User name and password are passed on to

15-14 Publishing Reports to the Web with Oracle Reports Services

15.4.1 Authorization Process

Authorization occurs after a user is authenticated using Single Sign-On or Non-SSO Oracle Internet Directory-based, File-based in case of JPS-based security, and Embedded ID store methods. Once the user is authenticated, the report request must go through the authorization process, as shown in Figure 15–4 . Figure 15–4 Authorization Process Flow The following numbered steps map to the numbers in Figure 15–5 :

1. Reports Server validates the user privileges against the policies defined in the

Policy Store. Reports Server validates the user privileges against the policies defined in Policy Store JAZN-XML, LDAP, or Portal repository by the user. Reports Server checks whether the user has the necessary privileges to run the report on the parameters specified in the Policy Store. If the validation check fails for any reason, then an error condition is returned to the user and the process terminates.

2. If the user is authorized to execute the report, Reports Server executes the report

request and passes the report output to rwservlet. Note: If Oracle Portal is configured to perform authorization, and the report request is launched from within Oracle Portal rather than rwservlet, Oracle Reports will similarly validate the users privileges on the report before running it. Even for unauthenticated PUBLIC users viewing public pages, Oracle Reports Services verifies that the PUBLIC user account has appropriate privileges on the report. Note: If the user is executing rwservlet Web commands such as showjobs and getserverinfo, instead of executing a report, Reports Server verifies and authorizes the user based on Policy Store settings. Securing Oracle Reports Services 15-15 Reports Server delegates the job to an engine that accesses the data source, retrieves the data, and formats the report.

3. Report output is passed to Oracle HTTP Server

.

4. Report output is passed to the user

. The completed output is sent to the specified destination. Depending upon the destination, the output may be served back to the browser as shown in Figure 15–5 , sent to a printer, stored in a file for future reference, sent to an FTP server, and so on.

15.4.2 Additional Step When Using JPS for Authorization

Reports policies are granted to application roles. You must associate all users in your ID store embedded ID store of Oracle WebLogic Server or an external Oracle Internet Directory with one of the Reports application roles. You must add the oracle.security.jps.enterprise.user.class property in the jps-config-jse.xml file. In Enterprise Manager, you can complete this task as follows:

1. Navigate to the WebLogic Domain menu.

2. Choose Security Application Roles.

The Application Roles page is displayed. In this page, you can map users to application roles. Alternatively, you can complete this task by manually editing the DOMAIN_ HOMEconfigfmwconfigsystem-jazn-data.xml file. This step is required if you want to use JPS to authorize your users in Oracle Internet Directory. Search for the reports application in the XML file and add a user in the members section. For example, to add a user called orcladmin, add: member classweblogic.security.principal.WLSUserImplclass nameorcladminname member

15.4.3 Defining Security Policies for Reports

Out-of-the-box, default users, roles, and permissions are already created. As administrator, you can specify the reports to which a particular user has access by defining a security policy for each report. In the security policy, you can also specify the server, destination name desname, destination type destype, and other parameters. The security policy is checked when the user provides the user name and password.

15.4.3.1 Defining Security Policies for JPS-Based Security

Refer to Section 7.8.2, Defining Security Policies for Reports to use Oracle Enterprise Manager to update the report security policies.

15.4.3.2 Defining Security Policies for Portal-Based Security

For Portal-based security, you can create a security policy in Oracle Portal. For more information, see the Securing Oracle Portal in the Oracle Fusion Middleware Administrator’s Guide for Oracle Portal.