XML PDS Configuration File

15-2 Publishing Reports to the Web with Oracle Reports Services

15.1.1 Overview

Oracle Reports 11g Release 1 11.1.1 uses a standards-based Java EE security model through Oracle Platform Security Services. This provides a flexible, simple to administer security mechanism. It can be used with standalone Oracle Reports install or any Forms-Reports combination. The policy store and the identity store used for authentication and authorization can be standard JAZN-XML based or any LDAP server, including Oracle Internet Directory through JAZN-LDAP, providing flexibility. Oracle Reports 11g Release 1 11.1.1 accomplishes authentication through Single Sign-On, Oracle Internet Directory, Embedded ID Store, and JAZN-XML File-based ID Store. For authorization, Oracle Reports 11g Release 1 11.1.1 supports Oracle Internet Directory, File-based, and Portal-based methods. In prior releases, Reports Server authentication was restricted to use only Oracle Internet Directory. If you want to revert to the security mechanism of prior releases, you can do so in Oracle Enterprise Manager, as described in Section 7.8.1.1, Switching to Oracle Portal Security . If you want to use OracleAS Single Sign-On without implementing data source security or Oracle Portal, refer to Chapter 17, Configuring and Administering OracleAS Single Sign-On . Alternatively, you might have your own application for launching reports with its own login mechanism and usergroup repository, or have your own mechanism for protecting data sources for example, you might choose to use a different LDAP server to store user and group information. In this case, Oracle Reports Services provides interfaces that allow you to integrate it with these non-Oracle components, as described in Section 15.14, Security Interfaces . 15.1.2 What’s New in This Release? Oracle Reports 11g Release 1 11.1.1 uses Oracle Platform Security Services, enabling a new security mechanism that provides the features and functionality described in Table 15–1 a subset of Table 1–1, 11g Functionality vs. 10g Functionality : Note: JAZN-XML is an XML file which is configured by the user to use as an id store andor policy store. Table 15–1 11g Security Features vs. 10g Functionality 11g New Features Equivalent 10g Functionality A standards-based Java EE security model through Oracle Platform Security Services. This provides a flexible, simple to administer security mechanism. For more information, see Section 15.1, Introduction to Oracle Reports Security Reports Server authentication restricted to use only Oracle Internet Directory. Authorization of Reports Server required Oracle Portal-based security model using Portal metadata repository for checking authorization. Oracle Enterprise Manager advanced user interface. Administrators can use Oracle Enterprise Manager to more easily define and manage granular security policies for reports, directories, Web commands, and readwrite access to directories. For more information, see Section 7.8, Securing Oracle Reports Services in Chapter 7, Administering Oracle Reports Services Using Oracle Enterprise Manager Basic UI in Oracle Portal for defining the policies. Hard-coded Web command access to the Oracle Reports seeded roles. Access policies at file report level only, not folder level. Securing Oracle Reports Services 15-3

15.1.3 Resources Protected

Oracle Reports Services encompasses functionality for three main areas of security: ■ Application Security that is, controlling access to the report application, where users launch report requests ■ Resource Security that is, controlling access to reports and Reports Servers ■ Data Source Security that is, for controlling access to a particular database

15.1.3.1 Application Security

Generally, users must log on to an application or site for example, your own corporate Web site, Oracle WebCenter from which they can access and run their reports. This launcher application is typically protected by some sort of login facility, such as OracleAS Single Sign-On. Once they successfully gain entry into the launcher application, resource security takes over and determines which reports and destinations a given user or group may request. Readwrite access to directories at Reports Server level. Administrators can control the input folders from which reports can be served and output folders to which the output of reports servers can be pushed. This ensures there is no security vulnerability. For more information, see Section 15.4.6, Defining ReadWrite Access to Directories REPORT_RESTRICT_DIRECTORIES as an interim feature. Database proxy authentication. Support for database authentication using proxy users: ■ Additional security through control of users that are allowed to connect to the database through Oracle Reports. ■ Scalability, through reuse of a single database connection. Not Applicable Security check for distribution destinations. Ability to define security policies for distribution jobs. For example, you can define a security policy that specifies report output may not be burst to ENHANCEDSPREADSHEET format; if the distribution XML file specifies ENHANCEDSPREADSHEET format, the attempt to generate a report to this output format displays an error. No security check performed for destinations specified in the distribution XML file. Security check for system parameters. A security check is performed for all system parameters, including those specified in the report definition as well as on the command line. No security check performed for system parameters. Security auditing. Audit authentication and authorization on the Reports Server. Security for report output from Oracle Forms Services. With no configuration required, support for intermediate-level security even when Oracle Forms Services and Oracle Reports Services are not secured. For more information, see Section 15.11, Intermediate-level Security for Forms and Reports , Section 17.6, Oracle Forms Services Security Considerations and Section 18.8.2, Generating Random and Non-Sequential Job IDs . Anyone is able to see anyone else’s report output by guessing the job ID based on sequential job ID assignment. Table 15–1 Cont. 11g Security Features vs. 10g Functionality 11g New Features Equivalent 10g Functionality