Is this practice recommended in production?

[erikmarbad]

The case is as follows:

The company has a web portal in which Jasper reports are currently generated, for certain reasons it has been decided to use JasperReports Server (8.0.0 community edition) to generate reports, so as not to make an abrupt change between the web portal and JasperReports Server It has been decided to establish a joint work, that is, in the web portal the parameters or input controls of the report will be entered, then this information is sent to Jasper Server to subsequently generate the pdf or excel, the way in which we send the information is through a URL like the following:

http://jasperadmin:jasperadmin@localhost:8080/jasperserver/rest_v2/reports/reports/MA032.pdf?AMB=yyyy

What we do is build the url dynamically, we successfully bring the report in question with the correct information, we still look for a way to hide the username and password.

The problem lies in making the user's session close immediately after the report is executed because the user remains in the session after executing the report, for this we have not found a solution in this regard, so we have thought of 2 alternatives, the first is shorten the time of inactivity of a user on the server, so that, for example, if 2 minutes pass after executing the report, it will be later removed from the server, and the second is to maintain one user per area for an indefinite time, that is, each area in the company will have a username and password, so that the users belonging to each area when generating the reports will use the credentials of their respective area .

How good are these solutions?

[yama818]

I have two ideas.
However, I am not sure if they can meet your requirements.
I would be happy to give you some ideas.

 

1. Log in with REST_API in advance.
  https://community.jaspersoft.com/documentation/tibco-jasperreports-server-rest-api-reference/v790/authentication
   --> The login Service
  After this, you should be able to output PDF using only this URL.
  http://localhost:8080/jasperserver/rest_v2/reports/reports/MA032.pdf?AMB=yyyy

 

 

2. Use Token-based Authentication.
  https://community.jaspersoft.com/documentation/tibco-jasperreports-server-authentication-cookbook/v790/token-based-authentication
  In this method, passwords are not required in the request because pre-authentication is assumed.
  The user can be passed in the request header and will not appear in the URL.
  The simplest parameter is 'pp=u=user', where ' user' specifies the JRS login user.

 

Logout can also be done via the REST_API. However, the method of firing may be problematic.
  https://community.jaspersoft.com/documentation/tibco-jasperreports-server-rest-api-reference/v790/authentication
    --> Logout

 

After that, there seems to be a way to not have user IDs in the first place.
https://community.jaspersoft.com/wiki/allow-anonymous-access-reports