Secure your Reports showjobs page

When you run your reports, you can afterwards check your executed reports through the "showjobs" page:

http://hostname:port/reports/rwservlet/showjobs

By default, the info on this page is not secured, what means that everybody who navigates to this page can see the executed reports.  In some business environments where user security is an important issue, this could be a serious problem.

But fortunately, we can easily overrule this lack of security.

(1)

In the EM, go to the "Advanced Configuration" section of the reports application on your reports managed server.

In the "Reports Security" block, normally the value of "Web Command Access Level" is "None".  You'll have to change this to "L1".

Apply your changes.

(2)

The rwserver.conf file must be modified (path = $DOMAIN_HOME/config/fmwconfig/servers/WLS_REPORTS/applications/reports_11.1.2/configuration/rwserver.conf).

First backup this file.

Open the file and locate the following lines (normally at the end of the file):

    <queue maxQueueSize="1000"/>

    <pluginParam value="%MAILSERVER_NAME%" name="mailServer"/>

Between these 2 lines, add this line:

    <identifier encrypted="no">$USER/$PASSWORD</identifier>

E.g.:

    <identifier encrypted="no">tom/tom123</identifier>

Save the file and restart your WLS_REPORTS managed server.

When navigating now to the showjobs page, you will see this error in the web page:

REP-52262: Diagnostic output is disabled.

You will notice that your credentials in the rwserver.conf file will be encrypted, e.g.:

   <identifier encrypted="yes">QQxdV12tLRTWlg==</identifier>

To see back the reports queue, you'll have to add the authid parameter to your url:

http://hostname:port/reports/rwservlet/showjobs?authid=$USERNAME/$PASSWORD