This guide is based on a business case from Defining a Domain Security File.

How-to insert a profile attribute (deprecated)

UPDATE: This section is only relevant to JasperReports Server v4.7 and below. Starting with JasperReports Server v5.0+ the profile attributes can be added from the Manage User page (see online Documentation Section on editting user profile attributes) in the Server UI while logged in with an admin account (jasperamdin or superuser). There is no need to add these are the database level.

A profile attribute is a name-value pair defined at the user or role level; in this example, it is set on the user and corresponds to value in the data returned by the Domain.

Retrieve the User IDs in the Repository

1. Launch your SQL client (depending on your database).
2. Launch the following SQL queries to retrieve Jasper and Repsaj IDs:

SELECT * FROM jiuserrole
 WHERE roleId = (SELECT id FROM jirole WHERE rolename = "ROLE_MYDOMAIN_STORE_MANAGER")
   AND userId = (SELECT id FROM jiuser WHERE username = "jasper");
SELECT * FROM jiuserrole
 WHERE roleId = (SELECT id FROM jirole WHERE rolename = "ROLE_MYDOMAIN_STORE_MANAGER")
   AND userId = (SELECT id FROM jiuser WHERE username = "repsaj");

Jasper user ID is 42.

Repsaj user ID is 43.

Inserting Attributes into Profile Attribute Table

Launch the following SQL queries to insert Jasper and Repsaj profile attribute:

INSERT INTO jiprofileattribute (attrName,attrValue,principalobjectclass,principalobjectid)
     VALUES ("Cities","Los Angeles",
             "com.jaspersoft.jasperserver.api.metadata.user.domain.impl.hibernate.RepoUser",42);
INSERT INTO jiprofileattribute (attrName,attrValue,principalobjectclass,principalobjectid)
     VALUES ("Cities","San Diego",
             "com.jaspersoft.jasperserver.api.metadata.user.domain.impl.hibernate.RepoUser",43); 

Note: after inserting attributes, go to JasperServer, Manage > Users. You can see the new profile attributes for Jasper and Repsaj.

Creating a Security File

Open your XML editor (eg: notepad++ or XMLBuddy) and create a new XML file.

1. Add the following lines and save your document:

   <securityDefinition xmlns="http://www.jaspersoft.com/2007/SL/XMLSchema" version="1.0"
                       itemGroupDefaultAccess="granted">
     <resourceAccessGrants>
       <resourceAccessGrantList id="JoinTree_1_List" label="ListLabel" resourceId="JoinTree_1">
         <resourceAccessGrants>
           <resourceAccessGrant id="Jointree_1_row_access_grant_1">
             <principalExpression>
               <!CDATA[authentication.getPrincipal().getAttributes().any{ it.getAttrName() in ['Cities']]]>
             </principalExpression>
             <filterExpression>
               store.store_city
               in (groovy( 'authentication.getPrincipal().getAttributes().find{ it.attrName == "Cities" }
                                          .attrValue.split(",").collect {"<em>" + it + "</em>"}
                                          .join(",").replaceFirst("^<em>","").replaceFirst("</em>$","")' ))
             </filterExpression>
           </resourceAccessGrant>
         </resourceAccessGrants>
       </resourceAccessGrantList>
     </resourceAccessGrants>
   </securityDefinition>
   

Applying a Security File

• As the Repository Administrator (eg: jasperadmin), log into JasperReports Server.
• On the Home page, click View > Repository.

• In the Repository manager, select the Domains folder, select your domain and click the Edit icon.

  
• Click on RESOURCES section and click on Add Security.

• In Local File tab, click on Browse to specify your security file path. Then do OK and Save.

  

Test

Let's create a basic report to test the row-level security rules.

1. As the Repository Administrator, click on Create > Ad Hoc Report.

   

2. In Domains tab, select your domain, and on the right select Table as the report type.

   

3. In Choose Ad Hoc Data, drag employee and store items and drop them on your right in Selected Items frame. Then do Done.

   

4. Create your report as below then save it in the Repository.

   

5. Run the new report as jasperadmin. You will notice the report displays stores' information from all location.

   

6. Run the new report as Jasper user. The report only displays stores' information related to Los Angeles.

   

7. Run the new report as Repsaj user. The report only displays stores' information related to San Diego.

   

(Optional) Multiple values for Profile Attributes

A profile attribute can contain multiple values, separated by commas. See the below example for Jasper user:

INSERT INTO jiprofileattribute (attrName,attrValue,principalobjectclass,principalobjectid)
     VALUES ("Cities","Los Angeles,Alameda,Acapulco","com.jaspersoft.jasperserver.api.metadata.user.domain.impl.hibernate.RepoUser",42);

(Optional) Modifying Profile Attributes

Here is the SQL query to modify a profile attribute. This example is for Jasper user:

UPDATE jiprofileattribute 
   SET attrValue = "Los Angeles,Alameda,Acapulco" 
 WHERE attrName = "Cities" AND principalobjectid = 42;

Run the new report as Jasper user. Now the report displays stores' information related to Los Angeles, Alameda and Acapulco.

Notes

• A Profile Atribute value is not case-sensitive(eg: SAn FrAnCisco).

More Examples

• See Basic Domain Security File Examples.

See also...

• Defining a Domain Security File
• Setting up Column-Level Security