Report folder security issue

Hi,
We are struggling with this issue, I have various report folders in Explore within Workspace. I would like my users to view (and run) reports in the folders for which permissions have been granted. Even after granting permissions, my users are able to view all report folders and also able to run reports from them.
How do we restrict users to view only relevant folders for which permissions have been granted for. My users are grouped in various groups and folder security is being given to these groups. All my reports are FR and some WA reports.
Am I missing something silly completely? Any guidance will be of great help. Thanks in advance.

Two things i have run into:
1) the group WORLD has access to the folders. You need to remove this group from each folder.
2) The users have admin rights for Reporting. This overrides folder security.

Similar Messages

Report folder security

Hi,
I have setup a user A (it belong to Administrators group) and it can access the Reporting Server's report folders, however, another user B (it belong to USERS only) cannot access.
I already tick all the 5 roles (Browser, Content Management, My Reports, Publisher, Report Builder) to be assigned to B (from the Folder Role Assignment)
Please help ~~

Hi ,for this you need to define security at two level .
First at site settings
second for folder.
To create a system-level role assignment
If necessary, log on as a local administrator.
Open a browser window and type the Report Manager URL to start the application. For example http://<server name>/reportserver
Click Site Settings at the top of the page.
Click the Security tab at the side of the page. This page shows all system-level role assignments that are currently defined. On a new report server installation, only the two predefined roles, System Administrator and System User, are visible.
There is one built-in role assignment that is created automatically; it maps the built-in local administrators group to the System Administrator role
Click New Role Assignment.
In Group or user name, specify a domain group account that includes all of the users who require permissions to view report server content and subscribe to reports. Specify the account in this format:
domain\group. The account should be in the same domain or in a trusted domain. If you do not have a domain group that fits this description, you can specify individual domain user accounts instead.
Select System User.
Click OK.
To create an Folder level security
Click Home at the top of the page to open the Report Manager home page.
Click the Folder Settings button.
Click New Role Assignment.
In Group or user name, specify the name of a domain group account that includes all of the users who require permissions to view reports. Specify the account
in this format: domain\group. The account should be in the same domain or in a trusted domain. If you do not have a domain group that fits this description, you can specify individual domain user accounts instead.
Select Browser.
Click OK.
Click New Role Assignment again.
Type the name of a domain user account for a user who has administrative responsibilities for this report server. Specify the account in this format:
domain\user. The account should be in the same domain or in a trusted domain.
Select Content Manager.
Click OK to save the role assignments.
Thanks
Please Mark This As Answer or vote for Helpful Post if this helps you to solve your question/problem. http://techequation.com

File and Folder Security Issue

Hi,
I'm facing some problem in my windows server 2012 r2. Problem is, when i set a users permission to modify a folder and it's content then that user can delete this folder and it's content. But I want user can write, edit a file (like .doc or .xls) but he
cannot delete this file. Is it possible?
Regards,
Mahfuz

Hi,I have been facing the same problem.
The security measures which were already mentioned here will not gonna work for MS office
file extension because without providing modify permission,its not possible to edit them as this protection is working on this way "edit=delete+create".
So without providing delete option,is there any other way out to manage the staffs?Please let me know.
Thanks,
Ashief Ahmed

How do I report a security problem to Firefox?

Here's the problem: 
Wednesday morning my Mac at home got infected by malware which I believe is usually called the "Google redirect virus". My Mac at home has been upgraded to OSX 10.6.7 and I believe I was using Firefox 3.6.13 (it automatically upgraded tonight). I haven't been able to find any useful information on line about this malware. 
The behavior after infection was that every time I tried to use Google my request would get redirected. If I entered www.google.com in the address bar, the URL would get changed to www.google.com/FuneralHomes/<something> and the browser would try to go there and a "Under Construction" error message or a no-such-page message would be returned. This started happening after I did a Google search and was checking various links in Firefox, but once it started in Firefox I got the same behavior in Safari even without using Safari to look at any links. And it continued to happen in Safari even after I did a "Reset Safari..." 
When I got infected I was using a non-adminstrator account and I was not asked to download anything nor was I prompted for a password. 
I searched on "Google redirect Mac virus" using my (so far) untouched work computer and found several suggestions but no solutions. Apparently this is a PC problem that's been around a few years, but there were some Mac reports from last year. So last night I checked the DNS addresses in my
Network preferences, looked at /etc/hosts, and removed the only plug-in from the Library:Internet Plug-ins of the infected account, even though it was a Picasa plug-in that predated this infection. None of those seemed to be the problem. I also scanned my disk with an up-to-date "Norton AntiVirus" which
I got from work some time ago, but it found no viruses. 
What really puzzles me is that the problem gradually went away while I was checking it last night. At first, when I entered www.google.com the browser would still show the redirected address in the prompt that comes up and it had the Legacy.com logo on the left instead of the Google one but it would actually go to the Google website (unless I'm being spoofed). Then at a later attempt, only the wrong logo persisted. Then at an even later attempt the logo got fixed and everything looked fine and appeared to behave correctly. 
Frankly, that's a little scary. It's as if a really smart trojan got
installed and was covering its tracks while it set up a man-in-the-middle attack (please advise if I'm misusing the jargon). If I'm being too paranoid, great, but I'd still like to know how such behavior could be induced on my machine just by linking to a website. Can anyone help?
''moderator- fixed the leading space formatting errors in this posting''

Thanks, the-edmeister, but the only relevant post I found was from GB Colburn on bleepingcomputer.com, wherein he reported a similar problem about a year ago. I've found a few similar threads in the last year or so (by searching "Google redirect mac virus" in Google) but they are all about the same: someone reports the problem, responders have various random suggestions, the problem seems to go away by itself (at least sometimes), and there's nothing conclusive either good or bad.
Without myself being as knowledgeable as GB Colburn, it doesn't look to me like the problem is in the DNS system or the router. It acts more like some malware in the automatic completion in the address bar of the browser or maybe in the history system, but I can't figure out how an infection in one browser could affect another browser. And I *really* can't figure out how it could be self-healing.
It's really frustrating that none of the major parties involved in this—Firefox, Google, Safari (Apple), Verizon (my internet provider)—even have a process for reporting a security issue. At least not one that I, an ordinary semi-naive user, can find.

Where do I report a security flaw?

Hey there,
I just stumbled across a security flaw on the Cisco Collateral Store website.
Might you have an idea where to report it to?
Thank you.

Thank you Mike for your reply but it does not bring me any further.
I am just not comfortable with reporting a security issue to some feedback button.
I am looking for a specific address comparable to the Cisco Product Security Incident Response Team (PSIRT) for the Cisco website.
Kind regards
Colin

RV042 reports tunnel disconnection without connection for foreign IP, Security issue?

Dear all,
we are recently working with a RV042 router, with VPN group tunnel (connectig throw shrew VPN). Last days router is logging disconnections like this ("[XXX]" text replaced for security reasons)
Dec 9 17:02:58 2014 XXX VPN Log: (grpips0)[72] [XXX].[XXX].[XXX].0/24=== ...113.240.173.58===?: [Tunnel Disconnected] instance with peer 113.240.173.58 {isakmp=#0/ipsec=#0}
But NO RELATED "connections" (apart from our own controled connection/disconnection) is reported previously. Is this a security issue/breach?
(The foreign IP was left clear so if anyone knows about that particular IP, can make a comment.)
Thanks in advance. Regards, Juan.

Zach,
I will try to use that approach while using dynamic IPs to connect to VPN (cannot build an stable whitelist, and this can lead to connection lost in the near future until new IP is registered in the remote router).
What I do not understand is:
router logs a disconnection without a previous connection
no other activity is detected on the VPN (perhaps only spying?)
when I disconnect, two logs are generated (in order of appearance)
Dec [xxx] [xxx]:[xxx]:[xxx] 2014 3EFF-3196 VPN Log: (grpips0)[73] 192.168.2.0/24=== ...[xxx].[xxx].[xxx].[xxx]===?: [Tunnel Disconnected] instance with peer [xxx].[xxx].[xxx].[xxx]{isakmp=#0/ipsec=#0}
Dec [xxx] [xxx]:[xxx]:[xxx]2014 3EFF-3196 VPN Log: (grpips0)[73] [xxx].[xxx].[xxx].0/24=== ...[xxx].[xxx].[xxx].[xxx]===? #220: [Tunnel Established] ISAKMP SA established
when foreign IP disconnects, only one is generated (e.g. whitout #220)
Does this have an explanation?
Thanks again, Juan.

Attachments folder security

Hello Experts,
I have a client that is using the Human Resources module in B1 and is storing confidential information, such as employee reviews in the B1 attachments folder. A while ago they restricted access to this folder on the server for most of their employees so they wouldn't be able to view these reports. Recently they have also expanded the use of Outlook Integration. Outlook integration requires full access to the attachments folder in order to attach any files to the email. So now they are running into the issue of needing to restrict access to some things stored in the folder while still allowing Outlook Integration to function properly.
We've tried giving users write permission to the attachments folder, but Outlook Integration will still not function properly. The client is also not interested in restricting access on a report by report basis.
Anyone else out there run into something similar and have a handy workaround available?

Ryan,
Did you manage to find a solution with your Attachments security issue?
I found a solution buts it can be a bit expensive.
regards, Sotos

Upgrade of Business Objects v3.0 to v3.1 makes folder security disappear

Hi All,
re: Upgrade of Business Objects v3.0 to v3.1 makes folder security disappear
We just upgraded to v3.1 and the security I put in place in v3.0 did not carry over for the folders. Our company wanted to secure the folders per SAP security role, so I did that by breaking the inheritence relationship from the Root Folder on child folders that they should not have access to (see SAP note#1281763 for explaination on this type of procedure). It worked fine in v3.0, but after the upgrade, all of those changes had disappeared and every SAP role was able to see every folder. This was a major effort to secure those folders and I do not want to do it again. Also, we did import the roles into the upgrade BO v3.1 before we imported the BO structure, which as told to us by SAP, would work and not cause this issue.
Thanks for your help!

Hello Gary,
I recommend to post this query to the [BusinessObjects Enterprise Administration|BI Platform; forum.
This forum is dedicated to topics related to administration and configuration of BusinessObjects Enterprise, BusinessObjects Edge, and Crystal Reports Server.
It is monitored by qualified technicians and you will get a faster response there.
Also, all BOE Administration queries remain in one place and thus can be easily searched in one place.
Best regards,
Falk

REPORTS folder does not appear when refreshing dynamic templates

Hi all,
I got one issue when refreshing dynamic templates. For one application, the REPORTS folder does not appear under Eexcel folder.
It works well on my quality environment, but it fails on production server.
It seems there is no differences in security settings, SP version...
I already tried deleting Outlooksoft folder, clear and refresh local folder in client options...
I must miss something but I dont know what to check anymore.
Any suggestion is welcome.
Thanks
Antoine

Hi Neil,
I do not have issue with what you mention, everything is ok in Webfolder.
The problem is in the local folder of every user in My Documents folder.
There is a folder Outlooksoft there that is refreshed automatically after connecting to BPC.
Every reports under REPORTS\WIZARDS should be there. Users need to access this folder to open a specific report.
What is strange is that it looks that it works for some users, but does not work for some other users...
Might be security settings?
Antoine

Report Designer Locking issue

Hi,
We have found locking issue while accessing same report(Created in Report Designer) by multi users at a time .
Has anyone face this issue and How to fix it. It's major concern because same report can be accessed by multiusers at same time
Thanks
Siva

Siva,
only one person at a time has permission to open the report in the Report designer - just like with Queries in the query designer. This should not have any effect on you actually executing the report in the portal - multiple people can do it then.
this is a security issue that other software vendors use as well - just like you cannot open any MS Office files on the network for editing that someone has opened already.
Thanks

How to create a crystal report using secured web service as a datasource?

Hi All Expert,
I having some challenges on how to create a report using secured web service as a datasource in crystal report designer (CR11 R3).
Secured Web Service including the certificate trusting, token authentication, header and/or body encryption. All web services running on https protocal.
Could you please suggest me on the solution?
Thank you and Best Regards,
Cherr

Please re-post if this is still an issue or purchase a case and have a dedicated support engineer work with you directly:
http://store.businessobjects.com/store/bobjamer/DisplayProductByTypePage&parentCategoryID=&categoryID=11522300?resid=-Z5tUwoHAiwAAA8@NLgAAAAS&rests=1254701640551

Why is Java Deployment Toolkit (click-to-play) blocked, also the referenced bug is closed and there are no security issues known in Version 7 U51?

I think it is important to block unsecure addons. But if you do so there should be an open bug assigened. The referenced bug for this add-on is allready resolved so I do not know why this plugin is disabled. https://bugzilla.mozilla.org/show_bug.cgi?id=636633
I have the problem that I want to use Secure_Auth that is using the Java Deployment Kit in such a nasty way (via javascript) that firefox doesn't see that the deployment kit should be started. Therefore I will not be asked to allow this plugin always for this web site. Since there is no documentation available how to do this configuration in a config file I am stuck at the moment.
I'm a liitle bit suprised that blocking all versions (even secure versions) is a way to get a good user experience.
Regards
Martin

''MG_DAU wrote:''
The referenced bug for this add-on is allready resolved so I do not know why this plugin is disabled. https://bugzilla.mozilla.org/show_bug.cgi?id=636633
That's a bug report in the Blocklisting component, meaning it's a request to add an add-on to the blocklist. The fact that it's marked as fixed means the add-on has been added to the blocklist.
* https://addons.mozilla.org/firefox/blocked/p428
* [[Add-ons that cause stability or security issues are put on a blocklist]]
Given that there's no way to disable Click-to-Play for this plug-in (the only options are Ask to Activate or Never Activate), if Firefox doesn't trigger a Click-to-Play prompt, I see no way to use it apart from disabling the entire blocklist. This carries a considerable security risk, as no plug-ins will be blocked or set to Click-to-Play, including known malware. If you're sure you want to go through with it, set ''extensions.blocklist.enabled'' to '''false''' in [http://kb.mozillazine.org/About:config about:config].

Spoof dialog Boxes security issue

Hi all
Any one out there aware of this security issue with Safari
"Secunia Research has discovered a vulnerability in various browser's, which can be exploited by malicious web sites to spoof dialog boxes.
The problem is that JavaScript dialog boxes do not display or include their origin, which allows a new window to open e.g. a prompt dialog box, which appears to be from a trusted site."
I found the above by accident as i was looking up something else.
If you go to Secunia site and try the test you may find that you are also vulnerable.
http://secunia.com/multiple_browser'sdialog_origin_vulnerabilitytest/
The only way i found to stop the spoof dialog box was to turn off enable plug-ins in preferences. However i don't have any plug-ins in my Safari plug-in folder.
I'am running safari 1.3(v312) however it would appear that it also effects version 2.2 of Safari too. Also i have installed the latest update but to no effect. Other browser effect are:-
_ Internet Explorer for Mac
- Internet Explorer
- Opera
- iCab
- Mozilla / FireFox / Camino
My question is, is this vulnerability true, or just a setup
Any comments welcome.
~Tim

Hi,
The issue is resolved, but I don't know what caused this error.
I uninstalled the java components and BO then I deleted the BO folder under program files, then I deleted all BO entries in the registry.
Finally I reinstalled everything except the service pack and that finally worked. I don't know the cause of this error.
Regards,
Marcela

Security issues for Discoverer 10g apps 12i

gurus,
I have couple of things to get it done at client.
We are on Oracle Apps rel 12i with dicoverer 10g.
Did anyone setup MOAC to be enabled and operational in business areas?
Setting up secure responsibilities in discoverer for MOAC?
Any setup needs to be done for custom report security in discoverer ?
thx

Hi,
I did setup new MOAC security profiles and assigned multiple organizations to that profile for testing purpose.
After this, I did run concurrent program "Security List Maintennce" etc...
Tested Upding profile at user level or responsibility level.
On APPS side fine.
I need the some basic steps on setup of security issues for discoverer side.
1) Business areas (any security steps need to be followed in order to access data for single or multi-org)
2) Custom Reports ( any security setup or any moac security profile setting against responsibilty for accessing single or multi-org data)
Since we dont have default operating unit parameter as specified in the concurrent program, how do you restrict data?
3) Reconciling security approach r12 with discoverer (any steps need to be followed here after r12 configuration with security issues)
4) Custom Views ( any steps to be followed for single or multi-org data as security aspect)
Looking for info on these setups.
Thx

Security issue in DNS ! Update bind.

Apparently there is a massive security issue in DNS protocol : http://securosis.com/2008/07/08/dan-kam … -released/
or http://www.kb.cert.org/vuls/id/800113
I am surprised I haven't seen any post on the forum about it. For now a solution could be to update bind to 9.5.0-P1 (I don't know if the one in testing is this particular one, there is no "P1").
Every DNS server has to be upgraded since the issue is in the protocol, not in the code !

A lot of systems got updated yesterday/today. I just checked a Windows Server 2003 x64 RC2 at work; yesterday it was vulnerable, but today it's reported safe after the recent security updates (this site offers some kind of check: http://www.doxpara.com/)
I believe all the "big" ones in Linux did release an update yesterday, so there's probably plentiful of patches around... which is beyond the limits of my brain cells at the moment.

Report folder security issue

Similar Messages

Maybe you are looking for