14.12 Database Proxy Authentication

14.12.1 Using Oracle Enterprise Manager

In Oracle Enterprise Manager, select Reports > Administration > Manage Reports Security Policies to display the Reports Security Policies page.

14.12.2 Using DAS and Editing the Server Configuration File

Step 1. Using Delegated Administration Service (DAS)

To define a user in Oracle Internet Directory:

1. Determine the configuration values of Oracle Internet Directory for application identity store. For example:

   host:port: stbpo44.oracle.com:3060
   user name: cn=orcladmin
   password: welcome1
   

2. Use the DAS URL if you want to add new users or use the existing users on Oracle Internet Directory. For example

   http://stbpo44.oracle.com:7788/oiddas
   

Step 2. Configure the standalone Report Server to use the RWSecurity to enable the non-Oracle Platform Security Services way of using Oracle Internet Directory (as in 10g Release 2 (10.1.2)).

1. Navigate to the Reports Server component.

2. Check out rwserver.conf.

3. Enable the RWSecurity element.

4. Make sure that the security id for the job element reflects the security id of the RWSecurity element.

5. Save rwserver.conf.

6. Add the following line in rwservlet.properties:

   <singlesignon>no</singlesignon>
   

7. Restart the Reports Server component (see Chapter 5, "Starting and Stopping Oracle Reports Services").

8. Test authentication using the following URL:

   http://host:port/reports/rwservlet/showjobs?server=reports_server_name
   

14.12.3 Configuring Proxy User Authentication in the Database

You can configure proxy user authentication in the database as follows:

1. Create a proxy user in the database. All clients connecting to the middle tier share this user connection.

2. Run the following:

   CREATE USER proxy_user1 IDENTIFIED BY welcome1;

3. Assign the following minimum privileges to proxy_user1:

   GRANT CONNECT, RESOURCE, CREATE ANY DIRECTORY, DROP ANY DIRECTORY TO proxy_user1

   The actual user already exists in the database.

4. Log in as the actual user, and assign privileges to the proxy user to connect to the database on behalf of the actual user.

   1. ALTER USER scott GRANT CONNECT THROUGH proxy_user1;

   2. Or you can define the roles that the proxy user can connect to the database as.

   3. ALTER USER scott GRANT CONNECT THROUGH proxy_user WITH ROLE admin;

   4. Repeat Step A or Step C for all actual database users.

The proxy user with minimum privileges is created. However, this proxy user can connect as the actual user with the assigned role. The middle tier can connect to the database as the proxy user first, and then connect as an actual user through the proxy user account.

14.12.4 Obtaining Proxy Access Information

You can configure a new resource in Oracle Internet Directory in the user RAD or default RAD. You can use this key to obtain proxy access information, including user name, password , and database information from Oracle Internet Directory. This information allows you to connect to the database.To create a key in the default RAD, complete the following steps:

1. Log in to the Oracle Internet Directory configuration page (http://oidhost:port/oiddas).

2. Click the Configuration tab.

3. Click Preferences.

4. In the Preferences page, create a new Resource of type OracleDB under Default Resource Access Information, as shown in the Figure 14-5.

   Figure 14-5 Oracle Internet Directory Configuration

   
   Description of "Figure 14-5 Oracle Internet Directory Configuration"
   
   

5. When creating the resource, in the Resource Access Information section, enter the database proxy user name, database proxy password, and the database value in the respective fields.

   A new key is created, and you can pass this key as a value for the dbproxyConn parameter. The number of proxy user connections and their access levels are set by the database administrator.

14.12.5 Configuration Settings in Reports Configuration Files

To use the database proxy feature, you must add and modify configuration settings in the Reports configuration files.

<dbProxyConnKeys> 
      <dbProxyKey name=key1 database=db1/> 
      <dbProxyKey name=key2 database=db2/> 
 </dbProxyConnKeys>