From the WebLogic Domain menu, select Security Credentials. From the Reports menu, select Administration Advanced Configuration.

15-28 Publishing Reports to the Web with Oracle Reports Services If Reports is Using Portal-Based Security ■ It is recommended that Forms and Reports are associated to same Oracle Internet Directory. For more information see, Configuring External Oracle Internet Directory for In-Process Servers , and Configuring External Oracle Internet Directory for Standalone Servers ■ It is recommended that you enable Single Sign-On Perform the following steps to enable Single Sign-On: 1. Log in to Oracle Enterprise Manager. 2. Navigate to the Reports Application page.

3. From the Reports menu, select Administration Advanced Configuration.

The Reports Application Advanced Configuration page is displayed. 4. From the Reports Security window, select the Enable Single Sign-On check box.

5. Click Apply.

If Reports is using JAZN security If Reports is using JPS-based security, by default, an in-process server uses the embedded ID store of WebLogic Server as the ID store and an XML-based Policy store. A standalone server uses JAZN-XML. Forms uses Oracle Internet Directory based authentication for security. In this scenario: ■ It is recommended that you configure Reports to use Oracle Internet Directory-based ID store. Forms and Reports should use the same Oracle Internet Directory. For more information about configuring external Oracle Internet Directory, see, Configuring External Oracle Internet Directory for In-Process Servers , and Configuring External Oracle Internet Directory for Standalone Servers ■ It is recommended that you migrate reports policies from JAZN-XML to JAZN-OID. Forms and Reports should use the same Oracle Internet Directory. ■ It is recommended that you enable Single Sign-On Perform the following steps to enable Single Sign-On: 1. Log in to Oracle Enterprise Manager. 2. Navigate to the Reports Application page.

3. From the Reports menu, select Administration Advanced Configuration.

The Reports Application Advanced Configuration page is displayed. 4. From the Reports Security window, select the Enable Single Sign-On check box.

5. Click Apply.

15.11 Intermediate-level Security for Forms and Reports

Oracle Reports 11g Release 1 11.1.1 provides new security measures for reports run from Oracle Forms Services in non-secure mode: Securing Oracle Reports Services 15-29 ■ Oracle Reports allows you to generate random and non-sequential job IDs to make it impossible to predict the job ID for a particular job. For more information, see Section 18.8.2, Generating Random and Non-Sequential Job IDs . Prior to 11g Release 1 11.1.1, Oracle Reports generated sequential job IDs, making it easy to predict the job ID. This meant that unauthorized or malicious users could potentially view the job output using GETJOBID through rwservlet to obtain job output that belongs to another user. ■ Web commands rwservlet keywords are now categorized for added security: – End user Web commands: GETJOBID , KILLJOBID , SHOWAUTH , SHOWJOBID – Administrator Web commands: DELAUTH , GETSERVERINFO , KILLENGINE , PARSEQUERY , SHOWENV , SHOWJOBS , SHOWMAP , SHOWMYJOBS . AUTHID is required to run administrator commands – L0: no Web commands allowed. – L1: only end user Web commands allowed GETJOBID , KILLJOBID , SHOWAUTH , SHOWJOBID . – L2: administrator Web commands DELAUTH , GETSERVERINFO , KILLENGINE , PARSEQUERY , SHOWENV , SHOWJOBS , SHOWMAP , SHOWMYJOBS are also allowed. AUTHID is required to run administrator commands. – NO for backward compatibility with DIAGNOSTIC=NO in 10g rwservlet.properties. No Web commands allowed. – YES for backward compatibility with DIAGNOSTIC=YES in 10g rwservlet.properties. Administrator Web commands DELAUTH , GETSERVERINFO , KILLENGINE , PARSEQUERY , SHOWENV , SHOWJOBS , SHOWMAP , SHOWMYJOBS are also allowed. AUTHID is required to run administrator commands. Administrators are allowed to run both end user and administrator Web commands. For a non-secure Reports Server, the user ID and password for administrators can be set in the identifier element of the Reports Server configuration file. The new webcommandaccess parameter in the Oracle Reports Servlet rwservlet configuration file rwservlet.properties defines access levels for executing rwservlet keywords Web commands. These values can be set using Oracle Enterprise Manager, as described in Section 7.8.4, Defining Security Policies for Web Commands .

15.12 Database Proxy Authentication

Oracle Reports11g Release 1 11.1.1 provides support for database authentication using proxy users: ■ Additional security through control of users that are allowed to connect to the database through Oracle Reports. Note: For L2 Web command access, you do not need to pass the authid. The authid parameter is required only for the STOPSERVER command irrespective of the webcommandaccess value.