Preventing unauthorized queries against the data warehouse data source

To prevent queries against tables that do not contain report data, create a user ID that has limited access in the database application. Then, in Report Builder, specify that database user in the connection information for the data warehouse.

Before you begin

  • This task applies only if your database application requires a database user ID and password to connect to the data warehouse. If you are not sure, on the Data Sources page, select the database vendor and see the sample value for the Data source location field.
  • You must be an administrator with Jazz administrative privileges or a report manager.
  • The data warehouse must be installed.

About this task

Note: This information applies only to the data warehouse. Access to Lifecycle Query Engine data sources is determined by project area membership, so team members cannot query tables that are related to projects they don't belong to.

If an administrator has not restricted the manual editing of queries, team members can edit the generated SQL or SPARQL queries in the Advanced section of the Report Builder interface. To prevent queries against tables that do not contain report data, use a database user ID that has access only to the data warehouse tables and views, and any custom tables for your reports.

You do not have to change the user ID and password on the Data Warehouse Connection page in the JTS administration section because other IBM® Engineering Lifecycle Management , applications do not provide a way for team members to edit queries.

To further restrict unauthorized queries, limit manual query editing to report managers.

Procedure

  1. Complete these steps in the database application that contains the data warehouse tables:
    1. Create a user ID.
    2. Grant that user ID read access to these items:
      • Tables and views in these schemas: RICALM, RIDW, and RIODS
      • Custom tables that contain information that your teams report on
  2. In Report Builder, go to the Data Sources page at https://server:port/rs/endpoint, and click the data warehouse link.
  3. Change the following fields to use the ID and password that you created in step 1:
    1. Data source location: Change the user ID. The format of this field depends on the database vendor.
    2. Data source password: Specify the new password.
  4. Optional: To ensure that only report managers can manually edit the SQL or SPARQL queries that generate the report, select Allow only report managers to edit queries.

Results

Report Builder can now access only those tables that the database user ID can access. Team members can report only on data in those tables.

If you change the privileges of that ID in the database application, no extra steps are required to update Report Builder.