As of December 1, 2020, Focal Point is retired and repurposed as a reference repository. We value the wealth of knowledge that's been shared here over the years. You'll continue to have access to this treasure trove of knowledge, for search purposes only. Moving forward, myibi is our community platform to learn, share, and collaborate. We have the same Focal Point forum categories in myibi, so you can continue to have all new conversations there. If you need access to myibi, contact us at email@example.com and provide your corporate email address, company, and name.
I am developing self service applications with a simple hmtl page as the front end. The problem is how do we limit the access to the report. I do not want everyone to see all the reports that are out there on the web. How can we limit access specific to the report? Any ideas?
Do you know about WebFOCUS Managed Reporting? WebFOCUS Managed Reporting allows you to provide your end users with robust ad hoc reporting and analysis capabilities and personalized views of corporate information while maintaining a secure and cohesive environment.
WebFOCUS can also be integrated and synchronized with custom security systems, as well as any standard Web or database security system for single-user logon capabilities.
When you're working with a self service application, you're basically on your own when it comes to security. In the past, I have done the following and it works very well.
1) Set up a small file or table that keeps track of what user ids have access to what. 2) Dynamically create a menu for the user upon login. 3) Create a simple fex that check the current user has access to the fex that is running. If not, exit out to a -HTMLFORM page. This is to insure that a user is not running a report that is not on their menu. 4) -INCLUDE that fex into each of your reports.
simplest way: your launch page has a password as one of its fields. The fex checks that password. make sure your fex has -SET &ECHO = OFF ; so that casual passersby cant crack open the results page (view source) to see the pw. Not bullet proof, but so so simple.
next way: if you use MSFrontPage, its easy to set up a database of users; either MSAccess or a flat file; Or use a focus file; you can build a site home page with a userlogin, check that userlogin against your db either with VBscript (if MSAccess or flat) or with focus against any file; If the user passes the id check, then launch your site's portal page.
Posts: 3811 | Location: Manhattan | Registered: October 28, 2003
You'd need writing some small program to retriewe user ID from http session (simplified example for Servlet API provided in doc.) and perform lookup in some repository in order to get security &GROUP,$IBIC_user etc. Actual authentication may be performed by Application Server. Perform -IF WHERE etc. with derived data. Nice, isn't it?