8
Controlling Access to Oracle Reports

Estimated completion time: 15 minutes

This chapter provides an overview of how to use Oracle WebDB to control access to Oracle Reports reports (and their associated Reports Servers and printers). Oracle Reports uses WebDB to provide security, so that end users can run only those reports on which they have the appropriate access privileges. WebDB determines:

Which reports, Reports Servers, and printers are available for processing in the secure environment.
Who has access to those reports, Reports Servers, and printers.
When those reports, Reports Servers, and printers are available for processing.
Which parameter values an end user is offered to control the output of those reports.

For example, a salary report may be made accessible to the Human Resources Director and all department managers. The report is available for processing on the last Friday of every month. The Human Resources Director can view salary details for all employees and can output the results to the destination type of his or her choice, while department managers can view salary details for only their direct reports and can output the results only to a specific printer.

To control end user access to a particular report, the Oracle Reports administrator must register the following in WebDB:

The report definition file (.RDF or .REP file)
The Reports Servers on which the report can be processed
The printers to which the report results can be output

Once the appropriate files and devices have been registered in WebDB, the report can be made accessible to end users, for example by adding it to a WebDB site.

This chapter provides you with a basic overview of the steps involved in using WebDB to control access to Oracle Reports reports (and their associated Reports Servers and printers). For specific information about how to perform each step of the process, see the WebDB online help. For example scenarios, see the Publishing Reports manual.

This chapter includes the following sections:

Section

"Prerequisites"

"The Access Control Process"

"What's Next?"

Section
"Prerequisites"
"The Access Control Process"
"What's Next?"

8.1 Prerequisites

You must have already installed and configured the Reports Servers to which you want to control access.
The reports to which you want to control access must have already been created using Report Builder.
The Reports Servers must be able to find any reports that they are to process (that is, the path for the report definition files must be included in the REPORT60_PATH environment variable).
To register Oracle Reports reports, Reports Servers, and printers you must be an Oracle Reports Administrator (that is, you must be a member of the RW_ADMINISTRATOR role). If you are not an Oracle Reports Administrator, you will not be able to access WebDB's Oracle Reports security features. If you need to be added to the RW_ADMINISTRATOR role, ask your DBA.

8.2 The Access Control Process

There are several steps involved in setting up WebDB to control access to an Oracle Reports report (and its associated Reports Servers and printers). The steps are:

Step 1: Install WebDB
Step 2: Assign Oracle Reports roles to users
Step 3: Configure Reports Servers for security
Step 4: Set the authentication cookie domain
Step 5: Create an availability calendar
Step 6: Add access to printers
Step 7: Add access to Reports Servers
Step 8: Add access to the report definition file

The following sections describe each of the above steps. For more detailed information about how to perform these steps, see the WebDB online help. For example scenarios, see the Publishing Reports manual.

8.2.1 Step 1: Install WebDB

Oracle Reports security is controlled using WebDB, therefore to control access to Oracle Reports reports, Reports Servers, and printers you must install WebDB. For information about installing WebDB, see the "Oracle WebDB Installation Guide."

8.2.2 Step 2: Assign Oracle Reports roles to users

WebDB includes several roles that provide various levels of Oracle Reports administrative control:

RW_ADMINISTRATOR
RW_DEVELOPER
RW_POWER_USER
RW_BASIC_USER

For example, RW_ADMINISTRATOR has privileges to perform all WebDB functions related to Oracle Reports access control and can view detailed error messages, while RW_BASIC_USER has privileges to make report requests and view basic error messages. For further information about the Oracle Reports roles, see the WebDB online help.

To learn how to assign roles to users, see Section 1.3, "Adding a User to a Role" (note that to complete this exercise, you must be a DBA).

8.2.3 Step 3: Configure Reports Servers for security

In order for a Reports Server to communicate with WebDB to determine whether an end user has privileges to run a particular report, you must tell the Reports Server where WebDB is installed.

For information about how to configure an Oracle Reports Server for security, see the Publishing Reports manual.

8.2.4 Step 4: Set the authentication cookie domain

When an end user successfully logs on to WebDB, a cookie containing authentication information is saved to his or her browser. When that end user attempts to run an Oracle Reports report URL, the information in the cookie is used to provide the authentication information of the user to the Reports Server.

For the cookie to send the authentication information to the Reports Server where the report is sent, the cookie must know the domain in which to locate the Reports Server. This is done by setting the authentication cookie domain.

For example, if a Reports Server has a domain name of my_webserver.west.my_company.com and you set the authentication cookie domain to:

my_company.com, the cookie can communicate with the Reports Server because it is located in a subordinate domain of the authentication cookie domain
west.my_company.com, the cookie can communicate with the Reports Server because it is located in the authentication cookie domain
sales.west.my_company.com, the cookie cannot communicate with the Reports Server because it is outside the authentication cookie domain
east.my_company.com, the cookie cannot communicate with the Reports Server because it is outside the authentication cookie domain

Note:
The WebDB Listener must also be installed within the boundaries of the authentication cookie domain.

For information about how to set the authentication cookie domain, see the WebDB online help.

8.2.5 Step 5: Create an availability calendar

An availability calendar determines when an Oracle Reports report, Reports Server, or printer is available for use. Each report, Reports Server, and printer can have an availability calendar associated with it. If an availability calendar is not specified, the report, Reports Server, or printer is available all the time.

There are two types of availability calendars:

Simple availability calendars define a single availability rule (for example Monday through Friday from 12:00 a.m. to 10:00 p.m.).
Combined availability calendars combine two or more availability calendars (for example Monday through Friday from 12:00 a.m. to 10:00 p.m. AND Saturday and Sunday from 6:00 a.m. to 6:00 p.m.).

For some examples of availability calendars and information about how to create them, see the WebDB online help.

8.2.6 Step 6: Add access to printers

Adding access to a printer defines:

Which printer you are providing access to
Who has access privileges to send output to the printer
When the printer is available for printing report output

For information about how to register a printer, see the WebDB online help.

8.2.7 Step 7: Add access to Reports Servers

Adding access to a Reports Server defines:

Which Reports Server you are providing access to
Who has access privileges to process report requests on the Reports Server
When the Reports Server is available for processing report requests
Which printers the Reports Server can access

For information about how to register a Reports Server, see the WebDB online help.

8.2.8 Step 8: Add access to the report definition file

Adding access to a report definition file defines:

Which report you are providing access to.
Who has access privileges to request the report to run.
When the report is available for processing.
Which parameter values an end user is offered to control the output of the report.

You can restrict the values that certain system parameters (such as DESTYPE and DESFORMAT) can be set to. For example, a report could be set to always output to cache in HTML format, always to a printer in PostScript, or the end user can be offered a choice of several destination types and formats.

You can also restrict the values that other system parameters and user parameters can be set to. For example, if SMITH can access a salary report, you could restrict the user parameter EMPNAME to offer only those employee names that have SMITH as a manager. Thus when SMITH runs the report, he can only access information about his direct reports.

For information about how to register a report, see the WebDB online help.

8.3 What's Next?

In this chapter you learned how to set up WebDB to control access to Oracle Reports reports (and their associated Reports Servers and printers).

This concludes the Oracle Reports access part of the tutorial. Now you're ready to control access to your own Oracle Reports reports, Reports Servers, and printers. For more information about any subject you've learned in this chapter and others, see the WebDB online help.

8 Controlling Access to Oracle Reports