Publishing Reports to the Web - Downloads - Oracle

About OracleAS Reports Services Security
The authid cookies are terminated when the user closes their browser session, but
you should not rely strictly on this method of terminating the cookie. You should limit
the lifetime of the cookie within a given session. For example, a user might log on and
then go to lunch, leaving the browser session open. To minimize the potential for a
security breach in this situation, the administrator may specify the COOKIEEXPIRE
parameter in the rwservlet.properties file. When rwservlet receives a job
request, it compares the time saved in the cookie with the current system time. If the
time is longer than the number of minutes defined in the environment variable (e.g., 30
minutes), the cookie is rejected and the user is challenged to provide authentication
information.
See Also: Configuring the Reports Servlet
For more information about the COOKIEEXPIRE parameter and the
rwservlet.properties file.
9.1.2.2.1 Report Request Flow without OracleAS Single Sign-On In this scenario, the report
request is sent to a secured Reports Server with Single Sign-On disabled. In this case,
rwservlet or a JSP report might be called through the use of a bookmark or from an
OracleAS Portal component.
1. The user must somehow gain access to the URL that launches the report request
(e.g., via a link on a Web page or a bookmark), and choose the URL.
2. rwservlet checks for the AUTHID parameter on the URL or an existing Oracle
Reports Authid Cookie. If it finds the AUTHID parameter, it uses that to
authenticate the user. If it does not find the AUTHID parameter, it looks for an
existing Reports Authid Cookie. (If the report is launched from OracleAS Portal,
AUTHID is added to the URL automatically.) If neither AUTHID nor a Reports
Authid Cookie is found, rwservlet displays the System Authentication screen,
where the user must supply their Single Sign-On username and password. This
information is subsequently stored in the Reports Authid Cookie.
3. If only partial data source credentials are provided on the URL (e.g.,
USERID=scott@orqa), the Database Authentication page is displayed with the
partial credentials priming the fields. The user must supply the remainder of the
data source credentials before proceeding further. Note that you can control which
Database Authentication page is used via the DBAUTH parameter in the
rwservlet.properties file. If no data source credentials at all are provided,
the Database Authentication page is not displayed and it is assumed the report
does not require a data source.
See Also: Configuring the Reports Servlet
For more information about the DBAUTH parameter and the
rwservlet.properties file.
4. rwservlet constructs a command line with the necessary information from the
previous steps and passes it to the Reports Server.
5. The Reports Server validates the user credentials against the Oracle Internet
Directory. It also checks whether the user has the necessary privileges to run the
report on the specified server at the specified time to the specified destination. If
the validation check fails for any reason, then an error condition is returned to the
user and the process terminates.
6. The data source credentials are stored in a Reports Userid Cookie for possible
future reference. Note that Pluggable Data Source credentials are not stored in the
Reports Userid Cookies.
9-6 Oracle Application Server Reports Services Publishing Reports to the Web