Specifies the database type for the Business Viewpoint repository.  -->
+      <!-- You cannot change the value of this property. It is automatically set when you choose
+           the database type for the repository in the Explorer window.  -->
+      <crn:instances name="mdm_database" disabled="true">
+        <!-- Database: Defines a group of properties used to locate an existing DB2 database.  -->
+        <!-- Ensure that the database already exists.  -->
+        <crn:instance name="Database" class="DB2" disabled="true">
+          <!-- server: Specifies the name or TCP/IP address of the database computer.  -->
+          <!-- When a value is specified, database connections are made directly to the database
+               (type 4). When the value is left blank, database connections are made through the
+               database client (type 2).  -->
+          <crn:parameter name="server" disabled="true">
+            <crn:value xsi:type="cfg:hostPort"></crn:value>
+          </crn:parameter>
+          <!-- user: Specifies the user ID and password that the product uses to connect to the
+               content store.  -->
+          <!-- This value identifies the database user who has unrestricted access to the database.
+               The product uses this account to access the content store. To secure the logon credentials,
+               you can encrypt the database logon information immediately by saving your configuration.  -->
+          <crn:parameter name="user" disabled="true">
+            <crn:value xsi:type="cfg:credential">
+              <credential>
+                <username/>
+                <password/>
+              </credential>
+            </crn:value>
+          </crn:parameter>
+          <!-- name: Specifies the name of the DB2 database.  -->
+          <!-- Enter the name of the database. The name is set when you create the database. Ensure
+               that the value for this property corresponds to the name of the database you created.
+               Otherwise, the product will not run.  -->
+          <crn:parameter name="name" disabled="true">
+            <crn:value xsi:type="xsd:string">bv</crn:value>
+          </crn:parameter>
+        </crn:instance>
+      </crn:instances>
+    </crn:value>
+  </crn:parameter>
+  <!-- mdmNotification: Defines a group of properties that provides access to a mail server
+       account.  -->
+  <!-- Use this group of properties to configure an account from which all notifications
+       are sent.  -->
+  <crn:parameter name="mdmNotification" opaque="true" disabled="true">
+    <crn:value>
+      <!-- smtpMailServer: Specifies the host name and port of the mail server computer.  -->
+      <!-- Use the following syntax to specify the location of the mail server: host:port. The
+           default SMTP port on most mail servers is 25.  -->
+      <crn:parameter name="smtpMailServer" disabled="true">
+        <crn:value xsi:type="cfg:hostPort">mailserver:25</crn:value>
+      </crn:parameter>
+      <!-- SmtpAccount: Specifies the user id and password to log on to the mail server.  -->
+      <!-- If the mail server requires authentication to send messages, enter a valid user id
+           and password. If the mail server does not require authentication, leave these values
+           empty.  -->
+      <crn:parameter name="SmtpAccount" disabled="true">
+        <crn:value xsi:type="cfg:credential">
+          <credential>
+            <username/>
+            <password/>
+          </credential>
+        </crn:value>
+      </crn:parameter>
+      <!-- DefaultSender: Specifies the email address of the sender.  -->
+      <!-- This setting specifies the email address of the 'sender' of outgoing messages. Use
+           a valid email address.  -->
+      <crn:parameter name="DefaultSender" disabled="true">
+        <crn:value xsi:type="xsd:string">user@mail</crn:value>
+      </crn:parameter>
+      <!-- defaultReplyTo: Specifies the email address for Reply-To.  -->
+      <!-- This setting specifies the email address of the 'Reply-To' of outgoing messages.
+           Use a valid email address.  -->
+      <crn:parameter name="defaultReplyTo" disabled="true">
+        <crn:value xsi:type="xsd:string">user@mail</crn:value>
+      </crn:parameter>
+    </crn:value>
+  </crn:parameter>
+  <!-- CM: Defines a component that manages content and security policies.  -->
+  <!-- Content Manager must be able to connect to an external database that stores content.  -->
+  <crn:parameter name="CM" opaque="true">
+    <crn:value>
+      <!-- outputCMReportToFile: Specifies whether to save report outputs to a file system through
+           the Content Manager Advanced Setting (i.e. CM.OUTPUTLOCATION).  -->
+      <!-- Use this flag to enable/disable the feature to save report outputs to a file system
+           by Content Manager Service. Please note that this feature is completely different
+           than the new report run option to archive a report output to a file system by Delivery
+           Service. Report output formats that you can save include: PDF, CSV, XML, Excel 2002,
+           and HTML which do not have embedded graphics. Report outputs that you cannot save
+           include: HTML fragment, XHTML, or Excel 2000 single sheet formats.  -->
+      <crn:parameter name="outputCMReportToFile">
+        <crn:value xsi:type="xsd:boolean">false</crn:value>
+      </crn:parameter>
+      <!-- advancedProperties: Specifies a set of advanced properties.  -->
+      <!-- The user needs to provide the name and the value for each advanced property.  -->
+      <crn:parameter name="advancedProperties" opaque="true">
+        <crn:value xsi:type="cfg:array"/>
+      </crn:parameter>
+      <!-- database: Specifies the database type for the content store.  -->
+      <!-- You cannot change the value of this property. It is automatically set when you choose
+           the database type for the content store in the Explorer window.  -->
+      <crn:instances name="database">
+        <!-- Content Store: Defines a group of properties used to locate an existing DB2 database.  -->
+        <!-- Ensure that the database already exists.  -->
+        <crn:instance name="Content Store" class="DB2">
+          <!-- server: Specifies the name or TCP/IP address of the database computer.  -->
+          <!-- When a value is specified, database connections are made directly to the database
+               (type 4). When the value is left blank, database connections are made through the
+               database client (type 2).  -->
+          <crn:parameter name="server">
+            <crn:value xsi:type="cfg:hostPort">localhost:50000</crn:value>
+          </crn:parameter>
+          <!-- user: Specifies the user ID and password that the product uses to connect to the
+               content store.  -->
+          <!-- This value identifies the database user who has unrestricted access to the database.
+               The product uses this account to access the content store. To secure the logon credentials,
+               you can encrypt the database logon information immediately by saving your configuration.  -->
+          <crn:parameter name="user">
+            <crn:value xsi:type="cfg:credential" encrypted="false">
+              <credential>
+                <username><%= scope['cognos::cognos_db_user'] %></username>
+                <password><%= scope['cognos::cognos_db_user_password'] %></password>
+              </credential>
+            </crn:value>
+          </crn:parameter>
+          <!-- name: Specifies the name of the DB2 database.  -->
+          <!-- Enter the name of the database.  -->
+          <crn:parameter name="name">
+            <crn:value xsi:type="xsd:string">cm</crn:value>
+          </crn:parameter>
+          <!-- SSLencryptionEnabled: Specifies whether database connection should use SSL encryption.  -->
+          <!-- Use this property to enable SSL encryption of the database connection.  -->
+          <crn:parameter name="SSLencryptionEnabled">
+            <crn:value xsi:type="xsd:boolean">false</crn:value>
+          </crn:parameter>
+        </crn:instance>
+      </crn:instances>
+    </crn:value>
+  </crn:parameter>
+  <!-- MOB: Defines a group of properties used to connect to the mobile database.  -->
+  <!-- Use these properties to specify the type of database for Mobile and the connection
+       information required to access it. Mobile supports DB2, SQL Server and Oracle. To
+       do this, right-click Mobile, click New resource, Database, select the database type
+       and then configure the resource properties.  -->
+  <crn:parameter name="MOB" opaque="true">
+    <crn:value/>
+  </crn:parameter>
+  <!-- NC: Defines a group of properties that provides access to a mail server account or
+       to IBM Cognos content.  -->
+  <!-- Use this group of properties to configure an account from which all notifications
+       are sent. The Notification component also requires access to a database that will
+       be used to store Notification content. This means that in a distributed installation
+       all Notification components must point to the same database. To do this, right-click
+       Notification, click New, Database and then type a name and select the database type.
+       If the Notification component is on the same computer as Content Manager, you are
+       not required to configure a database resource for the Notification component.  -->
+  <crn:parameter name="NC" opaque="true">
+    <crn:value>
+      <!-- smtpMailServer: Specifies the host name and port of the mail server computer.  -->
+      <!-- Use the following syntax to specify the location of the mail server: host:port. The
+           default SMTP port on most mail servers is 25.  -->
+      <crn:parameter name="smtpMailServer">
+        <crn:value xsi:type="cfg:hostPort">mailserver:25</crn:value>
+      </crn:parameter>
+      <!-- smtpAccount: Specifies the user id and password to log on to the mail server.  -->
+      <!-- If the mail server requires authentication to send messages, enter a valid user id
+           and password. If the mail server does not require authentication, leave these values
+           empty.  -->
+      <crn:parameter name="smtpAccount">
+        <crn:value xsi:type="cfg:credential">
+          <credential>
+            <username>nc_user</username>
+            <password>nc_password</password>
+          </credential>
+        </crn:value>
+      </crn:parameter>
+      <!-- defaultSender: Specifies the email address of the sender.  -->
+      <!-- This setting specifies the email address of the 'sender' of outgoing messages. Use
+           a valid email address.  -->
+      <crn:parameter name="defaultSender">
+        <crn:value xsi:type="xsd:string">notifications@cognos.ibm.com</crn:value>
+      </crn:parameter>
+      <!-- SSLencryptionEnabled: Specifies whether mail server connection should use SSL encryption.  -->
+      <!-- Use this property to enable SSL encryption for mail server connection.  -->
+      <crn:parameter name="SSLencryptionEnabled">
+        <crn:value xsi:type="xsd:boolean">false</crn:value>
+      </crn:parameter>
+    </crn:value>
+  </crn:parameter>
+  <!-- HTS: Defines a group of properties that provides access to Human Task and Annotation
+       Services content.  -->
+  <!-- Use this group of properties to configure the access to the database that will be
+       used to store Human Task and Annotation Services content.  -->
+  <crn:parameter name="HTS" opaque="true">
+    <crn:value/>
+  </crn:parameter>
+  <!-- PLACDS: Defines a group of properties that provide access to IBM Cognos Planning
+       content.  -->
+  <!-- Use this group of properties to configure the access to Planning Contributor Data
+       Server and Planning content store. A database resource component that points to the
+       Planning Store is required when the planning server is installed. If the planning
+       server component is installed on the same computer as Content Manager, the database
+       resource can point to the same database that's used for Content Manager.  -->
+  <crn:parameter name="PLACDS" opaque="true">
+    <crn:value>
+      <!-- ContributorDataServer: Defines the properties for the Planning Contributor Data Server.  -->
+      <crn:parameter name="ContributorDataServer" opaque="true">
+        <crn:value>
+          <!-- PLACDS_sharedSecret: Specifies the password that enables secure communication between
+               IBM Cognos servers and Contributor Data Server for scheduled reports and agents.  -->
+          <!-- The password is case-sensitive and must match the Signature password property that
+               you configure in IBM Cognos Series 7, Configuration Manager, IBM Cognos Planning
+               / IBM Cognos - Contributor Data Server / General properties.  -->
+          <crn:parameter name="PLACDS_sharedSecret">
+            <crn:value xsi:type="cfg:systemPassword">NoPassWordSet</crn:value>
+          </crn:parameter>
+        </crn:value>
+      </crn:parameter>
+      <!-- pla_database: Specifies the database type for the content store.  -->
+      <!-- You cannot change the value of this property. It is automatically set when you choose
+           the database type for the content store in the Explorer window.  -->
+      <crn:instances name="pla_database" disabled="true">
+        <!-- Planning Store: Defines a group of properties used to locate an existing DB2 database.  -->
+        <!-- Ensure that the database already exists.  -->
+        <crn:instance name="Planning Store" class="DB2" disabled="true">
+          <!-- server: Specifies the name or TCP/IP address of the database computer.  -->
+          <!-- When a value is specified, database connections are made directly to the database
+               (type 4). When the value is left blank, database connections are made through the
+               database client (type 2).  -->
+          <crn:parameter name="server">
+            <crn:value xsi:type="cfg:hostPort"></crn:value>
+          </crn:parameter>
+          <!-- user: Specifies the user ID and password that the product uses to connect to the
+               Planning database.  -->
+          <!-- This value identifies the database user who has unrestricted access to the database.
+               The product uses this account to access the content store. To secure the logon credentials,
+               you can encrypt the database logon information immediately by saving your configuration.  -->
+          <crn:parameter name="user">
+            <crn:value xsi:type="cfg:credential">
+              <credential>
+                <username/>
+                <password/>
+              </credential>
+            </crn:value>
+          </crn:parameter>
+          <!-- name: Specifies the name of the database used as the content store.  -->
+          <!-- Enter the name of the database. The name is set when you create the database. Ensure
+               that the value for this property corresponds to the name of the database you created.
+               Otherwise, the product will not run.  -->
+          <crn:parameter name="name">
+            <crn:value xsi:type="xsd:string">ps</crn:value>
+          </crn:parameter>
+          <!-- SSLencryptionEnabled: Specifies whether database connection should use SSL encryption.  -->
+          <!-- Use this property to enable SSL encryption of the database connection.  -->
+          <crn:parameter name="SSLencryptionEnabled">
+            <crn:value xsi:type="xsd:boolean">false</crn:value>
+          </crn:parameter>
+        </crn:instance>
+      </crn:instances>
+    </crn:value>
+  </crn:parameter>
+</crn:parameters>
diff --git a/templates/cognos_11.rsp.erb b/templates/cognos_11.rsp.erb
new file mode 100644
index 0000000..43db8b3
--- /dev/null
+++ b/templates/cognos_11.rsp.erb
@@ -0,0 +1,8 @@
+BISRVR_CA_INSTALL=1
+BISRVR_CA_TOOLS_INSTALL=0
+USER_INSTALL_DIR=<%= scope['cognos::installer_target_dir'] %>
+BISRVR_CUSTOM_FIRST=1
+BISRVR_CUSTOM_EXPAND=0
+BISRVR_FEATURE_APPTIER=<%= scope['install_app_tier_int'] %>
+BISRVR_FEATURE_GATEWAY=<%= scope['install_gateway_int'] %>
+BISRVR_FEATURE_SAMPLES=1
diff --git a/templates/create_cognos_db.sql.erb b/templates/create_cognos_db.sql.erb
new file mode 100644
index 0000000..2c872a2
--- /dev/null
+++ b/templates/create_cognos_db.sql.erb
@@ -0,0 +1,44 @@
+-- Licensed Materials - Property of IBM
+--
+-- BI and PM: CM
+--
+-- (C) Copyright IBM Corp. 2010
+--
+-- US Government Users Restricted Rights - Use, duplication or disclosure
+-- restricted by GSA ADP Schedule Contract with IBM Corp.
+
+-- Copyright (C) 2008 Cognos ULC, an IBM Company. All rights reserved.
+-- Cognos (R) is a trademark of Cognos ULC, (formerly Cognos Incorporated).
+-- Use this template to create the IBM Cognos content database. Replace these variables:
+-- cm : Database name
+-- <%= scope['cognos::cognos_db_user'] %> : User ID, this account is used by the product to connect to the content store
+-- This script must be run as a user that has sufficient privileges to access and create the database.
+-- The database user account needs to exist for the product to function.
+
+CREATE DATABASE cm AUTOMATIC STORAGE YES ALIAS cm USING CODESET UTF-8 TERRITORY US COLLATE USING SYSTEM PAGESIZE 8192;
+CHANGE DATABASE cm COMMENT WITH 'IBM Cognos Content Store';
+CONNECT TO cm;
+UPDATE DATABASE CONFIGURATION USING APPLHEAPSZ 1024 DEFERRED;
+UPDATE DATABASE CONFIGURATION USING LOCKTIMEOUT 240 DEFERRED;
+CONNECT RESET;
+
+CONNECT TO cm;
+CREATE BUFFERPOOL cm_08KBP IMMEDIATE SIZE 1000 PAGESIZE 8K;
+CREATE BUFFERPOOL cm_32KBP IMMEDIATE SIZE 1000 PAGESIZE 32K;
+CONNECT RESET;
+
+CONNECT TO cm;
+CREATE SYSTEM TEMPORARY TABLESPACE TSN_SYS_cm IN DATABASE PARTITION GROUP IBMTEMPGROUP PAGESIZE 32K BUFFERPOOL cm_32KBP;
+CREATE USER TEMPORARY TABLESPACE TSN_USR_cm IN DATABASE PARTITION GROUP IBMDEFAULTGROUP PAGESIZE 8K BUFFERPOOL IBMDEFAULTBP;
+CREATE REGULAR TABLESPACE TSN_REG_cm IN DATABASE PARTITION GROUP IBMDEFAULTGROUP PAGESIZE 8K BUFFERPOOL cm_08KBP;
+DROP TABLESPACE USERSPACE1;
+CONNECT RESET;
+
+CONNECT TO cm;
+CREATE SCHEMA db2COGNOS AUTHORIZATION <%= scope['cognos::cognos_db_user'] %>;
+COMMENT ON SCHEMA db2COGNOS IS 'IBM Cognos Content Store';
+GRANT CREATETAB,BINDADD,CONNECT,IMPLICIT_SCHEMA ON DATABASE  TO USER <%= scope['cognos::cognos_db_user'] %>;
+GRANT CREATEIN,DROPIN,ALTERIN ON SCHEMA DB2COGNOS TO USER <%= scope['cognos::cognos_db_user'] %>;
+GRANT USE OF TABLESPACE TSN_USR_cm TO USER <%= scope['cognos::cognos_db_user'] %>;
+GRANT USE OF TABLESPACE TSN_REG_cm TO USER <%= scope['cognos::cognos_db_user'] %>;
+CONNECT RESET;
diff --git a/tests/init.pp b/tests/init.pp
new file mode 100644
index 0000000..9aa8e73
--- /dev/null
+++ b/tests/init.pp
@@ -0,0 +1,12 @@
+# The baseline for module testing used by Puppet Labs is that each manifest
+# should have a corresponding test manifest that declares that class or defined
+# type.
+#
+# Tests are then run by using puppet apply --noop (to check for compilation
+# errors and view a log of events) or by fully applying the test in a virtual
+# environment (to compare the resulting system state to the desired state).
+#
+# Learn more about module testing here:
+# http://docs.puppetlabs.com/guides/tests_smoke.html
+#
+include cognos