Publishing Reports to the Web - Downloads - Oracle

About OracleAS Reports Services Security
Figure 9–1 Oracle Delegated Administration Services Create Resource
6. rwservlet constructs a command line from the URL (and Oracle Internet
Directory information if you used SSOCONN) and passes it to the Reports Server.
7. The Reports Server validates the user credentials against the Oracle Internet
Directory server. The Reports Server checks whether the user has the necessary
privileges to run the report on the specified server at the specified time to the
specified destination. If the validation check fails for any reason, then an error
condition is returned to the user and the process terminates.
8. The Reports Server delegates the job to a Reports Engine that accesses the data
source, retrieves the data, and formats the report.
9. The completed output is sent to the specified destination. Depending upon the
destination, the output may be sent to a printer, served back to the browser, or
stored in a file for future reference.
9.1.2.2 Handling Report Requests without OracleAS Single Sign-On
If Single Sign-On is not being used, then any user accessing a secured instance of the
Reports Server is challenged to identify themselves by rwservlet via its own
authentication mechanism (identical to the behavior of Oracle Reports6i). Because the
HTTP 1.0 protocol is stateless (i.e., each call to the server is effectively independent of
all others), users might need to authenticate themselves for each report request unless
a cookie is maintained. To allow users to authenticate themselves only once per
session, rwservlet has its own client-side cookie, the authid cookie, in which it stores
the required authentication information for the current session. Once the user is
authenticated, an encrypted cookie is created in the browser to enable the user to
submit multiple report jobs without re-authenticating for each request.
Note: If you want to force users to authenticate themselves for a
specific report, you can use the SHOWAUTH command line option.
Alternatively, you can include a %S in the corresponding report
entry in the key map file. This file is usually called cgicmd.dat
and is located in ORACLE_HOME\reports\conf. %S forces users
to enter their username and password each time the report is called.
Securing OracleAS Reports Services 9-5