End-to-End Security Scenarios Oracle Fusion Middleware Online Documentation Library

15-20 Publishing Reports to the Web with Oracle Reports Services The following table describes Portal-based security scenarios. This scenario involves the following: ■ JPS-OID for authentication ■ JAZN-XML for authorization policies To use this combination of authentication and authorization, complete the following steps: 1. Enable JPS-based security. On the Reports Server Advanced Configuration page in Enterprise Manager, select the Enable Security check box, and then select the Oracle Platform Security for Java option. 2. Add the following property in the jps-config-jse.xml file: property name=oracle.security.jps.enterprise.user.cl ass value=weblogic.security.principal.WLSUserIm pl 3. Configure JPS-OID as an ID store. For more information, see Configuring External Oracle Internet Directory as ID Store When Using JPS-Based Security . 4. Create security policies. Refer to Section 7.8.2, Defining Security Policies for Reports to update the report security policies defined in Oracle Internet Directory. 5. Map users to application roles. For more information about mapping users to application roles, see Mapping Users to Application Roles . 6. If the system-jazn-data.xml file is used as the policy store, search for the reports application in the system-jazn-data.xml file. To use JPS to authorize users in Oracle Internet Directory, add the corresponding users in the member section of the system-jazn-data.xml. For more information, see Section 15.4.2, Additional Step When Using JPS for Authorization . Table 15–8 Portal-Based Security Scenarios Security Scenario Description Portal-Based Authorization with Single-Sign-On Authentication for Reports Servlet This scenario involves the following: ■ Single Sign-On for authentication ■ Portal-based authorization policies To use this combination of authentication and authorization, complete the following steps: 1. Enable Single Sign-On. For more information, see Enabling and Disabling Single Sign-On . 2. Ensure that Portal-based security is enabled. If you have enabled JPS-based security, switch to Portal-based security. In the Advanced Configuration Page in Enterprise Manager, select the Enable Security check box and then the Security features available through Oracle Portal option under the Reports Security section. 3. Create security policies in Oracle Portal. For more information about creating security policies in Oracle Portal, see the Securing Oracle Portal chapter in the Oracle Fusion Middleware Administrator’s Guide for Oracle Portal. 4. Map users to application roles. For more information about mapping users to application roles, see Section 16.1, Creating Reports Users and Named Groups Portal-Based Authorization with Oracle Internet Directory as ID Store for Other Reports Clients Table 15–7 Cont. JPS-Based Security Scenarios Security Scenario Description Securing Oracle Reports Services 15-21

15.6 Recommended Production Scenario for JPS-Based Security

For JPS-based security, the following production scenario is recommended: ■ For authentication, Oracle Internet Directory as ID store, or Single Sign-On ■ Oracle Internet Directory as Policy store for authorization If you are not using Single Sign-On, use Oracle Internet Directory for authentication.

15.7 Recommended Production Scenario for Portal-Based Security

For Portal-based security, the following production scenario is recommended: ■ Oracle Internet Directory as ID store for authentication, or Single Sign-On ■ Portal-based authorization If you are not using Single Sign-On, use Oracle Internet Directory for authentication.

15.8 Managing Users and Security Policies

This section describes how to manage users and security policies for in-process servers and standalone servers. It discusses the following topics: ■ Adding Users to WebLogic Embedded ID Store for In-Process Servers ■ Adding Policies to Policy Store for In-Process Servers ■ Mapping Users to Application Roles ■ Adding Users to system-jazn-data.xml for Standalone Servers ■ Adding Policies to Policy Store for Standalone Servers

15.8.1 Adding Users to WebLogic Embedded ID Store for In-Process Servers

To add users to the ID store for an in-process server, complete the following steps: 1. Navigate to the WebLogic Server Administration Console. This scenario involves the following: ■ Oracle Internet Directory for authentication ■ Portal-based for authorization policies To use this combination of authentication and authorization, complete the following steps: 1. Configure Oracle Internet Directory as an ID store. For more information, see Configuring External Oracle Internet Directory as ID Store . 2. Ensure that Portal-based security is enabled. If you have enabled JPS-based security, switch to Portal-based security. In the Advanced Configuration Page in Enterprise Manager, select the Enable Security check box and then the Security features available through Oracle Portal option under the Reports Security section. 3. Create security policies in Oracle Portal. For more information about creating security policies in Oracle Portal, see the Securing Oracle Portal chapter in the Oracle Fusion Middleware Administrator’s Guide for Oracle Portal. 4. Map users to application roles. For more information about mapping users to application roles, see Section 16.1, Creating Reports Users and Named Groups Table 15–8 Cont. Portal-Based Security Scenarios Security Scenario Description 15-22 Publishing Reports to the Web with Oracle Reports Services

2. From the Domain Structure window on the left pane of the console, select

Security Realms myrealm. The Settings for myrealm page is displayed.

3. Click the Users and Groups tab.

4. Click New to add users.

The User Properties page is displayed. 5. Enter the parameters, and select the DefaultAuthenticator from the Provider drop-down list.

6. Click OK.

15.8.2 Adding Policies to Policy Store for In-Process Servers

To add policies to the policy store for an in-process server, complete the following steps: 1. Log in to Enterprise Manager 2. Navigate to the Reports Application home page.

3. From the Reports menu, select Administration Manage Reports Security

Policies . The Security Policy Configuration page is displayed. 4. Click Create to add or edit Reports policies, Web command policies or both. The Security Configuration for Reports page is displayed.

5. Enter appropriate values in the Security Configuration for Reports page.

6. Click OK

For more information about security policies, see Section 7.8.2, Defining Security Policies for Reports .

15.8.3 Mapping Users to Application Roles

After configuring the users, you must map users present in the ID store to one or more application roles. You can configure an application role for an in-process server either through Oracle Enterprise Manager or manually. In Enterprise Manager, you can complete this task as follows:

1. Navigate to the WebLogic Domain menu.

2. Choose Security Application Roles.

The Application Roles page is displayed. In this page, you can map users to application roles. If the system-jazn-data.xml file is used as the policy store, you can add the following under the reports entry in the system-jazn-data.xml file to configure users to application roles manually: app-role namerw_administratorname display-nameReports Administratordisplay-name classoracle.security.jps.service.policystore.ApplicationRoleclass members member Securing Oracle Reports Services 15-23 classweblogic.security.principal.WLSUserImplclass nameweblogicname member members app-role For a sample system-jazn-data.xml file, see Sample system-jazn-data.xml File

15.8.4 Adding Users to system-jazn-data.xml for Standalone Servers

If the system-jazn-data.xml file is used as the ID store, you can users to ID store for a standalone server by completing the following steps: 1. Add users to the system-jazn-data.xml file by replacing jazn-realm with the following: jazn-realm realm namejazn.comname users user nameweblogicname credentialspasswdcredentials user users realm jazn-realm For a sample system-jazn-data.xml file, see Sample system-jazn-data.xml File

15.8.5 Adding Policies to Policy Store for Standalone Servers

You can add policies to a policy store for a standalone server through Oracle Enterprise Manager. 1. Log in to Oracle Enterprise Manager. 2. Navigate to your Reports Application home page.

3. From the Reports menu, select Administration Manage Security Policies.

4. Click Create to add reports and web command policies.

5. Assign roles to the application policies.

6. Click OK.

For more information about security policies, see Section 7.8.2, Defining Security Policies for Reports .

15.9 Configuring External Oracle Internet Directory and Reassociating Reports

This section describes how to configure external Oracle Internet Directory for in-process servers and standalone servers and to reassociate Reports with Oracle Internet Directory and another Portal. It discusses the following topics: ■ Configuring External Oracle Internet Directory for In-Process Servers ■ Reassociating Reports with Oracle Internet Directory 15-24 Publishing Reports to the Web with Oracle Reports Services ■ Reassociating Oracle Reports to Oracle Portal ■ Configuring External Oracle Internet Directory for Standalone Servers

15.9.1 Configuring External Oracle Internet Directory for In-Process Servers

You can migrate from the default embedded ID store of WebLogic Server to an external Oracle Internet Directory to configure the ID store and Policy store settings. Note that configuration of an external Oracle Internet Directory is a post-installation procedure.

15.9.1.1 Configuring External Oracle Internet Directory as ID Store When Using JPS-Based Security

If you are using JPS-based security, you can configure an external Oracle Internet Directory as ID store through the Oracle WebLogic Server Administration Console. To configure an external Oracle Internet Directory as an ID store through Oracle WebLogic Server, complete the following steps: 1. Navigate to the WebLogic Server Administration Console.

2. From the Domain Structure window, select Security Realms.

The Summary of Security Realms page is displayed. 3. Select a Realm from the Realms table.

4. From the settings for the realm page, click the Providers tab.

5. Select New from the list of Authentication Providers.

6. Enter a name in the Name field. From the Type drop-down list, select

OracleInternetDirectoryAuthenticator , and click OK.

7. Select the new authenticator, and set the Control Flag to Sufficient.

8. Select the Provider Specific tab, and enter valid values in the appropriate fields.

9. Select the default Authenticator and set the Control Flag to OPTIONAL.

10. Click Save.

11. Restart the Admin Server.

12. Select the Security Realm Users and Groups. Ensure that all users of external

Oracle Internet Directory are seen on this page. Now, users trying to access the in-process servers are authenticated based on the users specified in the external Oracle Internet Directory. 15.9.1.2 Configuring an External Oracle Internet Directory as Policy Store When Using JPS-Based Security If you are using JPS-based security, you can configure an external Oracle Internet Directory as policy store though Oracle Enterprise Manager. To configure the policy store in Oracle Enterprise Manager, complete the following steps: 1. Log in to Oracle Enterprise Manager. 2. Navigate to the WebLogic domain.

3. From the WebLogic Domain menu, select Security Security Provider

Configuration .