Jump to content
We've recently updated our Privacy Statement, available here ×

gabrielinux

Members
  • Posts

    118
  • Joined

  • Last visited

 Content Type 

Profiles

Forum

Events

Featured Visualizations

Knowledge Base

Documentation (PDF Downloads)

Blog

Documentation (Test Area)

Documentation

Dr. Jaspersoft Webinar Series

Security Advisories

Downloads

Posts posted by gabrielinux

  1. I wonder, is it possible to use the parameter that contains the user ID in a SQL query? Because then the input control would simply contain a SQL query that returns the value of this parameter and present it in a drop down.
  2. Here's another bug:

     

    * Whenever a report is created under a sub-directory containing underscores, the scheduling/edit/run in background buttons are disabled. For instance, I created a sub-directory called /reports/Departments/sql_development and put various reports there. I am unable to schedule any reports in that directory unless I do it from View -> Reports instead of the home screen.

  3. Hi all,

     

    I am not sure where or how to report bugs, so I thought I'd post them here.

     

    * When using LDAP authentication, every time a new user logs in, his/her account type is marked as "External" and "Enabled." If an administrator clicks on the user account and makes any changes -- assign/remove roles, edit e-mail address, etc. -- the user account changes to "Disabled." This affects reports scheduled by that user as well as write access for the user regardless of his/her role. There is currently no way to re-enable the user (other than deleting the account).

     

    * E-mail addresses in user accounts cannot contain dashes or periods. This bug may have already been reported.

     

    * The new input controls (filters) that can placed above a report do not work. They throw JavaScript errors referencing a null object.

     

    * When you login as regular user, log out and immediately after you login as an administrator user, you will not have access to any restricted folders. It's almost like JasperServer thinks you are still the regular user. Maybe this is just a cookie or a page state issue? It seems to happen more often with Firefox 3 than with IE 6/7.

     

    * Upon logging in, there is a button on the toolbar to launch a report designer. It disappears right away. Maybe it was disabled in the community edition? If so, why have it at all?

     

    * The installer no longer asks for a an admin password or MySql root password, which is a BIG security risk.

     

    * The installer WILL install analysis components samples even if one selects not to install any report samples. The report samples are not installed, only analysis samples.

     

    * This one is not exactly a bug, but it is a terrible design flaw. Not being able to apply upgrades and/or patches as an add-on is very bad. If a new version comes out, one needs to re-install JasperServer and then manually transfer data from the old database to the new one. This is a very risky and time consuming process that may keep users locked in an older version, or even away from JasperServer.

     

    * The MS SQL drivers shipped with JasperServer are too old. They do not support SQL 2005 100%. New ones are available from Micr$oft.

     

    * When using LDAP authentication, the log files shows that every time a user logs in, his/her account is re-populated with all of the user's roles. This should not happen -- it should only add any new roles. There is no need to add existing roles again since that only creates overhead on the database and slows down the login process.

     

    * In JasperServer 3.0.0, the login (welcome) page is no longer customizable. That was not the case in v3.0-RC1 and older. This was a very bad decision since both companies and individuals will likely want the same look and feel across all Web applications. Moreover, this is also a security risk since the administrator account is shown.

    Post edited by: gabrielinux, at: 2008/07/02 14:48

  4. Hi,

     

    I'm running JasperServer 3.0 RC1. I have authenticated against Active Directroy. After a user logged in, I tried going to his account (in JasperServer) and entering an e-mail address. But no matter what I enter, I always get this error:

     

    "The email address has invalid format"

     

    Has this been fixed in 3.0.0? Or is there a work around?

  5. I'm not sure if this still happens in 3.0.0, but in versions up to 3.0 RC1 the js.mmail.properties file was not populated correctly.

     

    For example, if during the installation you leave the user name and password blank, the installer will place a bogus value in their place. Blank is blank -- so when the user leaves it blank, the js.mail.properties values should also be blank. It took me a while to figure this out, and as soon as I removed the place holders, JasperServer was able to send out e-mails.

  6. Thanks Sherman. I added a filter under the userSearch bean, and then referenced the bean as a property. However, it looks like the filter has no effect at all -- No matter what I put in the filter, users are always authenticated.

     

    My userSearch bean looks like this:

     

    <bean id="userSearch" class="org.acegisecurity.ldap.search.FilterBasedLdapUserSearch">

    <constructor-arg index="0">

    <value></value>

    </constructor-arg>

    <constructor-arg index="1">

    <value>(memberOf=CN=JasperServerUsers,OU=ApplicationGroups,OU=Groups,DC=mongefranco,DC=com)</value> <!-- uid -->

    </constructor-arg>

    <constructor-arg index="2">

    <ref local="initialDirContextFactory" />

    </constructor-arg>

    <property name="searchSubtree">

    <value>true</value>

    </property>

    </bean>

     

     

    And the userSearch and UserDNPatterns in the ldapAuthenticationProvider bean look like these:

     

    <bean class="org.acegisecurity.providers.ldap.authenticator.BindAuthenticator">

    <constructor-arg><ref local="initialDirContextFactory"/></constructor-arg>

    <property name="userSearch"><ref local="userSearch" /></property>

    <property name="userDnPatterns"><list>

    <value>cn={0},ou=DepartmentUsers</value>

    <value>cn={0},ou=AdminUsers</value>

    </list></property>

    </bean>

     

    Do I have the userSearch property in the wrong place? Or maybe my userSearch filter is incorrect???

  7. I don't know if this "officially" supported, but I did manage to change mine. :)

     

    [installation dir]apache-tomcatwebappsjasperserverWEB-INFJSPlogin_welcome.jsp

     

    To change the links to JasperSoft and SourceForge on the heather of each page:

     

    apache-tomcatwebappsjasperserverimagessflogo.gif

    apache-tomcatwebappsjasperserverimagesjaspersoft-logo.png

    apache-tomcatwebappsjasperserverWEB-INFdecoratorsmain.jsp

  8. Well, so far I have only been able to tell Spring where to find my users. The problem is that I don't know how to setup the filters to tell it to check if the user is a member of a specific security group. The documentation mentions how to check if users belong to an organizational unit, but not a security group.

     

    Essentially, my users are stored this way: cn=myusername,ou=DepartmentUsers,dc=mongefranco,dc=com.

     

    Then, I have several security groups. For example, JasperServer users (all of which should have access to JasperServer) belong to this security group: cn=JasperServerUsers,ou=ApplicationGroups,ou=Groups,dc=mongefranco,dc=com.

     

    Finally, each user is also part of another security group denoting his or her department. This department should determine the role name: cn=Development,ou=DepartmentGroups,dc=mongefranco,dc=com.

     

    Any idea how I would set that up in the ApplicationContext-security.xml file?

    Post edited by: gabrielinux, at: 2008/06/25 14:49

  9. Hi all,

     

    I just configured JasperServer to work with LDAP authentication. Unfortunately, every time a user logs in -- even if he's not in an authorized department -- JasperServer creates an external user in its database and assigns a default role. How can I prevent this behavior? I do not want external users to be able to login unless I manually add them to the users list first.

     

    The file that contains the default role is WEB-INFapplicationContext.xml. The only work-around that I've found so far is to change ROLE_USER to ROLE_ANONYMOUS here, and then remove access to everything in the repository from ROLE_ANONYMOUS. However, this still creates accounts upon a successful login which is very undesirable.

    <bean id="userAuthorityServiceTarget"

     

     

    class="com.jaspersoft.jasperserver.api.metadata.user.service.impl.UserAuthorityServiceImpl">

    <property name="sessionFactory" ref="sessionFactory"/>

    <property

     

    name="objectMappingFactory" ref="mappingResourceFactory"/>

    <property

     

    name="persistentClassFactory" ref="persistentMappings"/>

    <property

     

    name="profileAttributeService" ref="profileAttributeService"/>

    <property

     

    name="defaultInternalRoles">

    <list>

    <value>ROLE_ANONYMOUS</value>

     

     

    </list>

    </property>

    </bean>

     

    Help? :(

  10. JasperServer is an excellent report server. It provides fast, easy and flexible reporting capabilities for businesses of all sizes. It has everything from support for OLAP cubes and data marts, to charts, to sub reports, to dashboards. Wait, did I say dashboards? Scratch that. JasperServer Professional has support for dashboards, but not JasperServer Community Edition.

     

    Dashboards, a simple an intuitive function that one would expect to find in any sub-mature BI product, is not present in the "open source" edition of JasperServer. So essentially, the open source community only gets a taste of the pro version. If they want a fully functional, usable, enterprise-ready product, they must pay to obtain the Professional Edition. So in a way, JasperSoft has not captured the true sense of "open source." JasperSoft’s "community edition" software is nothing more than shareware. It is shareware in the sense that you only get a peek into the product, but you can't get the essential features -- such as dashboards -- unless you pay. Therefore, JasperServer Community Edition, although by all legal means "open source," is morally and functionally nothing more than shareware with viewable source code.

     

    ** Originally posted on the author's blog at http://blog-gabriel.mongefranco.com **

×
×
  • Create New...