How to use authid with rwservlet via WebLogic Thin Client

Question

1. Using J2EE Thin Client for WebLogic (WL) to submit interactive requests for Oracle Reports (App Server 10g) running on another server without SSO.
2. After starting basic Infrastructure, we start rwserver in batch mode (no other mid-tier components are used).
3. It appears that the cgicmd.dat file in the Thin Client conf directory on the WL server controls the DB access with the key:connect string info it has.
4. We had been allowing the testers to come in via the web through a SunOne (iPlanet/Netscape) web server instance, which in turn connects to the WL server running the Thin Client instance.
5. We noticed that anyone could run rwservlet to view report status with the showjobs command via a URL through the same mechanism as point #4 above, and were concerned about security of the reports - "bad".
6. Then someone realized the showmap command could also be specified, and thus see the DB connect string (Id/pw/SID) - "worse".
I researched securing Reports, and read through the white paper, "Securing Oracle9i Reports", and although it discusses security without using SSO, all it says is "users accessing a secured instance of Oracle9iAS Reports Services will be challenged to identify themselves by the Reports Servlet, using its own authentication mechanism (as with Reports6i)", but I can find no explanation of how that works, nor how it would work with the WL Thin Client.
Questions:
1. How are the Id's/passwords set up under AS 10g "as with Reports6i" in this environment going through the WL Thin Client?
2. Is there anything else that needs to be done to secure the created reports, and the connect string info (i.e. using authid with rwservlet?showjob, and not allowing the rwservlet?showmap to be executed at all)?
TIA,
ROC

Answer 1

the JDBC Developer's Guide (11gR2)
gives an example in chapter 9 under "JDBC Thin Driver Support for Encryption and Integrity", sub- "Setting Encryption and Integrity Parameters in Java"
from Oracle SQL Devloper, without redirecting the client to use the OCI/thick driver, choose, new database connection, connection type Advanced. add the entry from the example noted above to the Custom JDBC URL form.
for example:
Properties prop = new Properties();
prop.setProperty(OracleConnection.CONNECTION_PROPERTY_THIN_NET_ENCRYPTION_LEVEL,"REQUIRED");
prop.setProperty(OracleConnection.CONNECTION_PROPERTY_THIN_NET_ENCRYPTION_TYPES,"(AES128)");
OracleDataSource ods = new OracleDataSource(); ods.setProperties(prop); ods.setURL(jdbc:oracle:thin:@(DESCRIPTION=(ADDRESS_LIST=(ADDRESS=(PROTOCOL=TCP)(HOST=xxxx)(PORT=1521)))(CONNECT_DATA=(SERVICE_NAME=xxxx)(INSTANCE_NAME=xxxx))));
Connection conn = ods.getConnection();
strange side note!, we could not get this to encrypt unless the sqlnet.ora file included the SQLNET.ENCRYPTION_SERVER=required. if this was set to default(accepted), and even though the jdbc thin client properties set to required, the network traffic was still clear text.
good luck