security/cookies and which controls running on client/server

[patwolf]

Hi,

We got the following setup:
ws: plaintext auth secured ssl linux web server with images and data
rs: plaintext auth secured ssl windows reporting server

As a data source for reports on RS we use XML/XSL hosted and dynamically generated on WS. Currently we have to authenticate again though and were wondering how to get around it.

The workflow is:
1) WS: user clicks on link to open reporting on RS
2) RS: the reporting pages loads in ASP.NET
3) RS: via the URL we know the data the user wants to report on in this case page 343434
4) RS: we build the dictionary for Stimulsoft and use as a data source the RS server: https://ws/data/343434/xml,https://ws/data/343434/xsl
5) RS: we open a report, set the dictionary and tell the browser to render in the users browser
6) RS: Now Stimulsoft displays in users browser, loads the dictionary, tries to access the data
7) RS: Now the users browser has to authenticate again as the report runs from server RS but the data is on WS.

Question: How can we avoid that the user has to log in again please?
e.g. could we log in on the server and pass the cookie along to the client side?

Also along these lines what is the client /serer work flow for these controls please?
ASP.NET Reports Viewer with Ajax client-side: access data and render on server side and just display data in browser? e.g. WS data is accessed from server only
ASP.NET Reports Viewer with Flash client-side: access data and render on client side? e.g. WS data is accessed from client directly
ASP.NET Reports Designer with Flash client-side: access data and render on client side? e.g. WS data is accessed from client directly

Thanks a lot,
Patrick

[Vladimir]

Hello, Patrick

1. You can store the session ID in the URL address, then the server should accept it and do not ask for login again. Also please set the following options:

Code: Select all

<cc1:StiWebViewer ID="StiWebViewer1" runat="server" UseRelativeUrls="true" />

Code: Select all

StiWebViewerFxOptions.Connection.RelativeUrls = true;

Code: Select all

StiWebDesignerOptions.Connection.RelativeUrls = true;

2. You can pre-load the data into the stream and transmit them to the report, using the report.RegData() method and GetDataSet or GetPreviewDataSet events.

Thank you.

[patwolf]

Hi Vladimir,

thanks for your answer. Could you please provide more details so I can fully understand it?
What does the UseRelativeUrls option do?
Does it mean I have to add the session ID to every single item? E.g. the XML is full of links to images on the webserver does it mean I have to rewrite the whole XML every time the report is opened with a different session id?
Wouldn't it be easier if your controls control has a property I could set from the server side which is used to authenticate against other servers from the client browser. Then the XML file wouldn't need to be changed each time a different user runs the report. Is there a way to do this?
Could you please comment on my client/server work flow for controls please?

Thanks a lot,
Patrick

[patwolf]

Regarding my question:
ASP.NET Reports Viewer with Ajax client-side: access data and render on server side and just display data in browser? e.g. WS data is accessed from server only
ASP.NET Reports Viewer with Flash client-side: access data and render on client side? e.g. WS data is accessed from client directly
ASP.NET Reports Designer with Flash client-side: access data and render on client side? e.g. WS data is accessed from client directly

It looks from another post like it is actually like this:
All of them do the same: Access data and render on server side and just display data in browser? e.g. WS data is accessed from server only
And the only exception is if thumbnails are loaded via a URL in which case the client browser would access them directly?
Is that correct?
Is it possible to append a sessionId to each URL for authentication?
Thanks a lot,
Patrick

[Vladimir]

Hello, Patrick

In all these control all data operations, rendering and exporting reports occurs on the server side. Use of RelativeUrls will keep the session ID, which is located in the URL. To enable the specified mode sessions in the URL, you must set the appropriate option in the Web.Config file for your application.

Thank you.

[patwolf]

So even when the data source contains URLs to images these are loaded on the server side and then send to the client?
Thanks
Patrick

[HighAley]

Hello, Patrick.

So even when the data source contains URLs to images these are loaded on the server side and then send to the client?

Yes, the image firstly is loaded on server.

Thank you.