use jsapi secure

Really appreciate, if some one could share the ways to use jspai securely. What really meant is, for actuate.intialize(url, request options, username, password, callback) when the password is supplied it is visible by viewing the source.
 
By the way, the application has its own login mechanism and do understand single sign on needs to be implemented.
 
But anyways when the password field is supplied, it will be visible in the source of the page.
 
Are there any ways to keep the password secured. Also are there any other ways to integrate birt reports into web applications apart from jsapi.

Find more posts tagged with

Comments

Clement Wong

Ideally, you should be using SSO and implement the Information Console Security Extension (ICSE). This way you would be able to pass null for the username and password in the JSAPI .initialize or .authenticate call. 
If you had to do it without SSO, there some alternatives of not passing the actual password value in the JSAPI .initialize or .authenticate call. The password is a JavaScript string so it can be replaced with a JavaScript variable or evaluation such as form.input_password.value. 
HTML5 has a feature called web storage (<a data-ipb='nomediaparse' href='; One of your application pages (after your application login) can set the password in a session storage. if(typeof(Storage) !== "undefined") { 
 sessionStorage.password = "password"; 
} else { 
 // Sorry! No Web Storage support.. 
} 
Then in your JSAPI page, you can: actuate.authenticate(url, reqOps, sessionStorage.username, sessionStorage.password, null, JSAPI_Loaded, JSAPI_NotLoaded); 
 
To include BIRT content in an application without SSO, it is not necessary to use JSAPI. It is possible to use another mechanism to log in using the Login Servlet (/loginservlet) in an AJAX call. Then you can use JSAPI passing in null as the username and password because the user has been logged into Information Console. Instead of embedding via JSAPI, you can just call reports or dashboard via URL. For example, via /executereport.do, /iv, or /dashboard. These items could open in a new tab/window or in an iframe. 
Example: <!DOCTYPE html> 
<html> 
<body> 
<h2>Loginservlet AJAX example</h2> 
<form name="myform"> 
 Username: <input type="text" size="25" id="userid"> 
 Password: <input type="password" size="25" id="password"> 
 <input type="button" value="Login" onClick="doLogin();"> 
</form> 
<script> 
function doLogin() { 
var xhttp = new XMLHttpRequest(); 
xhttp.onreadystatechange = function() { 
 if (xhttp.readyState == 4 && xhttp.status == 200) { 
 status = xhttp.responseXML.getElementsByTagName("Status")[0].childNodes[0].nodeValue; 
 if (status == "Succeeded") 
 { 
 alert ('Succeeded'); 
 } 
 else 
 { 
 alert ('Failed'); 
 } 
 } 
}; 
xhttp.open("POST", "<a href="http://yourserver:8700/iportal/loginservlet?">http://yourserver:8700/iportal/loginservlet?",</a>true); 
xhttp.setRequestHeader("Content-type", "application/x-www-form-urlencoded"); 
debugger; 
xhttp.send("userid=" + document.forms["myform"]["userid"].value + "&password=" + document.forms["myform"]["password"].value ); 
} 
</script> 
</body> 
</html>

bcmp

It would be great, if you could share link or reference for sso implementation. 
 
Thanks! and the description was informative.

Clement Wong

Under this page (<a data-ipb='nomediaparse' href='http://developer.actuate.com/resources/documentation/ihub31/integration/'>http://developer.actuate.com/resources/documentation/ihub31/integration/</a>), you'll find: 
 
<a data-ipb='nomediaparse' href='http://developer.actuate.com/be/documentation/ihub31-dev/SIT/iHub311_Simple SSO.zip'>Single Sign-On</a>
<a data-ipb='nomediaparse' href='http://developer.actuate.com/be/documentation/ihub31-dev/SIT/iHub311_Sample IPSE.zip'>IPSE Implementation</a>
 
Also, from GitHub, Server Integration IPSE Example (<a data-ipb='nomediaparse' href='https://github.com/ActuateBIRT/ServerIntegrationIPSEExample/'>https://github.com/ActuateBIRT/ServerIntegrationIPSEExample/</a>)

Sumit Malpure

How to implement Single SIgn On using iFrame for iHUB?

Sumit Malpure

I need to use templates stored on iHUB server in order to display charts (Speed vs distance or distance vs time etc) in my web application.When i explored it was told we can make use of JS API to display charts in my application.
 
UI is developed using vaadin and karaf is the container.
 
Any example with source code will be great help.
 
Thanks, 
Sumit