Prerequisites Oracle Fusion Middleware Online Documentation Library

17-4 Publishing Reports to the Web with Oracle Reports Services ■ Oracle HTTP Server The Oracle HTTP Server processes requests from the client browser. ■ Reports Servlet Oracle Reports Servlet rwservlet is a component of Oracle Reports Services that runs inside Oracle WebLogic Server. When a report request comes to the Oracle HTTP Server, Oracle Reports Servlet rwservlet passes the job request to Reports Server. ■ Reports Server Reports Server rwserver processes client requests, which includes ushering them through authentication and authorization checking, scheduling, caching, and distribution. ■ OracleAS Single Sign-On OracleAS Single Sign-On is responsible for managing users Single Sign-On sessions. It verifies login credentials by looking them up in Oracle Internet Directory. ■ Oracle Internet Directory Oracle Internet Directory is Oracles highly scalable, native LDAP version 3 service and hosts the Oracle common user identity. OracleAS Single Sign-On authenticates users against the information stored in Oracle Internet Directory. As noted in earlier sections, when Single Sign-On is enabled for Oracle Reports Services, it checks Oracle Internet Directory for user and group privilege information. It also retrieves data source connection information from Oracle Internet Directory. ■ Oracle Delegated Administration Services The Delegated Administration Service provides a comprehensive interface for making updates to Oracle Internet Directory. Oracle Reports Services displays Oracle Delegated Administration Services when it encounters a Single Sign-On key that does not already have a data source connection string associated with it in Oracle Internet Directory. For more information, refer to Chapter 17, Configuring and Administering OracleAS Single Sign-On .

17.3 Administering OracleAS Single Sign-On

This section describes some of the administrative tasks you may need to perform as you maintain security for Oracle Reports Services. ■ Enabling and Disabling OracleAS Single Sign-On ■ Enabling and Disabling Reports Server Security ■ Enabling and Disabling Data Source Security Note: At the highest level, all communication to and from Oracle HTTP Server may be configured to use SSL. The Oracle HTTP Server incorporates an OpenSSL module to provide support for Secure Sockets Layer SSL and HTTP Secure Sockets Layer HTTPS. Once this is set up in the Oracle HTTP Server see Oracle Fusion Middleware Administrators Guide for Oracle HTTP Server, rwservlet automatically detects the SSL port number. Configuring and Administering OracleAS Single Sign-On 17-5 ■ Connecting to Oracle Internet Directory

17.3.1 Enabling and Disabling OracleAS Single Sign-On

To take advantage of OracleAS Single Sign-On out-of-the-box, the SINGLESIGNON parameter in the Oracle Reports Servlet rwservlet configuration file rwservlet.properties is set to YES, which specifies that you will use OracleAS Single Sign-On to authenticate users. Oracle considers this to be the normal security deployment model and you should set singlesignonnosinglesignon only if you plan to run in a completely custom security configuration. Use Oracle Enterprise Manager to change configuration settings, rather than directly editing configuration files. To enable or disable OracleAS Single Sign-On, see Section 7.8.6, Enabling and Disabling Single Sign-On .

17.3.2 Enabling and Disabling Reports Server Security

In 11g Release 1 11.1.1, Reports Server is secured out-of-the-box using the Portal-based security, by default. However, you can enable JPS-based security, including JAZN-XML authorization. For more information, see Chapter 15, Securing Oracle Reports Services . Use Oracle Enterprise Manager to change configuration settings, rather than directly editing configuration files. To enable or disable security, see Section 7.8.1, Enabling and Disabling Security . During Oracle Fusion Middleware installation, you are asked to select an identity store, a policy store, and a credential store. By default, these are file-based stores. After installation, you can change either of these to LDAP-based stores, such as Oracle Internet Directory. For more information, see Understanding Identities, Policies, and Credentials in Oracle Fusion Middleware Security Guide.

17.3.3 Enabling and Disabling Data Source Security

To enable data source security through OracleAS Single Sign-On, you must do the following: ■ Include SSOCONN in the URL that launches the report. ■ Populate Oracle Internet Directory with data source connection information using one of three methods. If you wish to implement data source security through OracleAS Single Sign-On for your own pluggable data sources, you must perform the following additional task: ■ Add a new resource type to Oracle Internet Directory. The sections that follow explain how to perform these operations.

17.3.3.1 SSOCONN

To enable data source security through OracleAS Single Sign-On, the URL must contain or reference that is, through the key map file an OracleAS Single Sign-On parameter SSOCONN with a value of the form: key_namedata_source_typeconn_string_parameter key_name maps to a string stored in Oracle Internet Directory that provides the necessary information to connect to the database. When Oracle Reports encounters a key_name, it checks to see if the current user has a corresponding key stored in Oracle