How to forbit or secure job queue service?

Question

Hi all,
After install Oracle Application Server Forms and Reports Services 10g 9.0.4.0.1 in Windows 2000 environment, any user can use
http://localhost/reports/rwservlet/showjobs to display all jobs list, how can I forbid this service or secure it?
thanks

Answer 1

you need to set diagnostic=no in rwservlet.properties as follows---
The following procedures requires editing of your reportserversname.conf file and rwservlet.properties file. It is assumed that the user is somewhat familiar with the conventions of these files.
1. First, open your reportserversname.conf file in a text editor. If the following XML Tag Sets are there, or are un-commented, STOP, You are using a SSO-Enabled reports server then this article does not apply to you. Tag Sets are commented if they begin with a left-bracket, bang, dash, dash (
Code:
<!--
) and the tag is closed with a dash, dash, right bracket (
Code:
-->
NOTE: the 10g entry has the "securityUserid" entry commented for backwards compatibility,
and is SSO-Enabled by virtue of the "oidEntity" entry.
Properly commented security tagset for 9iAS Rel 2 (9.0.2.x):
Code:
<!--security id="rwSec" class="oracle.reports.server.RWSecurity">
<property name="securityUserid" value="lyKAUY845Trn2FHwfECO4QPGBg==" confidential="yes" encrypted="yes"/>
</security-->
Properly commented security tagset for 10g (NOTE: the "securityUserid" property must be uncommented, as XML cannot have nested tags inside the "security" tagset):
Code:
<!--security id="rwSec" class="oracle.reports.server.RWSecurity">
<property name="securityUserid" value="%PORTAL_DB_USERNAME%/%PORTAL_DB_PASSWORD%@%PORTAL_DB_TNSNAME%" con
fidential="yes" encrypted="no"/>
<property name="oidEntity" value="reportsApp_rmsc_rep_sol1.us.oracle.com_CE2703AC6D1C3321E030018A40906109"/>
</security-->
2. Next, secure your reports server by removing the comments for the following line in your <>.conf file.
Change:
Code:
<!--identifier confidential="yes" encrypted="yes">scott/tiger</identifier-->
To Read:
Code:
<identifier confidential="yes" encrypted="no">scott/tiger</identifier>
NOTE: The comments are the starting ( !-- ) characters and the closing ( -- ) characters in the string
above. Once you restart the reports server, the file is updated and encrypts the scott/tiger
entry (or the user/password combo you entered) and sets the encrypted= flag to "yes"
3. Edit your $ORACLE_HOME/reports/conf/rwservlet.properties file and uncomment the Diagnostics entry as follows:
Change:
#DIAGNOSTIC=NO
To Read:
DIAGNOSTIC=NO
4. Restart your reports server and run the following URL to ensure the security has taken effect (assuming your Non-SSO reports server is named 'mytest').
http://localhost:8888/reports/rwservlet/showmap?server=mytest
You should receive a warning that Diagnostics has been disabled, and no keymap file is shown.
5. Run the following URL (Note the authid= parameter) to verify the security password is correct:
http://localhost:8888/reports/rwservlet/showmap?server=mytest&authid=scott/tiger
You should be able to see the key-mapping file.
Thanks
Subodh