Oracle HTTP Server routes the request to rwservlet deployed on Oracle rwservlet

Securing Oracle Reports Services 15-11 Figure 15–3 Authentication Process Without Single Sign-On The following numbered steps map to the numbers in Figure 15–4 :

1. User requests the report through a URL

. The user must somehow gain access to the URL that launches the report request for example, through a link on a Web page or a bookmark, and choose the URL.

2. Oracle HTTP Server routes the request to

rwservlet deployed on Oracle WebLogic Server .

3. rwservlet

asks for user credentials that is, user name and password. rwservlet checks for the AUTHID parameter in the URL or an existing Oracle Reports AUTHID cookie. If it finds the AUTHID parameter, it uses that to authenticate the user. If it does not find the AUTHID parameter, it looks for an existing Oracle Reports AUTHID cookie. If the report is launched from Oracle Portal, AUTHID is added to the URL automatically. If neither the AUTHID parameter nor an Oracle Reports AUTHID cookie is found, rwservlet sends the System Authentication page to the Oracle HTTP Server, to display to the user.

4. Oracle HTTP Server displays the login page to the user, and the user provides

user name and password . On the login page, the user must supply a user name and password. This information is stored in an Oracle Reports AUTHID cookie for future reference.

5. User name and password are passed on to

rwservlet. If only partial data source credentials are provided in the URL for example, USERID=scottorqa, the Database Authentication page displays with the partial credentials shown. The user must supply the remainder of the data source credentials before proceeding further. Note that you can control which Database Authentication page is used through the DBAUTH parameter in the rwservlet.properties file. If no data source credentials are provided, the Database Authentication page does not display and it is assumed the report does not require a data source. See Also: Section 8.3, Oracle Reports Servlet Configuration File for more information about the DBAUTH parameter and the rwservlet.properties file. 15-12 Publishing Reports to the Web with Oracle Reports Services The data source credentials are stored in an Oracle Reports USERID cookie for future reference. Note that pluggable data source PDS credentials are not stored in Oracle Reports USERID cookies.

6. rwservlet

forwards user name and password to Reports Server. rwservlet constructs a command line with the necessary information from the previous steps and passes it to Reports Server.

7. Reports Server authenticates the user that is, verifies the user name and

password against the ID Store . Reports Server validates the user credentials against the ID store Oracle Internet Directory, embedded ID store or file-based Oracle Internet Directory. If the validation check fails for any reason, then an error condition is returned to the user and the process terminates.

15.3.3 Authentication Scenarios for JPS-Based Security

This section discusses the following authentication scenarios: ■ If Reports is using JPS security, JPS-OID for security policies, and an embedded ID store ■ If Reports is using JPS security and JPS-OID as ID store

15.3.3.1 If Reports is using JPS security, JPS-OID for security policies, and an embedded ID store

It is recommended that you move users in your current ID store, such as embedded ID store, to Oracle Internet Directory, which is an LDAP-based ID store. Subsequently, you can map users to application roles. For information about moving users to Oracle Internet Directory, see the section Migrating Identities Manually in the Oracle Fusion Middleware Security Guide. For information about mapping users to application roles, see Mapping Users to Application Roles .

15.3.3.2 If Reports is using JPS security and JPS-OID as ID store

You must map users in Oracle Internet Directory to the default application roles. For information about mapping users to application roles, see Mapping Users to Application Roles . Note: By default, an in-process server uses the embedded ID store of Oracle WebLogic Server as the ID store and the system-jazn-data.xml file as the policy store. Standalone servers use the system-jazn-data.xml file as both ID store and policy store. Note: In the above authentication scenarios, if Single Sign-On is enabled, the Single Sign-On screen is displayed. If Single Sign-On is disabled, the Reports sysauth screen is displayed. In either case, users are authenticated against Oracle Internet Directory. If you have not moved your users to Oracle Internet Directory, then users are authenticated against the embedded ID store for in-process servers. For standalone servers, such users are authenticated against the file-based ID store.