Security Features Provided by Oracle Portal

16-2 Publishing Reports to the Web with Oracle Reports Services In Oracle Portal, security privileges can be granted to individual users and to named groups of users. Named groups are useful for streamlining the process of granting access privileges. You can assign a set of access privileges to a named group, and grant the entire set of privileges to an individual simply by adding that person to the group. The next sections provide overview information on how to create users and groups in Oracle Portal. They include: ■ Default Reports-Related Groups ■ Creating Users and Groups

16.1.1 Default Reports-Related Groups

When you install Oracle Portal, Reports-related groups are created for you automatically. These include the following groups: ■ RW_BASIC_USER ■ RW_POWER_USER ■ RW_DEVELOPER ■ RW_ADMINISTRATOR You must assign appropriate privileges to these groups to enable group members to perform specific functions on reports through Oracle Portal. For example, for each report object that you want members of a group for example, RW_BASIC_USER to be able to run, you have to grant the Execute privilege to that group from the Access tab of the report object. Similarly, if you want members of a group for example, RW_ ADMINISTRATOR to be able manage Reports Servers, printers, and reports, you have to grant the Manage privilege to that group from the Access tab of those objects. While you can assign object privileges to individual users, we recommend that every person who will access your reports belong to one of these groups or a group that you create yourself. If users try to run reports without being a member of one of these groups, by default, they are assigned the privileges of a basic user. Note: If you have a large user population already entered into an LDAP-compatible directory, you can use Oracle Internet Directory features to synchronize the directories and save yourself the effort of entering your users individually. Youll find information about Oracle Internet Directorys Directory Integration Server in the Oracle Fusion Middleware Administrators Guide for Oracle Internet Directory. Note: When you use features like Oracle Portal Security, Portal Destination, and Job Status Repository, the JDBC database connections made by Oracle Reports Services may override the initial NLS_LANG setting. This change may in turn affect the behavior of the running report, such as bidirectional output in PDF. On UNIX platforms, you can work around this issue by using the environment switching functionality to dynamically set the environment for reports. Refer to Section 8.2.2, Dynamic Environment Switching for more information. Deploying Reports in Oracle Portal 16-3 The following commands can be run by members of any group: ■ getfile ■ showmyjobs ■ killmyjobs ■ getjobid ■ showjobid ■ help Only members of the RW_DEVELOPER group can run the following commands: ■ showmap ■ showenv ■ showjobs ■ parsequery Members of the RW_ADMINISTRATOR group can run any command.

16.1.1.1 RW_BASIC_USER

Should the security check fail, members of the RW_BASIC_USER group see less detailed error messages than the users in other Oracle Reports groups, such as: Security Check Error Typically, you will want to assign this group minimal privileges. For example, you probably will want to give RW_BASIC_USER the privilege to execute reports and no more.

16.1.1.2 RW_POWER_USER

In addition to the privileges of the RW_BASIC_USER group, the RW_POWER_USER group sees error messages that are more detailed than those displayed to basic users. For example, if members of this group are not permitted to run to HTML, but they try anyway, they might get the message: Cannot run report to HTML This is more detailed than the message an RW_BASIC_USER would receive for the same error.

16.1.1.3 RW_DEVELOPER

In addition to the privileges of the RW_POWER_USER group, the RW_DEVELOPER group can run the following Web commands that show the system environment: ■ showmap ■ showenv ■ showjobs Note: The RW_ groups are created automatically by configuring Oracle Portal, or you can create them manually. You can also run Web commands if they are in the IASADMINS group.