Embed report using embed secret key

To render a Bold Reports® report in your web application with single sign-on (SSO), you frame the embed URL using the embed secret key.

How do I get the embed secret key?

You generate the embed secret key on the Bold Reports® Report Server Embed settings page. Follow these steps:

  1. Go to the settings page and click Embed.
  2. On that page, enable the Enable embed authentication option. Embed settings page
  3. Click the Generate Secret button. Generate secret button
  4. The secret key is generated. Save the secret key safely, because you cannot retrieve or restore the generated secret after it is created. Copy secret key
  5. After the secret key is generated, you can reset it by clicking the Reset Secret button. Reset secret Button

    Resetting this code will break the previously functioning embedded reports.

What is the embed URL format?

A Bold Reports® embed URL signed with the secret key uses the following format: {report URL}?{embed parameters}&embed_signature={signature}

Example: http://localhost:51778/reporting/en-us/site/site1/reports/5ff24040-cd74-42cf-a168-57f8cb7dafed/Sample%20Reports/Invoice?embed_nonce=3e253410-1a82-4fb3-a337-122a8007dafc&[email protected]&embed_report_views_edit=true&embed_report_views=true &embed_report_export=true&embed_report_comments=true&embed_timestamp=1583928213&embed_expirationtime=100 &embed_signature=W1oqFY6MvJ2lxCwCwLHWihSd19jPfzr

The following table describes the parts of the URL.

Parameter Description
report URL URL of the report to be embedded.
embed parameters Parameters required to embedding the report with SSO.
signature Authorized key for the report to be embedded.

Parameters to generate the signature in the embed URL

Bold Reports® Report Server needs the following values to form the embed signature.

Parameter Mandatory Description Example

embed_nonce

 Yes A random string serves to restrict the URL reconstruction or attacks from the hackers.

5ff24040-cd74-42cf-a168-57f8cb7dafed

embed_user_email

 Yes The email address of the user.

[email protected]

embed_report_views

 No Use this value to check the views in the embedded report. true

embed_report_views_edit

 No This value enables you to perform actions such as saving a view, updating a view, and deleting views in the embedded report. true

embed_report_export

 No The export option for various formats of the report in the embedded report is displayed based on this value. true

embed_report_comments

 No Actions related to comments, such as post, edit, delete, reply, watch, unwatch, posting the image and user mention list options can be performed in report based on this value. true

embed_timestamp

 Yes The current time is represented as a UNIX timestamp. The embedded URL that is formed will be valid for 5 minutes from this embed timestamp.

1583934776

embed_expirationtime

 No Set the duration for the token to remain active. It must be represented in seconds. The default time is 86400 seconds, and the maximum is 604800 seconds.

604800

extended_attribute

 No Passes custom attributes to the report. The value must be a Base64-encoded JSON object. Custom attributes can be accessed in report expressions at runtime.

Custom Attribute JSON (Base64 Encoded)

parameter

 No Passes report parameter values to the report. The value must be a Base64-encoded JSON array containing the report parameter definitions and values.

Report Parameter JSON (Base64 Encoded)

Extended Attribute Example

The extended_attribute value in a Bold Reports® embed URL is a Base64-encoded JSON object, as in this example.

JSON:

{"AttributeName":"value1","attributeName2":"value2"}

Equivalent Base64 value:

eyJBdHRyaWJ1dGVOYW1lIjoidmFsdWUxIiwiYXR0cmlidXRlTmFtZTIiOiJ2YWx1ZTIifQ==

Parameter Example

The parameter value in a Bold Reports® embed URL is a Base64-encoded JSON array of report parameter definitions and values, as in this example.

JSON:

[{"name": "SalesOrderNumber","labels": ["SO50752"],"prompt": "Sales Order No:","values": ["SO50752"],"nullable": false}]

Equivalent Base64 value:

W3sibmFtZSI6ICJTYWxlc09yZGVyTnVtYmVyIiwibGFiZWxzIjogWyJTTzUwNzUyIl0sInByb21wdCI6ICJTYWxlcyBPcmRlciBObzoiLCJ2YWx1ZXMiOiBbIlNPNTA3NTIiXSwibnVsbGFibGUiOiBmYWxzZX1d

Generating the signature for the embed URL

Bold Reports® Report Server authenticates the embedded URL with the embed_signature value, described in the following table.

embed_signature

 Yes A signature is generated using the secret code to authenticate the embedded URL.

W1oqFY6MvJ2lxCwCwLHWihSd 19jPfzr

Form the embed parameter in the following format.

embed_nonce=5ff24040-cd74-42cf-a168-57f8cb7dafed&[email protected]&embed_report_views_edit=true&embed_report_views=true&embed_report _export=true &embed_report _comments=true& &embed_timestamp=1583935418&embed_expirationtime=100

The embed parameter formed above is signed with the secret code generated on the Bold Reports® server using the HMACSHA256 algorithm. The resulting signed key is appended to the embed URL as embed_signature.

Sample to Embed Report Using SSO Authentication

You can download a Bold Reports® sample that embeds a report using SSO authentication from the Syncfusion® download page.

Frequently asked questions

Can I recover a lost embed secret key?

No. You cannot retrieve or restore the generated secret after it is created. You can reset it with the Reset Secret button, but resetting breaks previously functioning embedded reports.

How long is a signed embed URL valid?

The embedded URL is valid for 5 minutes from the embed_timestamp value.

Which algorithm signs the embed parameters?

The embed parameters are signed with the secret code using the HMACSHA256 algorithm.

See also