Has anyone been able to successfully integrate SharePoint and WebFOCUS using SharePoint web parts? If so, how have you implemented your WebFOCUS Security? PTH, OPSYS, Kerberos, or other? Have you been able to integrate SharePoint and WebFOCUS in such a way that users do not have to type in their WebFOCUS password every time they try to run a report?

We have been attempting to integrate SharePoint (MOSS 2007) and WebFOCUS 7.7.03 using the SharePoint web parts. Our goal is to view WebFOCUS reports within a SharePoint window. However, we are running into problems with user authentication. One of our requirements is that the user must NOT be prompted to log in to WebFOCUS (even inside a sharepoint window) to run reports. Currently, our reporting server is using PTH Security, which I understand does not actually authenticate the user at the reporting server level. But PTH security opens a security hole where if a user knows how to craft a report URL, they can input a username instead or a paramter into the URL that would give them access to other user’s reports and data sources. And it appears that OPSYS security always requires a user to input their username and password when they run a report, even within the SharePoint web Parts and dashboard.

If anyone has integrated SharePoint with WebFOCUS, please let me know what security method you used, and if your users have to log in to WebFOCUS when they run their reports.

This message has been edited. Last edited by: Kerry,

You can go light weight to heavy duty with something like this.

Light weight is to use IIS (under IWA) to front end the WF requests. If you use an app server like Tomcat, then you can shut down the HTTP listener and only use AJP via a filter on IIS. This will only allow known users into the WF environment. The server is still open for anyone that knows how to request reports via the HTTP listener (I only know one person that kind of knows the syntax). Here again you can shut down the HTTP listener to protect that.

SSO with Kerberos might be your best option. With Kerberos, the signon token can be configured to pass all the way to the back end, and all using your lan account. It can be a bit of a bear to configure, but pretty rock solid once the work is done.

Do you know if Kerberos works with Mobile Favorites? We have been told that it does not.

No idea .... never looked at mobile favs.

However, one thing I've leaned over the years is that there is always a way. Maybe you should switch this question to CSS or your local SE team. You should be able to get a final answer or suggestion on how to proceed.