New to BIRT and Java

TroySwRI

Hello, I've been tasked with looking into what BIRT can do for us and how well we can integrate with our current systems. We currently have about 3000 employees thta may view these reports. I've been doing a lot of research and I think I know the direction I want to go but I need a little advice. We currently are a .Net exclusive group but I've volunteered to learn Java for the sake of BIRT. We have tons of ASP.net apps and windows apps that need to to make use of reports. I would like to implement a centralized report repository that can be called from asp.net or a windows app. My initial idea is to set up a Tomcat 6 server with the BIRT report viewer. I can put all the reports(approx 2000) in there and then just serve them up through the intranet in a web browser. That seems pretty simple. Here are the things I need some advice on.

- These reports will need to have access resrictions put in place. We currently have our own means of authentication that users use to login into our apps. I don't want the users to have to log into a separate server to view the report. I want them to just click a button in our app and the report should open.

- What's the best way to restrict access to reports using Tomcat and the BIRT viewer? My first thought was to pass certain encrypted parameters to the report and have an event handler decrypt the parameter and determine whether or not to display the report, but the API doesn't seem to really support that.

- Would it be better to handle the authentication at the report level, or modify the BIRT viewer servlets? I rather not try to handle all the authorizations throught Tomcat's web.xml file.

- I would also rather at this point not resort to an off-the-shelf product. There seems to be a lot of APIs to handle this with the open source versions of these products.

Any and all ideas are appreciated. Thanks.

johnw

This is a pretty common scenario. I will make the commercial pitch real quick, even though you said you weren't interested, that the iServer and iServer Express products do this really well. Plus, there are some additional features. By the way, I don't work for Actuate, I just speak from experience as a consultant.

With that said, yes, you can implement the same thing in Tomcat directly. Normally, what companies do is implement a single sign-on system, such as Site Minder. In the case of Windows based systems, and IE exclusive shops, you also have Windows authentication. The way this works is you get a "token" inserted into the header, and when you go to the protected app, a handler in the service container will intercept and either decode the request, or prompt the user to authenticate. The header is then stored for the session. This is completely independent of the BIRT web viewer, you would just configure the container to protect the BIRT viewer and pass those credentials. To protect your reports at that point, you would need to write your reports to read the user credentials. There is an example of a "authentication" and "authorization" setup in Tomcat already. It uses a flat text file with users names and roles. You could play around with that to size up feasibility.

With that said, since you are doing this in a mixed environment, you should consider some of the other possibilities. If you don't want to forward to another server, you could have the Tomcat instance act as a web service provider, which would be responsible for merely running reports, and leave the presentation to your .Net environment. In this scenario, your .Net environment is responsible for authentication, and will pass the credentials to the web service, which will run the report, and return the result, which your application will serve up. You can also set it to such as way that the engine runs what are called "reportlets", which are snippets of HTML, not full HTML pages, that your application can integrate into its results.

There are a lot of possibilities to consider, so choose wisely.

John