Out-of-the-Box Behavior Oracle Fusion Middleware Online Documentation Library

15-8 Publishing Reports to the Web with Oracle Reports Services ■ The user chooses a link on a Web page or a bookmark that contains a URL that requests the report. ■ From within Oracle Portal if configured, the user requests to run the report object for example, clicks the Run link. The user must be logged into Oracle Portal and, consequently, OracleAS Single Sign-On. As part of its security, Oracle Portal validates that the user has the required security permissions to see the report object. For example, if the report object is on a page, the user must have appropriate privileges to see the page and the reports object. Otherwise, Oracle Portal will not display the page or the report object to the user.

2. Oracle HTTP Server routes the request to rwservlet deployed on Oracle

WebLogic Server. The URL redirects the user to either rwservlet or the JSP depending upon whether this report has been set to execute through rwservlet or a JSP.

3. rwservlet

asks OracleAS Single Sign-On to authenticate the user. 4. OracleAS Single Sign-On server requests the user name and password. 5. Oracle HTTP Server displays the login page to the user, and the user provides user name and password. 6. User name and password are passed on to OracleAS Single Sign-On. 7. OracleAS Single Sign-On verifies the credentials with Oracle Internet Directory. 8. If the user is authenticated, OracleAS Single Sign-on server passes the user authenticated message to rwservlet. If you used SSOCONN in your URL, rwservlet checks the Single Sign-On key against Oracle Internet Directory to see if it already has been mapped to a data source connection string for example, scotttigermy_or_db. If you used SSOCONN and Oracle Internet Directory already has a connection string associated with the key, then rwservlet uses that connection string for the data source connection of the report. If you used SSOCONN but Oracle Internet Directory does not already contain a connection string for the key, the Oracle Delegated Administration Services Create Note: The URL may optionally contain or reference that is, through the key map file a Single Sign-On parameter SSOCONN with a value of the form: key_namedata_source_typeparameter_name In the case of an Oracle database, the Single Sign-On value would look something like the following: mykeyOracleDBuserid If you do not specify a data source type and parameter name, an Oracle database is assumed. Note: Because of this feature, many users can use the same report URL even if they all use different data source connection strings. Securing Oracle Reports Services 15-9 Resource page displays for the user to enter their data source connection string. See Figure 15–3 . Oracle Delegated Administration Services stores the string in Oracle Internet Directory for future use and rwservlet uses the newly entered connection string for the data source connection string of the report. Figure 15–2 Oracle Delegated Administration Services Create Resource

15.3.2 Non-SSO Authentication

If any of the non-SSO authentication methods is used based on Oracle Internet Directory, File-based in case of JPS-based security, and Embedded ID store, then any user accessing a secured instance of the Reports Server is challenged to identify themselves by rwservlet or Reports clients through their own authentication mechanism. Because the HTTP 1.0 protocol is stateless that is, each call to the server is effectively independent of all others, users may want to authenticate themselves for each report request unless a cookie is maintained. To allow users to authenticate themselves only once per session, rwservlet has its own client-side cookie, the AUTHID cookie, in which it stores the required authentication information for the current session. Once the user is authenticated, an encrypted cookie is created in the browser to enable the user to submit multiple report jobs without re-authenticating for each request. Table 15–4 Non-SSO Authentication Methods ID Store Authentication Oracle Internet Directory rwsec, or JPS-OID configured Authentication against Oracle Internet Directory Embedded ID store in-process servers Authentication against embedded ID store of WebLogic Server JAZN-XML File-based ID store standalone servers Authentication against file-based ID store