At a client site, images in a report raised a set of security-related questions. The report we were asked to modify required a signature to be displayed on the page. The customer wanted the signature of the user running the report. Users were spread over several sites with multiple users at each site. With a shared PC, we couldn’t use the system user id to restrict access to the images.

There were other complications to be resolved. Security considerations about individual signatures meant that we had to lock the image to individual users. Report delivery was via our cView report viewer. The solutions we discuss below could equally apply to Crystal Reports Server, Business Objects Enterprise or any other 3rd party report delivery. The key issue is that the users did not have access to the Crystal Reports Designer, and were using a delivery method that gave them the report to view.

Who is running the report? It was vital to have a secure way to do this. Because several users shared access and user id, it was impossible to use that approach. In the end, all the solutions required the users to enter a Personal Authentication Number (PIN) to uniquely identify them.

Why not create a report for each user? Store the image in the report for that user, and give them their own copy of the report, saved on a local drive. This would work well for sites with a couple of users. But the report was complex, we found there were several others that also needed the secure dynamic image, and there were enough users to make this impractical.

So we could take one report, save all the signatures into a section each, and use the PIN number to select which section to display. This would be manageable, but the multiple images created a single security point of failure. If someone could break in, all the signatures would be available to them.

We did consider storing the images in a database table. Everywhere we looked with this opened up major security issues. Any other database retrieval tool such as MS-Access or even Excel could extract the data and images from the table. By putting the images in a table, the security moved outside the Crystal Reports framework.

Several developer solutions presented themselves. A custom viewer, encrypted RPT files, or encryption support inside our cViewIMAGE driver all seemed too difficult and expensive.

Dynamic Images are supported in Crystal Reports XI, and our cViewIMAGE COM driver (if you are running and older version of Crystal Reports. Both of these let you change the image location at run time. The solution we selected was to store site specific images in a local secure folder. The PIN would then calculate the folder and file name to extract.

Where to store?

Crystal Reports XI includes the ability to have a dynamic image location. This is useful because it means you do not need to store your images in your database in order to display them in your report.

(If you are on an older Crystal version, you can still have that functionality by using our cViewIMAGE utility to display a dynamic image on the page. It is available for Crystal Reports 8.5 or later).

You place an image on the report and then use a formula to replace that image with another. So it is important to decide what data you store in your database to identify the image location.

One approach is to give the field a fully qualified drive and path name to the image. If you do this you need to make sure that everyone who views the report has the same drive, path and image file available to them.

A network or web folder might help here, but you need to make sure the images are always available to the report.

• Or you could use a formula and a field value to calculate the image. Perhaps take the product code and append a path and file extension to identify the image.

• You could also have a parameter in the report to point to the image folder so you could move it at some point in the future.