16.7 Oracle Forms Services Security Considerations

The default configuration for Oracle Fusion Middleware Forms Services does not run in the Single Sign-On (SSO) mode. The default configuration for Oracle Reports Services does run in SSO mode.

Oracle Forms Services applications calling integrated Oracle Reports Services using the RUN_REPORT_OBJECT built-in procedure will not experience any problems when Oracle Forms Services is running in non-SSO mode and Oracle Reports Services is running in Single Sign-On mode as long as the Reports Server and the requested report are not registered in Oracle Portal.

Other Requirements:

• The property Reports Server must be set explicitly for all report objects in the Oracle Forms Services module.

• If a Reports Server other than the default is being used, that server must be started (using Oracle Enterprise Manager).

• The system variable REPORTS_PATH must be modified in the file ORACLE_INSTANCE/config/reports/bin/reports.sh to reference the path of the reports to be run.

• The first time Reports Server is started, it creates a configuration file called rwserver.conf located in the ORACLE_INSTANCE\config\ReportsServerComponent\server_name directory.

• The default status of Reports Server is secure. To change the Reports Server status to non-secure, modify ORACLE_INSTANCE\config\ReportsServerComponent\server_name\rwserver.conf by commenting out the <security> tag and removing securityId from the <job> tags.

• After making these modifications, the Reports Server must be stopped and restarted (using Oracle Enterprise Manager).

• If Oracle Forms Services is configured to run in Single Sign-On mode, then report requests are sent with the authid provided, based on the Single Sign-On user login.

• Protected reports and Reports Servers can be registered in Oracle Portal.

Table 16-4 lists the possible Forms/Reports combinations and expected results:

Table 16-4 Outcome of Forms/ Reports Integration when Forms is running in SSO Mode or Non-SSO Mode

Report Type	Registered, Secure Reports Server (runs only registered reports)	Registered, Secure Reports Server (runs any reports)	Non-Secure Reports Server
Reports with public access	report generated	report generated	report generated
Reports with specific user access	report generated	report generated	report generated
Reports with no specific user access	report not generated	report not generated	report generated
Non-registered reports	report not generated	report not generated	report generated