 Contents |
 Index |
|
|
|
|
Access control enables you to restrict user access to reports that are run on Oracle Reports Services. Oracle Reports Services uses WebDB to perform a security check that ensures that users have the necessary privileges to run reports on restricted Oracle Reports Services and printers. Access control determines the following:
WebDB stores information about the report definition file (that is, how to run the report) as a packaged procedure. In order to run a report, WebDB also needs to store access control information about the restricted Oracle Reports Services that accepts the request, and any printers that are used to print report output. These access controls are added using Reports Services Security wizards in WebDB. Only users who have Reports Services system administrator privileges can add access controls in WebDB.
You can make report requests available to users on the Web by doing the following:
System administrators can run report requests from Reports Services Security in WebDB. See Section 6.3.7, "Step 7. Setting Parameter Values on the Reports Services Parameter Form" for more information.
Note:
This section describes how to configure Oracle Reports Services for access control and how to add access information in WebDB that will be used to run report requests to restricted Oracle Reports Services.
The steps below assume that you have already configured Oracle Reports Services using Web CGI or Servlet. See Chapter 4, "Configuring Oracle Reports Services on Sun SPARC Solaris" for more information. See Section 6.3, "Setting Up Access Controls in WebDB" for a detailed example on implementing access control in Reports Services.
To install and configure Reports Services security you need to configure WebDB for Reports Services security.
To set up access control, you do the following:
You can batch register multiple reports in WebDB using the Reports Services Batch Registering utility. Refer to the Reports Services Batch Registering Reports technical white paper located on the OTN (http://technet.oracle.com).
Installing and configuring the Reports Services Security in WebDB involves installing WebDB and Oracle Reports Services Security feature, and then setting the authentication cookie domain.
Once Oracle Reports Services Security is installed and configured in WebDB, see Section 6.3, "Setting Up Access Controls in WebDB" for information on configuring Oracle Reports Services for access control and adding access to Oracle Reports Services, reports, and printers in WebDB.
You must do the following to install and configure the Reports Services Security feature in WebDB:
Install WebDB into an Oracle 7.3.4, Oracle 8.0.5, or Oracle 8i database if it has not been installed already. Refer to the Oracle WebDB Getting Started-Installation and Tutorial manual for more information.
You can install Oracle Reports Services security packages from any machine (for example, where your WebDB or your Oracle Reports Services is installed).
username/password@database).
Table 6-1 Connection to Log on to the WebDB Schema
You set the authentication cookie domain so that the cookie can send the authentication information to Oracle Reports Services where the report is sent. Click on 
and do the following:
|
|
On the machine where WebDB is installed:
and type... authentication cookie
wdbsvr.cfg file in a text editor (located in the ORACLE_HOME\LISTENER\CFG directory). Under the [SERVER] section, set the configuration parameter using the following syntax, where my_company.com is the domain name of the Oracle Reports Services
ORCookieDomain=my_company.com
This example provides step-by-step instructions that will help you configure your Oracle Reports Services for access control. You will add access to the report definition file, Oracle Reports Services, and printer in WebDB. Finally, you will publish the report request on a WebDB site so that authorized users can run this restricted report.
This example assumes the following:
security.rdf. This report generates a 401K report for employees. Information about this report will be added in WebDB. This file is provided for you in the ORACLE_HOME\TOOLS\DOC60\US\RBBR60 directory.
security.rdf file on Oracle Reports Services. Use the demo CD that came with your product package to install the SQL scripts that are used to install the demo tables in your database. These SQL scripts can be run from the Start->Programs menu.
The 401K report that you add access to in WebDB contains vested 401K portfolio information of four fictional employees. You want to restrict access to this confidential report only to these four employees. Further, you want to ensure that the requesting employee can access only his personal information, not other employees' information. This can be achieved by doing the following:
security.rdf report was built with two user parameters: last name and social security number (SSN). In WebDB, you will build a Runtime Parameter form that contains a list of values of the last names of 401K participants and an unrestricted parameter for the social security number.
Suppose that Jeff Abers wants to review his 401K investments. On the Runtime Parameter Form, in addition to the destination parameters, he will need to choose his last name from a list of values and then enter his social security number. When he runs the report, he must log on. WebDB checks that he has the access privileges needed to run the report. If he logs on successfully, then Oracle Reports Services processes the request. If he entered the correct last name and social security number combination, then his personal 401K report is delivered as requested.
Oracle Reports Services must be installed and configured before you can perform this step. See Chapter 4, "Configuring Oracle Reports Services on Sun SPARC Solaris" for information.
To configure Oracle Reports Services for access control, you will do the following:
You need to create a TNS names alias for WebDB in the tnsnames.ora file on the machine where Oracle Reports Services is installed. This enables Oracle Reports Services to communicate with WebDB.
You can create the TNS names alias using the Net8 Easy Config tool, or you can create one by editing the tnsnames.ora file in a text editor.
To create TNS names alias, you will need the following information:
You can find the host name, port number, and SID in the tnsnames.ora file in the ORACLE_HOME\NETWORK\ADMIN directory on the machine where the database is installed.
On Oracle Reports Services machine:
tnsname.ora file located in the ORACLE_HOME\NET80\ADMIN directory. Go to step 2.
If you installed Oracle Reports Services Security feature from your Oracle Reports Services machine, then a TNS names alias for WebDB has already been created for you. You can skip this step and go to Section 6.3.1.2, "Restricting Access to Oracle Reports Services".
sec_rep.world = (DESCRIPTION = (ADDRESS = (PROTOCOL = TCP) (HOST = my_pc.my_domain) (PORT = 1521) ) (CONNECT_DATA = (SID = ORCL) ) )
where:
tnsnames.ora file.
To restrict access to Oracle Reports Services, you set the SECURITYTNSNAME parameter in Oracle Reports Services configuration file. Once set, access control is enforced. Users will be required to authenticate themselves to run report requests to this restricted Oracle Reports Services.
To run a report request, access to the report definition file must be added in WebDB. If you want to run unrestricted report requests, then ensure the Run Only Registered Report Definition Files option is unchecked in the Server Access wizard in WebDB for this Oracle Reports Services. Users, however, will still need to authenticate themselves to the Reports Services to run the report.
On Oracle Reports Services machine, do the following:
ORACLE_HOME\REPORT60\SERVER directory) in a text editor. Set the SECURTYTNSNAME parameter using the following syntax, where sec_rep is the TNS names alias of the WebDB server instance defined in the tnsnames.ora file:
SECURITYTNSNAME="sec_rep"
You will need to create the following users accounts:
In order to perform security administration in WebDB, you must have a user account that is assigned the RW_ADMINISTRATOR role. Only those users with the RW_ADMINISTRATOR role can access Reports Services Security wizards in WebDB. In addition, you must have BUILD IN privileges to the schema that will own the report's packaged procedure and any list of values (LOV) that you might create. If you have a user account with DBA privileges, then you can create user accounts. Otherwise, contact your DBA and request that user accounts be created. Click on and do the following:
|
|
To add a report item to a WebDB site, a WebDB site must be created. If you will be responsible for creating the WebDB site, then you must be a DBA with Execute privileges on the SYS.DBMS_SQL packaged procedure with the Grant option. This privilege will allow you to create the site and grant Manage Item privileges to other users.
If someone else is the site administrator, then you must be given Own, Manage Item, or Create With Approval privileges for the folder that you want to add items to. Contact the DBA or site administrator for more information.
Any users who will be given access privileges to run report requests must have a user account that WebDB can recognize. Reports Services has four predefined roles that can be assigned to users. Each role gives users access to certain administrative controls, such as monitoring jobs or viewing error messages. By default, Reports Services basic user functions (that is, the RW_BASIC_USER role) are implied if users are not assigned specific Reports Services roles.
If you have a user account with DBA privileges, then you can create user accounts. Otherwise, contact your DBA and request that user accounts be created. Click on and do the following:
|
|
For this exercise, create or request a user account for Jeff Abers, one of the employees who participates in the 401K plan. His user account should be JABERS. He is assigned the basic user role. Contact your DBA to create user accounts for those users who require access privileges to run report requests. Assign users Reports Services roles as needed.
If the JABERS user account already exists, then append your initials to it (for example, JABERSAA).
An availability calendar determines when report definition files, Oracle Reports Services, and printers are available for processing.
You can create two types of availability calendars:
You can associate only one availability calendar with a report definition file, Oracle Reports Services, or printer. If your production environment requires more than one availability rule, then you will need to combine availability calendars.
Availability calendars are not necessary if the reports definition files, Oracle Reports Services, and printers are always available for processing.
In this exercise, you will create a production calendar that determines the availability for every day of the week, days with scheduled maintenance, and holidays. To do this, you will create the following availability calendars:
You will create a daily calendar with an availability period of Sunday through Saturday from 12:00 a.m. to 10:00 p.m.
Click 
to access context-sensitive help for the current wizard page. Click on the title bar to access the WebDB help system.
from the navigation toolbar on any WebDB page to access the Administer page.
Daily as the Calendar Name. If the Daily calendar already exists, then append your initials to it (for example, DailyAA).
.
.
.
You will create a maintenance calendar with an availability period of every Saturday from 3:00 p.m. to 10:00 p.m. In a later step, you will add this calendar to the Production calendar and then exclude it to prohibit processing based on the date and time specified.
Maintenance as the Calendar Name. If the Maintenance calendar already exists, then append your initials to it (for example, MaintenanceAA).
.
Table 6-2 Maintenance Calendar Rule
You will create a Christmas calendar with an availability period of every December 25 from 12:00 a.m. to December 26 at 12:00 a.m. In a later step, you will add this calendar to the Production calendar and then exclude it to prohibit processing based on the date and time specified.
Christmas as the Calendar Name. If the Christmas calendar already exists, then append your initials to it (for example, ChristmasAA).
.
Table 6-3 Christmas Calendar Rule
| Field | Value |
|---|---|
|
Duration Start |
Specify December 25 and 12:00 a.m. |
|
Duration End |
Specify December 26 and 12:00 a.m. |
|
Repeat |
Choose Yearly. |
In this exercise, you will create a Production calendar that combines the Daily, Maintenance, and Christmas calendars, then excludes the Maintenance and Christmas calendars, which prohibits processing based on their availability rules.
Production as the Calendar Name. If the Production calendar already exists, then append your initials to it (for example, ProductionAA).
.
to move the selected calendars to the Selected Availability Calendars list box, or click 
to select all available calendars.
.
to move the Maintenance and Christmas calendars to the Excluded Availability Calendars list box. Doing so prohibits processing on the date and time specified in each calendar.
.
It is a good practice to check the combined calendar at this point. You can verify that the calendars you prohibited processing on are excluded during the period specified. Scroll to December to ensure that December 25 is excluded from processing. Choose the Day option and scroll to a Saturday to ensure that processing is unavailable from 3 p.m.
.
Printer Access defines the following:
You must already have a printer that Reports Services can recognize installed and running. Refer to the DESNAME and DESFORMAT command line arguments described in Appendix A, "RWCLI60 Command Line Arguments" for more information.
Prerequisite:
Click to access context-sensitive help for the current wizard page. Click on the title bar to access the WebDB help system.
Reports_Printer in the Printer Name field. If this printer name already exists, then append your initials to it (for example, Reports_PrinterAA).
\\net_machine\my_printer). Refer to your operating system's documentation for more information.
.
to move this user to the Selected Users list box.
.
Production as the availability calendar, or click 
to find the availability calendar. If you want to make this printer available all the time, then do not specify a calendar.
.
Oracle Reports Services Access defines the following in WebDB:
Click to access context-sensitive help for the current wizard page. Click on the title bar to access the WebDB help system.
Repserver in the Server Name field. If this server name already exists, then append your initials to it (for example, RepserverAA).
tnsname.ora file when you installed and configured Oracle Reports Services. See Chapter 4, "Configuring Oracle Reports Services on Sun SPARC Solaris" for more information.
http://my_webserver/cgi-bin/rwcgi60.exe
The Reports Services Web Gateway URL is determined by the virtual location of the Web CGI.
Reports_Printer from the Printers list box.
.
Be sure that you select the same users who have been given access to the printer.
to move this user to the Selected Users list box.
.
Production as the availability calendar, or click to find the availability calendar. If you want to make this server available all the time, then do not specify a calendar.
.
Report Definition File Access defines the following in WebDB:
.RDF, .REP, or .XML file you want to make accessible in WebDB.
In this exercise, you will restrict access to the security.rdf file (located in the ORACLE_HOME\TOOLS\DOC60\US\RBBR60 directory) in WebDB based on the following information:
Click to access context-sensitive help for the current wizard page. Click on the title bar to access the WebDB help system.
If you want users to select values from a list of values for any system or user parameters you define on the Optional Parameters page, then you must create this list in WebDB.
Recall that the security.rdf report gathers information about the vested portfolios of employees participating in the company's 401K plan. You want to restrict access to only those employees who participate in the plan. In this exercise, you will create a list of values for the P_Lastname user parameter that lists the last names of these employees.
If you are not publishing the report request on a WebDB site, then creating a list of values in WebDB is not necessary. You can create a list of values in Report Builder using the Parameter Form editor. Click on and do the following:
|
|
from the navigation toolbar.
LASTNAME_LOV as the name of LOV. If this LOV already exists, then append your initials to it (for example, LASTNAME_LOVAA).
Table 6-4 Static List of Values
| Display Value | Return Value | Display Order |
|---|---|---|
|
Abers |
Abers |
1 |
|
Costner |
Costner |
2 |
|
Matsumoko |
Matsumoko |
3 |
|
Williams |
Williams |
4 |
If you back out of the wizard page (that is, click Back on your Web browser), then you will lose the settings you defined on that page. If you need to make changes, then first create the packaged procedure for the report by completing the wizard. Then, edit the package by clicking Edit on the Manage Component page.
from the navigation toolbar and click Reports Developer Security.
Investment_Report in the Report Name field. The report name cannot be prefaced with numeric characters (for example, 401K_report is an invalid file name and my_401K_report is valid). If this report name already exists, then append your initials to it (for example, Investment_ReportAA).
repserver from the Reports Servers list box.
security.rdf as the Reports Services File Name. Ensure Oracle Reports Services can find this report definition file. The report's source path must be set in the SOURCEDIR parameter in Oracle Reports Services configuration, or must be set in the REPORTS60_PATH environment variable.
.
to move this user to the Selected Users list box.
.
Production as the availability calendar, or click to find the availability calendar. If you want to make this report definition file available all the time, then do not specify a calendar.
.
Reports_Printer from the Printers list box. If the printer you defined does not appear, then you might have entered an incorrect OS Printer Name when you created access to your printer. Finish creating this report definition file package. It is likely that an invalid package will be created. Return to the Printer Access wizard and edit access to the Reports_Printer. After you edit the printer access. Return to the Report Definition File Access wizard, edit the report definition file access for this report, then create a new package.
.
P_LASTNAME in the Parameter Name column. When users run this report at runtime, they will be required to select a last name to run the report. The P_LASTNAME is the name of the parameter defined in report. Open the security.rdf file in Report Builder and view the parameters in the Parameter Form editor to determine the parameter's name.
LASTNAME_LOV in the LOV column to enable users to choose the last name of the 401K participant from a list of values, or click to find the LOV.
P_SSN in the second row of the Parameter Name column to require users to type their social security number in the Runtime Parameter Form.
COPIES in the third row of the Parameter Name column to restrict the number of copies the user can print when outputting the report to a printer.
1 in the Low Value column.
2 in the High Value column.
USERID in the fourth row of the Parameter Name column. This enables users to specify the database that they can connect to if they want to schedule the report to run automatically.
twice to skip the Validation Trigger page.
If an invalid package is created, then you will be unable to proceed to the next step. Verify the access controls that you defined for the printer, Oracle Reports Services, and report. Make the necessary changes and then try to create a valid production package for this report definition file.
To edit access to the report definition file, click 
from the navigation toolbar. At the Reports Developer Security menu, choose Report Definition File Access. Then, to access the Manage Component page for a particular report, find the report or choose the report from the Recently Edited Report Definition File section. At the Manage Component page, click Edit.
As the Reports Services system administrator, you can run the restricted report request you just created to ensure that it will run as expected. You also can set the default parameters that will be available to users at runtime. You can run and set default parameter values from the Manage Component page.
In this exercise and the next, you will choose parameters values to run the report to cache for debugging purposes, not to set the default values that will be available to users at runtime. You will set the default values in Section 6.3.7.3, "Setting the Default Parameters for Users at Runtime".
To access the Manage Component page, click
. At the Reports Developer Security menu, choose Report Definition File Access. Then, find the report or choose the report from the Recently Edited Report Definition File section.
Table 6-5 Parameter Form Settings for Debugging Cache Output
Following are the steps you would follow if you want to run report output to a restricted printer:
Table 6-6 Parameter Form Settings for Debugging Printer Output
Once you are satisfied that the report can run based on the restrictions imposed, you can set the default parameter values and choose the parameters that will be available to users on the Runtime Parameter Form.
Table 6-7 Default Parameter Settings for Users
You might want to make parameters visible to users on the Runtime Parameter Form only when they need to take an action on the parameter (that is, select or input a value) to run the request. In this case, the Server and Printer parameters are restricted to one server and printer. The Desname parameter is populated automatically with the printer name when Printer is chosen as the Destination type. These parameters do not require user input to run the report.
When users run the report from a WebDB site, they can set the default parameters values available to them on the Runtime Parameter Form to their personal preferences. See Section 6.3.8, "Step 8. Making the Report Available to Users" for more information.
You make the report available to users in a WebDB site by adding a link as a WebDB component that points to the INVESTMENT_REPORT packaged procedure.
Create a WebDB site if it has not already been created. Click on and do the following:
|
|
To create a WebDB site, the Reports Services system administrator will need to have site administrator privileges (that is, a DBA with execute privileges on the SYS.DBMS_SQL packaged procedure with the Grant option). If someone else is the site administrator, then ask that person to create the WebDB site.
You will create the folder in which the report's packaged procedure is added. By default this folder and any items that are added to it are available only to the owner of the folder (that is, the Reports Services system administrator). You can make the folder available to all users (that is, to public users) or available only to users who have been given access to it. You will restrict access to this folder only to the users who have access privileges to run this report (that is, JABERS).
If you make a folder public, then PUBLIC users (that is, users who have not logged on to the WebDB site) can access the report's Parameter/Scheduling form and might unknowingly save their personal information to it. Subsequent PUBLIC users will see this confidential information. To prevent this from happening, it is best to restrict access to the folder to those users who have access to run the report. Users must log on to access the restricted folder. Once logged on, the information they save on the Parameters/Scheduling form is secured (that is, only they can view it).
Click to access context-sensitive help for the current wizard page. Click on the title bar to access theWebDB help system.
http://my_webdb_server.com:1111/my_webdb_site
If you have site administrator privileges to create a site, then click 
from the navigation toolbar on any WebDB page to access the Sites page. Click Site Home Page to access the WebDB site.
To add a WebDB component to a WebDB site, your Reports Services system administrator user account must have site administrator privileges (that is, a DBA with execute privileges on the SYS.DBMS_SQL packaged procedure with the Grant option). If you do not have site administrator privileges, then you must have Own, Manage Item, or Create with Approval privileges for the folders in which the component is being added. Contact your DBA or site administrator for more information.
.
to add a new folder to your site.
Benefits as the title of the folder that will be displayed in the WebDB site. If the Benefits folder has already been created by another user, then append your initials to the folder name (for example, BenefitsAA).
JABERS as the Name of the user you want to have access to this folder.
to return to the Benefits folder.
To add the report request to the folder, do the following:
to access the Item wizard and add the report request to this folder.
WEBDB is the name of the schema that owns this report's package procedure for the 401K report.
Investment Summary Report as the Title.
Restricted 401K Report in the Description text box.
You will run this report as JABERS, not as the Reports Services system administrator. In this exercise, you will set your default parameter settings for Jeff Abers and then run the report.
Click to access context-sensitive help for the current wizard page. Click on the title bar to access the WebDB help system.
JABERS.
Table 6-8 User's Default Parameter Settings
The default settings saved here are the ones that are accessible only to this user. If you (or someone else) logged on as a different user, then the default settings defined by the Reports Services system administrator would display. That user could then personalize her or his own settings.
Suppose that Jeff Abers only wants to review his 401K investments once a month. Further, he prefers to have this report run automatically and pushed to his own personal folder by 9:00 a.m. on the last Friday of every month. First, you will create Jeff's own personal folder (that is, one that only his user account can access). Then, you will schedule the report to run automatically.
|
Prerequisite: You must have already completed the exercise in Section 6.3.8, "Step 8. Making the Report Available to Users". |
To ensure that only the specified user can access his or her own personal reports, the user (that is, you are logged on as JABERS for this exercise) can create her or his own personal folder.
Click to access context-sensitive help for the current wizard page. Click on the title bar to access the WebDB help system.
.
You are the owner of your personal folder. No one else can access it unless you give them permission to do so. You are ready to schedule the 401K report to run automatically and push to the JABERS personal folder.
In this exercise, you will schedule the report to run every last Friday of the month at 9:00 a.m. You also want to retain historical records of your 401K results for two months.
Click to access context-sensitive help for the current wizard page. Click on the title bar to access the WebDB help system.
Last Friday of each month on or before the 30 th.
Rather than waiting until the end of the month for the report to run, set the repeat option to repeat every n hours. Once you are satisfied that the report output can be pushed successfully to the result folder, reset the repeat pattern.
Table 6-9 Output Destination Settings
To view the pushed report output, do the following:
Notice that in addition to a link to the report itself, a link to status information about the report is also available. Use this status link to help you troubleshoot any problems you might have running this scheduled report. Depending on the Reports Services role (for example, RW_BASIC_USER) this user is assigned, you might see different status details. If users are having problems scheduling and running their reports, then they should contact the Reports Services system administrator for help.
Suppose that the Human Resource director asked you (the Reports Services system administrator) to make a stock report available to all employees. You want to run this stock report automatically every morning so that employees can monitor the status of certain stocks. This report will be pushed to a public folder from which all employees can view it.
Use the exercises in this chapter to help you add access to the template.rdf report (located in the ORACLE_HOME\TOOLS\DOC60\US\RBBR60 directory) in WebDB.
Since you (as the Reports Services system administrator) will be scheduling this report to run and push to a public folder, this report needs to be accessible only to the Reports Services system administrator.
Add this report's packaged procedure to the Benefits folder as a WebDB component. Then, schedule this report to run every morning at 10:00 a.m. pushing the report output to a new folder called Stocks.
The Stock folder must be set up to display for public users.
You have successfully configured Oracle Reports Services for access control. In this chapter, you learned how to do the following:
|
 Copyright © 2000 Oracle Corporation. All Rights Reserved. |
|