 Contents |
 Index |
|
|
|
|
Access control enables you to restrict user access to reports that are run on Oracle Reports Services. Oracle Reports Services uses Oracle WebDB to perform a security check that ensures that users have the necessary privileges to run reports on restricted Oracle Reports Servers and printers. Access control determines the following:
Oracle WebDB stores information about the report definition file (that is, how to run the report) as a packaged procedure. In order to run a report, Oracle WebDB also needs to store access control information about the restricted Oracle Reports Server that accepts the request, and any printers that are used to print report output. These access controls are added using Oracle Reports Services Security wizards in Oracle WebDB. Only users who have Oracle Reports Services system administrator privileges can add access controls in Oracle WebDB.
You can make report requests available to users on the Web by doing the following:
System administrators can run report requests from Oracle Reports Services Security in Oracle WebDB. See Section 5.1.3.7, "Step 7. Setting Parameter Values on the Oracle Reports Services Parameter Form" for more information.
Note:
This section describes how to configure Oracle Reports Services for access control and how to add access information in Oracle WebDB that will be used to run report requests to restricted Oracle Reports Servers.
The steps below assume that you have already configured Oracle Reports Services using the CGI or servlet. See Chapter 3, "Configuring the Oracle Reports Server on Windows NT and UNIX" for more information. See Section 5.1.3, "Setting Up Access Controls in Oracle WebDB Example" for a detailed example on implementing access control in Oracle Reports Services.
To set up access control, you do the following:
You can batch register multiple reports in Oracle WebDB using the Oracle Reports Services Batch Registering utility. Refer to the Oracle Reports Services Batch Registering Reports technical white paper located on the OTN (http://technet.oracle.com).
Installing and configuring the Oracle Reports Services Security in Oracle WebDB involves installing Oracle WebDB and Oracle Reports Services Security feature, and then setting the authentication cookie domain.
Once Oracle Reports Services Security is installed and configured in Oracle WebDB, see Section 5.1.3, "Setting Up Access Controls in Oracle WebDB Example" for information on configuring Oracle Reports Services for access control and adding access to Oracle Reports Servers, reports, and printers in Oracle WebDB.
You must do the following to install and configure the Oracle Reports Services Security feature in Oracle WebDB:
manual for more information.
You can install Oracle Reports Services Security packages from any machine (for example, where your Oracle WebDB or your Oracle Reports Services is installed).
username/password@database).
Table 5-1 Connection to Log on to the Oracle WebDB Schema
You set the authentication cookie domain so that the cookie can send the authentication information to Oracle Reports Services where the report is sent. Click on 
and do the following:
|
|
On the machine where Oracle WebDB is installed:
and type... authentication cookie
wdbsvr.cfg file in a text editor (located in the ORACLE_HOME\LISTENER\CFG directory). Under the [SERVER] section, set the configuration parameter using the following syntax, where my_company.com is the domain name of the Oracle Reports Services
ORCookieDomain=my_company.com
This example provides step-by-step instructions that will help you configure your Oracle Reports Services for access control. You will add access to the report definition file, Oracle Reports Servers, and printer in Oracle WebDB. Finally, you will publish the report request on a Oracle WebDB site so that authorized users can run this restricted report.
This example assumes the following:
security.rdf. This report generates a 401K report for employees. Information about this report will be added in Oracle WebDB. This file is provided for you in the ORACLE_HOME\TOOLS\DOC60\US\RBBR60 directory.
security.rdf file on Oracle Reports Services. Use the demo CD that came with your product package to install the SQL scripts that are used to install the demo tables in your database. These SQL scripts can be run from the Start->Programs menu.
The 401K report that you add access to in Oracle WebDB contains vested 401K portfolio information of four fictional employees. You want to restrict access to this confidential report only to these four employees. Further, you want to ensure that the requesting employee can access only his personal information, not other employees' information. This can be achieved by doing the following:
security.rdf report was built with two user parameters: last name and social security number (SSN). In Oracle WebDB, you will build a Runtime Parameter form that contains a list of values of the last names of 401K participants and an unrestricted parameter for the social security number.
Suppose that Jeff Abers wants to review his 401K investments. On the Runtime Parameter Form, in addition to the destination parameters, he will need to choose his last name from a list of values and then enter his social security number. When he runs the report, he must log on. Oracle WebDB checks that he has the access privileges needed to run the report. If he logs on successfully, then Oracle Reports Services processes the request. If he entered the correct last name and social security number combination, then his personal 401K report is delivered as requested.
Oracle Reports Services must be installed and configured before you can perform this step. See Chapter 3, "Configuring the Oracle Reports Server on Windows NT and UNIX" for information.
To configure Oracle Reports Services for access control, you will do the following:
You need to create a TNSnames alias for Oracle WebDB in the tnsnames.ora file on the machine where the Oracle Reports Server is installed. This enables the Oracle Reports Server to communicate with Oracle WebDB. If you installed the Oracle Reports Services Security feature from your Oracle Reports Services machine, then a TNSnames alias for Oracle WebDB has already been created for you. You can skip this step and go to Section 5.1.3.1.2, "Restricting Access to Oracle Reports Servers".
You can create the TNSnames alias using the Net8 Easy Config tool or by editing the tnsnames.ora file in a text editor.
To create the TNSnames alias, you will need the following information:
You can find the host name, port number, and SID in the tnsnames.ora file in the ORACLE_HOME\NETWORK\ADMIN directory on the machine where the database is installed.
On the Oracle Reports Services machine:
sec_rep.world = (DESCRIPTION = (ADDRESS = (PROTOCOL = TCP) (HOST = my_pc.my_domain) (PORT = 1521) ) (CONNECT_DATA = (SID = ORCL) ) )
where:
tnsnames.ora file.
To restrict access to Oracle Reports Server, you set the SECURITYTNSNAME parameter in Oracle Reports Services configuration file. Once set, access control is enforced. Users will be required to authenticate themselves to run report requests to this restricted Oracle Reports Server.
To run a report request, you add access to the report definition file in Oracle WebDB. If you want to run unrestricted report requests, then ensure the Run Only Registered Report Definition Files option is unchecked in the Server Access wizard in Oracle WebDB for this Oracle Reports Server. Users, however, will still need to authenticate themselves to the Oracle Reports Services to run the report.
On Oracle Reports Services machine, do the following:
ORACLE_HOME\REPORT60\SERVER directory) in a text editor. Set the SECURTYTNSNAME parameter using the following syntax, where sec_rep is the TNSnames alias of the Oracle WebDB server instance defined in the tnsnames.ora file:
SECURITYTNSNAME="sec_rep"
You will need to create the following user accounts:
In order to perform security administration in Oracle WebDB, you must have a user account that is assigned the RW_ADMINISTRATOR role. Only those users with the RW_ADMINISTRATOR role can access Oracle Reports Services Security wizards in Oracle WebDB. In addition, you must have BUILD IN privileges to the schema that will own the report's packaged procedure and any list of values (LOV) that you might create. If you have a user account with DBA privileges, then you can create user accounts. Otherwise, contact your DBA and request that user accounts be created. Click on and do the following:
|
|
To add a report item to an Oracle WebDB site, an Oracle WebDB site must be created. If you will be responsible for creating the Oracle WebDB site, then you must be a DBA with Execute privileges on the SYS.DBMS_SQL packaged procedure with the Grant option. This privilege will allow you to create the site and grant Manage Item privileges to other users.
If someone else is the site administrator, then you must be given Own, Manage Item, or Create With Approval privileges for the folder that you want to add items to. Contact the DBA or site administrator for more information.
Any users who will be given access privileges to run report requests must have a user account that Oracle WebDB can recognize. Oracle Reports Services has four predefined roles that can be assigned to users. Each role gives users access to certain administrative controls, such as monitoring jobs or viewing error messages. By default, Oracle Reports Services basic user functions (that is, the RW_BASIC_USER role) are implied if users are not assigned specific Oracle Reports Services roles.
If you have a user account with DBA privileges, then you can create user accounts. Otherwise, contact your DBA and request that user accounts be created. Click on and do the following:
|
|
For this example, create or request a user account for Jeff Abers, one of the employees who participates in the 401K plan. His user account should be JABERS. He is assigned the basic user role. Contact your DBA to create user accounts for those users who require access privileges to run report requests. Assign users Oracle Reports Services roles as needed.
If the JABERS user account already exists, then append your initials to it (for example, JABERSAA).
An availability calendar determines when report definition files, Oracle Reports Servers, and printers are available for processing. Availability calendars are not necessary if the reports definition files, Oracle Reports Servers, and printers are always available for processing.
You can create two types of availability calendars:
You can associate only one availability calendar with a report definition file, Oracle Reports Servers, or printer. If your production environment requires more than one availability rule, then you will need to combine availability calendars.
In this example, you will create a production calendar that determines the availability for every day of the week, days with scheduled maintenance, and holidays. To do this, you will create the following availability calendars:
You will create a daily calendar with an availability period of Sunday through Saturday from 12:00 a.m. to 10:00 p.m.
Click 
to access context-sensitive help for the current wizard page. Click on the title bar to access the Oracle WebDB help system.
from the navigation toolbar on any Oracle WebDB page to access the Administer page.
Daily as the Calendar Name. If the Daily calendar already exists, then append your initials to it (for example, DailyAA).
.
.
.
You will create a maintenance calendar with an availability period of every Saturday from 3:00 p.m. to 10:00 p.m. In a later step, you will add this calendar to the Production calendar and then exclude it to prohibit processing based on the date and time specified.
Maintenance as the Calendar Name. If the Maintenance calendar already exists, then append your initials to it (for example, MaintenanceAA).
.
Table 5-2 Maintenance Calendar Rule
You will create a Christmas calendar with an availability period of every December 25 from 12:00 a.m. to December 26 at 12:00 a.m. In a later step, you will add this calendar to the Production calendar and then exclude it to prohibit processing based on the date and time specified.
Christmas as the Calendar Name. If the Christmas calendar already exists, then append your initials to it (for example, ChristmasAA).
.
Table 5-3 Christmas Calendar Rule
| Field | Value |
|---|---|
|
Duration Start |
Specify December 25 and 12:00 a.m. |
|
Duration End |
Specify December 26 and 12:00 a.m. |
|
Repeat |
Choose Yearly. |
In this example, you create a Production calendar that combines the Daily, Maintenance, and Christmas calendars, then excludes the Maintenance and Christmas calendars, which prohibits processing based on their availability rules.
Production as the Calendar Name. If the Production calendar already exists, then append your initials to it (for example, ProductionAA).
.
to move the selected calendars to the Selected Availability Calendars list box, or click 
to select all available calendars.
.
to move the Maintenance and Christmas calendars to the Excluded Availability Calendars list box. Doing so prohibits processing on the date and time specified in each calendar.
.
It is good practice to check the combined calendar at this point. You can verify that the calendars you prohibited processing on are excluded during the period specified. Scroll to December to ensure that December 25 is excluded from processing. Choose the Day option and scroll to a Saturday to ensure that processing is unavailable from 3 p.m.
.
Printer access defines the following:
You must already have a printer that Oracle Reports Services can recognize installed and running. Refer to the DESNAME and DESFORMAT command line arguments described in Appendix A, "RWCLI60 Command Line Arguments" for more information.
Prerequisite:
Click to access context-sensitive help for the current wizard page. Click on the title bar to access the Oracle WebDB help system.
Reports_Printer in the Printer Name field. If this printer name already exists, then append your initials to it (for example, Reports_PrinterAA).
\\net_machine\my_printer). Refer to your operating system's documentation for more information.
.
to move this user to the Selected Users list box.
.
Production as the availability calendar, or click 
to find the availability calendar. If you want to make this printer available all the time, then do not specify a calendar.
.
Oracle Reports Server access defines the following in Oracle WebDB:
Click to access context-sensitive help for the current wizard page. Click on the title bar to access the Oracle WebDB help system.
Repserver in the Server Name field. If this server name already exists, then append your initials to it (for example, RepserverAA).
tnsname.ora file when you installed and configured Oracle Reports Services. See Chapter 3, "Configuring the Oracle Reports Server on Windows NT and UNIX" for more information.
http://my_webserver/cgi-bin/rwcgi60.exe
The Oracle Reports Services Web Gateway URL is determined by the virtual location of the CGI.
Reports_Printer from the Printers list box.
.
Be sure that you select the same users who have been given access to the printer.
to move this user to the Selected Users list box.
.
Production as the availability calendar, or click to find the availability calendar. If you want to make this server available all the time, then do not specify a calendar.
.
Report definition file access defines the following in Oracle WebDB:
.RDF, .REP, or .XML file you want to make accessible in Oracle WebDB.
In this example, you restrict access to the security.rdf file (located in the ORACLE_HOME\TOOLS\DOC60\US\RBBR60 directory) in Oracle WebDB based on the following information:
Click to access context-sensitive help for the current wizard page. Click on the title bar to access the Oracle WebDB help system.
If you want users to select values from a list of values for any system or user parameters you define on the Optional Parameters page, then you must create this list in Oracle WebDB.
Recall that the security.rdf report gathers information about the vested portfolios of employees participating in the company's 401K plan. You want to restrict access to only those employees who participate in the plan. In this example, you create a list of values for the P_Lastname user parameter that lists the last names of these employees.
If you are not publishing the report request on an Oracle WebDB site, then creating a list of values in Oracle WebDB is not necessary. You can create a list of values in Oracle Report Builder using the Parameter Form editor. Click on and do the following:
|
|
from the navigation toolbar.
LASTNAME_LOV as the name of LOV. If this LOV already exists, then append your initials to it (for example, LASTNAME_LOVAA).
Table 5-4 Static List of Values
| Display Value | Return Value | Display Order |
|---|---|---|
|
Abers |
Abers |
1 |
|
Costner |
Costner |
2 |
|
Matsumoko |
Matsumoko |
3 |
|
Williams |
Williams |
4 |
If you back out of the wizard page (that is, click Back on your Web browser), then you will lose the settings you defined on that page. If you need to make changes, then first create the packaged procedure for the report by completing the wizard. Then, edit the package by clicking Edit on the Manage Component page.
from the navigation toolbar and click Reports Developer Security.
Investment_Report in the Report Name field. The report name cannot be prefaced with numeric characters (for example, 401K_report is an invalid file name and my_401K_report is valid). If this report name already exists, then append your initials to it (for example, Investment_ReportAA).
repserver from the Reports Servers list box.
security.rdf as the Oracle Reports Services File Name. Ensure Oracle Reports Services can find this report definition file. The report's source path must be set in the SOURCEDIR parameter in Oracle Reports Services configuration, or the path must be set in the REPORTS60_PATH environment variable.
.
to move this user to the Selected Users list box.
.
Production as the availability calendar, or click to find the availability calendar. If you want to make this report definition file available all the time, then do not specify a calendar.
.
.
P_LASTNAME in the Parameter Name column. When users run this report at runtime, they will be required to select a last name to run the report. The P_LASTNAME is the name of the parameter defined in report. Open the security.rdf file in Oracle Report Builder and view the parameters in the Parameter Form editor to determine the parameter's name.
LASTNAME_LOV in the LOV column to enable users to choose the last name of the 401K participant from a list of values, or click to find the LOV.
P_SSN in the second row of the Parameter Name column to require users to type their social security number in the Runtime Parameter Form.
COPIES in the third row of the Parameter Name column to restrict the number of copies the user can print when outputting the report to a printer.
1 in the Low Value column.
2 in the High Value column.
USERID in the fourth row of the Parameter Name column. This enables users to specify the database that they can connect to if they want to schedule the report to run automatically.
twice to skip the Validation Trigger page.
If an invalid package is created, then you will be unable to proceed to the next step. Verify the access controls that you defined for the printer, Oracle Reports Server, and report. Make the necessary changes and then try to create a valid production package for this report definition file.
To edit access to the report definition file, click 
from the navigation toolbar. At the Reports Developer Security menu, choose Report Definition File Access. Then, to access the Manage Component page for a particular report, find the report or choose the report from the Recently Edited Report Definition File section. At the Manage Component page, click Edit.
As the Oracle Reports Services system administrator, you can run the restricted report request you just created to ensure that it will run as expected. You also can set the default parameters that will be available to users at runtime. You can run and set default parameter values from the Manage Component page.
In this example and the next, you will choose parameters values to run the report to cache for debugging purposes, not to set the default values that will be available to users at runtime. You will set the default values in Section 5.1.3.7.3, "Setting the Default Parameters for Users at Runtime".
To access the Manage Component page, click
. At the Reports Developer Security menu, choose Report Definition File Access. Then, find the report or choose the report from the Recently Edited Report Definition File section.
Table 5-5 Parameter Form Settings for Debugging Cache Output
Following are the steps you would follow if you want to run report output to a restricted printer:
Table 5-6 Parameter Form Settings for Debugging Printer Output
Once you are satisfied that the report can run based on the restrictions imposed, you can set the default parameter values and choose the parameters that will be available to users on the Runtime Parameter Form.
Table 5-7 Default Parameter Settings for Users
You might want to make parameters visible to users on the Runtime Parameter Form only when they need to take an action on the parameter (that is, select or input a value) to run the request. In this case, the Server and Printer parameters are restricted to one server and printer. The DESNAME parameter is populated automatically with the printer name when Printer is chosen as the Destination type. These parameters do not require user input to run the report.
When users run the report from an Oracle WebDB site, they can set the default parameters values available to them on the Runtime Parameter Form to their personal preferences. See Section 5.1.3.8, "Step 8. Making the Report Available to Users" for more information.
You make the report available to users in an Oracle WebDB site by adding a link as an Oracle WebDB component that points to the INVESTMENT_REPORT packaged procedure.
Create a Oracle WebDB site if it has not already been created. Click on and do the following:
|
|
To create an Oracle WebDB site, the Oracle Reports Services system administrator will need to have site administrator privileges (that is, a DBA with execute privileges on the SYS.DBMS_SQL packaged procedure with the Grant option). If someone else is the site administrator, then ask that person to create the Oracle WebDB site.
You will create the folder in which the report's packaged procedure is added. By default this folder and any items that are added to it are available only to the owner of the folder (that is, the Oracle Reports Services system administrator). You can make the folder available to all users (that is, to public users) or available only to users who have been given access to it. You will restrict access to this folder only to the users who have access privileges to run this report (that is, JABERS).
If you make a folder public, then PUBLIC users (that is, users who have not logged on to the Oracle WebDB site) can access the report's Parameter/Scheduling form and can unknowingly save their personal information to it. Subsequent PUBLIC users will see this confidential information. To prevent this from happening, it is best to restrict access to the folder to those users who have access to run the report. Users must log on to access the restricted folder. Once logged on, the information saved on the Parameters/Scheduling form is secured and can only be viewed.
Click to access context-sensitive help for the current wizard page. Click on the title bar to access the Oracle WebDB help system.
http://my_oraclewebdb_server.com:1111/my_oraclewebdb_site
If you have site administrator privileges to create a site, then click 
from the navigation toolbar on any Oracle WebDB page to access the Sites page. Click Site Home Page to access the Oracle WebDB site.
To add an Oracle WebDB component to an Oracle WebDB site, your Oracle Reports Services system administrator user account must have site administrator privileges (that is, a DBA with execute privileges on the SYS.DBMS_SQL packaged procedure with the Grant option). If you do not have site administrator privileges, then you must have Own, Manage Item, or Create with Approval privileges for the folders in which the component is being added. Contact your DBA or site administrator for more information.
.
to add a new folder to your site.
Benefits as the title of the folder that will be displayed in the Oracle WebDB site. If the Benefits folder has already been created by another user, then append your initials to the folder name (for example, BenefitsAA).
JABERS as the Name of the user you want to have access to this folder.
to return to the Benefits folder.
To add the report request to the folder, do the following:
to access the Item wizard and add the report request to this folder.
WEBDB is the name of the schema that owns this report's package procedure for the 401K report.
Investment Summary Report as the Title.
Restricted 401K Report in the Description text box.
You will run this report as JABERS, not as the Oracle Reports Services system administrator. In this example, you set your default parameter settings for Jeff Abers and then run the report.
Click to access context-sensitive help for the current wizard page. Click on the title bar to access the Oracle WebDB help system.
JABERS.
Table 5-8 User's Default Parameter Settings
The default settings saved here are the ones that are accessible only to this user. If you (or someone else) logged on as a different user, then the default settings defined by the Oracle Reports Services system administrator would display. That user could then personalize her or his own settings.
Suppose that Jeff Abers only wants to review his 401K investments once a month. Further, he prefers to have this report run automatically and pushed to his own personal folder by 9:00 a.m. on the last Friday of every month. First, you will create Jeff's own personal folder (that is, one that only his user account can access). Then, you will schedule the report to run automatically.
|
Prerequisite: You must have already reviewed the example in Section 5.1.3.8, "Step 8. Making the Report Available to Users". |
To ensure that only the specified user can access his or her own personal reports, the user (that is, you are logged on as JABERS for this example) can create her or his own personal folder.
Click to access context-sensitive help for the current wizard page. Click on the title bar to access the Oracle WebDB help system.
.
You are the owner of your personal folder. No one else can access it unless you give them permission to do so. You are ready to schedule the 401K report to run automatically and to push it to the JABERS personal folder.
In this example, you will schedule the report to run every last Friday of the month at 9:00 a.m. You also want to retain historical records of your 401K results for two months.
Click to access context-sensitive help for the current wizard page. Click on the title bar to access the Oracle WebDB help system.
Last Friday of each month on or before the 30 th.
Rather than waiting until the end of the month for the report to run, set the repeat option to repeat every n hours. Once you are satisfied that the report output can be pushed successfully to the result folder, reset the repeat pattern.
Table 5-9 Output Destination Settings
To view the pushed report output, do the following:
Notice that in addition to a link to the report itself, a link to status information about the report is also available. Use this status link to help you troubleshoot any problems you might have running this scheduled report. Depending on the Oracle Reports Services role (for example, RW_BASIC_USER) this user is assigned, you might see different status details. If users are having problems scheduling and running their reports, then they should contact the Oracle Reports Services system administrator for help.
Suppose that the Human Resource director asked you (the Oracle Reports Services system administrator) to make a stock report available to all employees. You want to run this stock report automatically every morning so that employees can monitor the status of certain stocks. This report will be pushed to a public folder from which all employees can view it.
Use the examples in this chapter to help you add access to the template.rdf report (located in the ORACLE_HOME\TOOLS\DOC60\US\RBBR60 directory) in Oracle WebDB.
Since you (as the Oracle Reports Services system administrator) will be scheduling this report to run and push to a public folder, this report needs to be accessible only to the Oracle Reports Services system administrator.
Add this report's packaged procedure to the Benefits folder as an Oracle WebDB component. Then, schedule this report to run every morning at 10:00 a.m., pushing the report output to a new folder called Stocks.
The Stock folder must be set up to display for public users.
You have successfully configured Oracle Reports Services for access control. In this chapter, you learned how to do the following:
|
 Copyright © 2000 Oracle Corporation. All Rights Reserved. |
|