Click Create or Edit.

7-12 Publishing Reports to the Web with Oracle Reports Services

3. From the Reports menu, select Administration Manage Reports Security

Policies Web Command Policies.

4. Click Create or Edit to enter appropriate values for the elements on the page.

The Security Policy Configuration for Web Commands page is displayed. 5. Enter appropriate values for the elements on the page to define a web command security policy using the descriptions in the Help topic for the page. Click the Help icon on the page to access the page-level help. Perform the following steps to complete the elements on the page, ■ From the Server Name parameter checkbox, select one or more servers to which the security policy has to be applied. If you want to apply the security policy to all servers, select All. ■ From the Web Commands parameter checkbox, select one or more Web commands authorized for the specified servers and grantees. If you want to specify all Web commands, select All. ■ Click OK. All fields on this page require restart to take effect. 6. Run a report as the specified role and other roles to test that security policies for authentication and authorization are enforced as you have defined. For example, run the showjobs Web command from your browser using the following URL: http:host:portreportsrwservletshowjobs?server=ReportsServer_instancename where, host is the machine where the Oracle Instance is set up. port is the OHS port.

7.8.5 Defining ReadWrite Access to Directories

As an administrator, you can specify readwrite access for Reports Server, Reports Application in-process Reports Server, or Oracle Reports Runtime to directories. This feature only checks whether Reports Server, Reports Application, or Oracle Reports Runtime is authorized to read from or write to a specified directory, and is unrelated to security policies that check the user name and password. ■ Read access . To avoid the security issue of exposing sensitive content of files, you can specify the directories from which Reports Server, Reports Application, or Oracle Reports Runtime is allowed to read. For example, a malicious user may specify the following keywords to run a report on Windows: distribute=yesdestination=C:\Temp This would generate an error stating that there was an error in the syntax of the file. To avoid this, enable file system access control to specify read directories that do not include system directories. Note: The security policies defined in Oracle Enterprise Manager are stored in the policy store configured by the user. The idstore contains information on the users and the policy store contains the security policies configured by the user.