Customer Accounts Report

I am on security doubt on how to design a report that must show the accounts
of a customer.
I have an aspx page showing the customer info , then he must push a button a
see its accounts on a report generated by Reporting Services.
Obviously the report can not be accesed via a Customer parameters because
another users could see any customer 's accounts.
How can i solve it.
I am thinking in generating a temp table with a random id an pass it by
parameter, but it is only so as to reduce an intruder access.
ThanksHi Fernando,
If you are using ASP.NET you have more than one option:
1.- Storing in Sessions variables
2.- Using QueryString
3.- Using Server side code (static variables)
4.- Change the report viewer (passsing SOAP params)
The fact is the report params does not to be part of the URL you can easily
hide them using multiples techniques, depends how your app is designed you
may use some of them.
Thanks
Jerry
--
You can use this example to show you how to call the report params.
http://www.rdlcomponents.com/ASPExamples/Default.aspx?sm=b1_a
"Fernando Hunth" wrote:
> I am on security doubt on how to design a report that must show the accounts
> of a customer.
> I have an aspx page showing the customer info , then he must push a button a
> see its accounts on a report generated by Reporting Services.
> Obviously the report can not be accesed via a Customer parameters because
> another users could see any customer 's accounts.
> How can i solve it.
> I am thinking in generating a temp table with a random id an pass it by
> parameter, but it is only so as to reduce an intruder access.
> Thanks|||Thats true we have multiples techniques to pass parameters but not to avoid
access to those public parameters.
When a report is deployed , anyone (authenticated) can access to the report
and can access a report via URL and with the posibility of changing any
parameter value via URL.
That 's what i want to avoid. I am trying to investigate doing it with a
DataProcessingExtension
Thanks.
"Jerry" wrote:
> Hi Fernando,
> If you are using ASP.NET you have more than one option:
> 1.- Storing in Sessions variables
> 2.- Using QueryString
> 3.- Using Server side code (static variables)
> 4.- Change the report viewer (passsing SOAP params)
> The fact is the report params does not to be part of the URL you can easily
> hide them using multiples techniques, depends how your app is designed you
> may use some of them.
> Thanks
> Jerry
> --
> You can use this example to show you how to call the report params.
> http://www.rdlcomponents.com/ASPExamples/Default.aspx?sm=b1_a
> "Fernando Hunth" wrote:
> > I am on security doubt on how to design a report that must show the accounts
> > of a customer.
> > I have an aspx page showing the customer info , then he must push a button a
> > see its accounts on a report generated by Reporting Services.
> > Obviously the report can not be accesed via a Customer parameters because
> > another users could see any customer 's accounts.
> > How can i solve it.
> >
> > I am thinking in generating a temp table with a random id an pass it by
> > parameter, but it is only so as to reduce an intruder access.
> >
> > Thanks|||Check out this link:
http://www.codeproject.com/useritems/SQLRSViewer.asp#TheCodeBehind
It's an ASP.NET app that lets you recreate the entire look of the report
viewer. It also give you flexibilty in what you feed the report.
I was able to use this program and feed in my own parameters. The report
will display and no parameters are visible in the URL.
Look for the variable 'reportParameterValues2' in the code. It's a array
that stores the parameters for your report.
Hope this helps, or at least gets you started.
"Fernando Hunth" wrote:
> Thats true we have multiples techniques to pass parameters but not to avoid
> access to those public parameters.
> When a report is deployed , anyone (authenticated) can access to the report
> and can access a report via URL and with the posibility of changing any
> parameter value via URL.
> That 's what i want to avoid. I am trying to investigate doing it with a
> DataProcessingExtension
> Thanks.
>
> "Jerry" wrote:
> > Hi Fernando,
> >
> > If you are using ASP.NET you have more than one option:
> >
> > 1.- Storing in Sessions variables
> > 2.- Using QueryString
> > 3.- Using Server side code (static variables)
> > 4.- Change the report viewer (passsing SOAP params)
> >
> > The fact is the report params does not to be part of the URL you can easily
> > hide them using multiples techniques, depends how your app is designed you
> > may use some of them.
> >
> > Thanks
> > Jerry
> > --
> > You can use this example to show you how to call the report params.
> > http://www.rdlcomponents.com/ASPExamples/Default.aspx?sm=b1_a
> >
> > "Fernando Hunth" wrote:
> >
> > > I am on security doubt on how to design a report that must show the accounts
> > > of a customer.
> > > I have an aspx page showing the customer info , then he must push a button a
> > > see its accounts on a report generated by Reporting Services.
> > > Obviously the report can not be accesed via a Customer parameters because
> > > another users could see any customer 's accounts.
> > > How can i solve it.
> > >
> > > I am thinking in generating a temp table with a random id an pass it by
> > > parameter, but it is only so as to reduce an intruder access.
> > >
> > > Thanks|||Yes, i previously took a look a this project, but that is another client
solution wher you can pass parameters to a public report.
"Hausbro" wrote:
> Check out this link:
> http://www.codeproject.com/useritems/SQLRSViewer.asp#TheCodeBehind
> It's an ASP.NET app that lets you recreate the entire look of the report
> viewer. It also give you flexibilty in what you feed the report.
> I was able to use this program and feed in my own parameters. The report
> will display and no parameters are visible in the URL.
> Look for the variable 'reportParameterValues2' in the code. It's a array
> that stores the parameters for your report.
> Hope this helps, or at least gets you started.
> "Fernando Hunth" wrote:
> > Thats true we have multiples techniques to pass parameters but not to avoid
> > access to those public parameters.
> > When a report is deployed , anyone (authenticated) can access to the report
> > and can access a report via URL and with the posibility of changing any
> > parameter value via URL.
> > That 's what i want to avoid. I am trying to investigate doing it with a
> > DataProcessingExtension
> >
> > Thanks.
> >
> >
> >
> > "Jerry" wrote:
> >
> > > Hi Fernando,
> > >
> > > If you are using ASP.NET you have more than one option:
> > >
> > > 1.- Storing in Sessions variables
> > > 2.- Using QueryString
> > > 3.- Using Server side code (static variables)
> > > 4.- Change the report viewer (passsing SOAP params)
> > >
> > > The fact is the report params does not to be part of the URL you can easily
> > > hide them using multiples techniques, depends how your app is designed you
> > > may use some of them.
> > >
> > > Thanks
> > > Jerry
> > > --
> > > You can use this example to show you how to call the report params.
> > > http://www.rdlcomponents.com/ASPExamples/Default.aspx?sm=b1_a
> > >
> > > "Fernando Hunth" wrote:
> > >
> > > > I am on security doubt on how to design a report that must show the accounts
> > > > of a customer.
> > > > I have an aspx page showing the customer info , then he must push a button a
> > > > see its accounts on a report generated by Reporting Services.
> > > > Obviously the report can not be accesed via a Customer parameters because
> > > > another users could see any customer 's accounts.
> > > > How can i solve it.
> > > >
> > > > I am thinking in generating a temp table with a random id an pass it by
> > > > parameter, but it is only so as to reduce an intruder access.
> > > >
> > > > Thanks|||Ok.
I decided to write some sample code for the solution i was thinking about
generating a temp table with a random id an pass it by
parameter, or something like this.
I 'll publish it in somewhere.
I 'll go on writing on my blog
http://msdevelopers.blogspot.com/2005/03/reporting-services-filtering.html
Fernando Hunth
Senior Developer
Huddle Group S.A.
fernando@.huddle.com.ar
Huddle Group S.A. | Enterprise Technology Services
Microsoft Certified Partner
Ciudad de Buenos Aires · Argentina
www.huddle.com.ar
"Fernando Hunth" wrote:
> I am on security doubt on how to design a report that must show the accounts
> of a customer.
> I have an aspx page showing the customer info , then he must push a button a
> see its accounts on a report generated by Reporting Services.
> Obviously the report can not be accesed via a Customer parameters because
> another users could see any customer 's accounts.
> How can i solve it.
> I am thinking in generating a temp table with a random id an pass it by
> parameter, but it is only so as to reduce an intruder access.
> Thanks

Custom PDF export...

Group...
I have a requirement to add a custom button to an ASPX 'View PDF'. When the
user clicks this button a specific SSRS report will be returned (Open/Save)
as a pdf. I need to be able to do this without using the MS Sample Report
Viewer control (which has the 'Select a format, Export' option just like in
Report Manager).
From what I have read there may be a call that can be made to the RS Web
Service, is this true and if so, is this the only way to accomplish a PDF
export.
Thanks in advance everyone.I have same case as yours, and I am using web service call to accomplish
this. I dont know if there is another way but using RS web service is quite
easy. If you need further information or sample code drop a message.
Regards
"Terry Mulvany" <terry.mulvany@.rouseservices.com> wrote in message
news:eHXMZx92EHA.1452@.TK2MSFTNGP11.phx.gbl...
> Group...
> I have a requirement to add a custom button to an ASPX 'View PDF'. When
the
> user clicks this button a specific SSRS report will be returned
(Open/Save)
> as a pdf. I need to be able to do this without using the MS Sample Report
> Viewer control (which has the 'Select a format, Export' option just like
in
> Report Manager).
> From what I have read there may be a call that can be made to the RS Web
> Service, is this true and if so, is this the only way to accomplish a PDF
> export.
> Thanks in advance everyone.
>|||Do you have a sample link handy?
Thanks so much.
"saglamtimur" <bsaglamtimur@.mayanet.com.tr> wrote in message
news:ul5ho$92EHA.2540@.TK2MSFTNGP09.phx.gbl...
>I have same case as yours, and I am using web service call to accomplish
> this. I dont know if there is another way but using RS web service is
> quite
> easy. If you need further information or sample code drop a message.
> Regards
>
> "Terry Mulvany" <terry.mulvany@.rouseservices.com> wrote in message
> news:eHXMZx92EHA.1452@.TK2MSFTNGP11.phx.gbl...
>> Group...
>> I have a requirement to add a custom button to an ASPX 'View PDF'. When
> the
>> user clicks this button a specific SSRS report will be returned
> (Open/Save)
>> as a pdf. I need to be able to do this without using the MS Sample Report
>> Viewer control (which has the 'Select a format, Export' option just like
> in
>> Report Manager).
>> From what I have read there may be a call that can be made to the RS Web
>> Service, is this true and if so, is this the only way to accomplish a PDF
>> export.
>> Thanks in advance everyone.
>>
>|||My custemer can chose which format to download. I have a sub that accepts
mime type, so I can pass render format to sub, and use one sub for all
formats.
First you must add web referance to ReportService.
Here is the code;
Private Sub renderdoc(ByVal mime As String)
Dim mime_type As String
Dim filename As String
Select Case mime
Case "pdf"
mime_type = "application/pdf"
filename = "fiyatlistesi.pdf"
Case "Excel"
mime_type = "application/x-msexcel"
filename = "fiyatlistesi.xls"
Case "xml"
mime_type = "application/xml"
filename = "fiyatlistesi.xml"
Case Else
mime_type = "application/pdf"
filename = "fiyatlistesi.pdf"
End Select
Dim report As Byte() = Nothing
Dim rs As localhost.ReportingService = New
localhost.ReportingService
'login details comes here
rs.Credentials = New
System.Net.NetworkCredential("raport_user_name_here", "password_here")
rs.PreAuthenticate = True
'report path here, I have a report named fiyat.rdl
Dim reportPath As String = "/rapor/fiyat"
Dim format As String = mime
Dim devInfo As String = _
"<DeviceInfo>" + _
"<Toolbar>False</Toolbar>" + _
"<Parameters>False</Parameters>" + _
"<DocMap>True</DocMap>" + _
"<Zoom>100</Zoom>" + _
"</DeviceInfo>"
Dim historyID As String = Nothing
'I have 3 report parameters, I define them here
Dim parameters(2) As localhost.ParameterValue
Dim paramValue As localhost.ParameterValue = New
localhost.ParameterValue
'First param name is cari_isim (ok its in Turkish)
paramValue.Name = "cari_isim"
paramValue.Value = textbox1.text
parameters(0) = paramValue
'second here
paramValue = New localhost.ParameterValue
paramValue.Name = "fiyatgrup"
paramValue.Value = textbox2.text
parameters(1) = paramValue
'third here
paramValue = New localhost.ParameterValue
paramValue.Name = "urunler"
paramValue.Value = dropdownlist1.selecteditem.value
parameters(2) = paramValue
Dim credentials() As localhost.DataSourceCredentials = Nothing
Dim showHideToggle As String = Nothing
Dim encoding As String
Dim mimeType As String
Dim warnings() As localhost.Warning = Nothing
Dim reportHistoryParameters() As localhost.ParameterValue = Nothing
Dim streamIDs() As String = Nothing
Dim sh As localhost.SessionHeader = New localhost.SessionHeader
rs.SessionHeaderValue = sh
Try
report = rs.Render(reportPath, format, historyID, _
devInfo, parameters, credentials, _
showHideToggle, encoding, mimeType, _
reportHistoryParameters, warnings, _
streamIDs)
sh.SessionId = rs.SessionHeaderValue.SessionId
Response.Clear()
HttpContext.Current.Response.ClearHeaders()
HttpContext.Current.Response.ClearContent()
HttpContext.Current.Response.ContentType = mime_type
HttpContext.Current.Response.AddHeader("Content-disposition",
"attachment; filename=" + filename + "")
HttpContext.Current.Response.BinaryWrite(report)
HttpContext.Current.Response.Flush()
HttpContext.Current.Response.End()
Catch ex As Exception
If ex.Message <> "Thread was being aborted." Then
HttpContext.Current.Response.ClearHeaders()
HttpContext.Current.Response.ClearContent()
HttpContext.Current.Response.ContentType = "text/html"
HttpContext.Current.Response.Write( _
"&

---

Error" & _
ex.Message & "

---

")
HttpContext.Current.Response.End()
End If
End Try
End Sub
Hope works for you.
Regards
"Terry Mulvany" <terry.mulvany@.rouseservices.com> wrote in message
news:#yYGGv#2EHA.1264@.TK2MSFTNGP12.phx.gbl...
> Do you have a sample link handy?
> Thanks so much.
> "saglamtimur" <bsaglamtimur@.mayanet.com.tr> wrote in message
> news:ul5ho$92EHA.2540@.TK2MSFTNGP09.phx.gbl...
> >I have same case as yours, and I am using web service call to accomplish
> > this. I dont know if there is another way but using RS web service is
> > quite
> > easy. If you need further information or sample code drop a message.
> >
> > Regards
> >
> >
> >
> > "Terry Mulvany" <terry.mulvany@.rouseservices.com> wrote in message
> > news:eHXMZx92EHA.1452@.TK2MSFTNGP11.phx.gbl...
> >> Group...
> >> I have a requirement to add a custom button to an ASPX 'View PDF'. When
> > the
> >> user clicks this button a specific SSRS report will be returned
> > (Open/Save)
> >> as a pdf. I need to be able to do this without using the MS Sample
Report
> >> Viewer control (which has the 'Select a format, Export' option just
like
> > in
> >> Report Manager).
> >>
> >> From what I have read there may be a call that can be made to the RS
Web
> >> Service, is this true and if so, is this the only way to accomplish a
PDF
> >> export.
> >>
> >> Thanks in advance everyone.
> >>
> >>
> >
> >
>|||In the URL for the report you can specify the Render property for whatever
output you wish. The following (part) URLs demonstrate this. I have a number
of buttons on my asps, that allow the user to output directly to XL, PDF or
the standard RS report page, by using the following::
NOTE: I use javascript to create the link and then open a new results window
at this point::
function GET_RS(aFormat)
{
var sReportName="myReport1";
if(aFormat=="EXCEL"){sReportName="ReportRS1XL";GET_HELP('XL')}
if(aFormat=="PDF"){sReportName="ReportRS1";GET_HELP('PD')}
HLINK = HLINK + "http://myServer/ReportServer"
HLINK = HLINK + "?%2fBaanReports%2f"+sReportName HLINK = HLINK +
"&rs%3aClearSession=true"
HLINK = HLINK + "&rs%3aCommand=Render"
HLINK = HLINK + "&rs%3aFormat=" + aFormat
.....
....
}
This blows through the standard RS page, where the user then has to select
the output format and click the Export link.
Hope this helps
Tony
"Terry Mulvany" wrote:
> Group...
> I have a requirement to add a custom button to an ASPX 'View PDF'. When the
> user clicks this button a specific SSRS report will be returned (Open/Save)
> as a pdf. I need to be able to do this without using the MS Sample Report
> Viewer control (which has the 'Select a format, Export' option just like in
> Report Manager).
> From what I have read there may be a call that can be made to the RS Web
> Service, is this true and if so, is this the only way to accomplish a PDF
> export.
> Thanks in advance everyone.
>
>

custom code + delegation = problem...

Hi,
I have a custom aspx page which access RS (Reporting Services) using the
webservice interface.
I'm using the delegation (defautcredentialcache) to send the user
authentication to RS.
RS and my web application are on the same server.
this works fine in 2 cases:
* NT authentication used in both virtual directories (/reportserver & /
mycustomapp)
* Basic authentication used for /mycustomapp but NT authentication for
/reportserver
But I want to setup the Basic authentication for both the /reportserver & /
mycustomapp virtual folders.
I don't understand why using the default credential cache doesn't works.
my current work around is to detect if I'm in Basic authentication mode,
then a create a networkcredential object base on the current user login &
password.
does it a RS related issue? or an ASP.Net one?Hello,
I've had issues with webservices and credential delegation many times.
I have a quick article I wrote here that may help. If not let me know and
I can try to help out.
article http://www.criticalsites.com/dlaflotte/default.aspx?date=2004-08-31
Good Luck,
Duane
Duane Laflotte
MCSE, MCSD, MCDBA, MCSA, MCT, MCP+I
dlaflotte@.criticalsites.com
http://www.criticalsites.com/dlaflotte
"Jéjé" <willgart_A_@.hotmail_A_.com> wrote in message
news:%23wKtYcOcFHA.3492@.TK2MSFTNGP14.phx.gbl...
> Hi,
> I have a custom aspx page which access RS (Reporting Services) using the
> webservice interface.
> I'm using the delegation (defautcredentialcache) to send the user
> authentication to RS.
> RS and my web application are on the same server.
> this works fine in 2 cases:
> * NT authentication used in both virtual directories (/reportserver & /
> mycustomapp)
> * Basic authentication used for /mycustomapp but NT authentication for
> /reportserver
> But I want to setup the Basic authentication for both the /reportserver &
/
> mycustomapp virtual folders.
> I don't understand why using the default credential cache doesn't works.
> my current work around is to detect if I'm in Basic authentication mode,
> then a create a networkcredential object base on the current user login &
> password.
> does it a RS related issue? or an ASP.Net one?
>|||mmm
I allready have tested this without more success.
now the only problem I have is this:
* Frontend custom app using Basic authentication
* Reportserver using both NTLM & Basic authentication
in this case, I send the username + password of the active user, but I
receive a permission error!
I think the system try to use the integrated security...
"Duane Laflotte" <dlaflotte@.criticalsites.com> wrote in message
news:O$tSasOcFHA.3712@.TK2MSFTNGP09.phx.gbl...
> Hello,
> I've had issues with webservices and credential delegation many times.
> I have a quick article I wrote here that may help. If not let me know
> and
> I can try to help out.
> article
> http://www.criticalsites.com/dlaflotte/default.aspx?date=2004-08-31
> Good Luck,
> Duane
>
> --
> Duane Laflotte
> MCSE, MCSD, MCDBA, MCSA, MCT, MCP+I
> dlaflotte@.criticalsites.com
> http://www.criticalsites.com/dlaflotte
>
> "Jéjé" <willgart_A_@.hotmail_A_.com> wrote in message
> news:%23wKtYcOcFHA.3492@.TK2MSFTNGP14.phx.gbl...
>> Hi,
>> I have a custom aspx page which access RS (Reporting Services) using the
>> webservice interface.
>> I'm using the delegation (defautcredentialcache) to send the user
>> authentication to RS.
>> RS and my web application are on the same server.
>> this works fine in 2 cases:
>> * NT authentication used in both virtual directories (/reportserver & /
>> mycustomapp)
>> * Basic authentication used for /mycustomapp but NT authentication for
>> /reportserver
>> But I want to setup the Basic authentication for both the /reportserver &
> /
>> mycustomapp virtual folders.
>> I don't understand why using the default credential cache doesn't works.
>> my current work around is to detect if I'm in Basic authentication mode,
>> then a create a networkcredential object base on the current user login &
>> password.
>> does it a RS related issue? or an ASP.Net one?
>>
>|||If the front end server is using basic auth, are you capturing the user name
and password from that and passing those in your NetworkCredential object or
are you using DefaultCredentials?
Joe K.
"Jéjé" <willgart_A_@.hotmail_A_.com> wrote in message
news:uxrxFQZdFHA.1036@.tk2msftngp13.phx.gbl...
> mmm
> I allready have tested this without more success.
> now the only problem I have is this:
> * Frontend custom app using Basic authentication
> * Reportserver using both NTLM & Basic authentication
> in this case, I send the username + password of the active user, but I
> receive a permission error!
> I think the system try to use the integrated security...
> "Duane Laflotte" <dlaflotte@.criticalsites.com> wrote in message
> news:O$tSasOcFHA.3712@.TK2MSFTNGP09.phx.gbl...
>> Hello,
>> I've had issues with webservices and credential delegation many
>> times.
>> I have a quick article I wrote here that may help. If not let me know
>> and
>> I can try to help out.
>> article
>> http://www.criticalsites.com/dlaflotte/default.aspx?date=2004-08-31
>> Good Luck,
>> Duane
>>
>> --
>> Duane Laflotte
>> MCSE, MCSD, MCDBA, MCSA, MCT, MCP+I
>> dlaflotte@.criticalsites.com
>> http://www.criticalsites.com/dlaflotte
>>
>> "Jéjé" <willgart_A_@.hotmail_A_.com> wrote in message
>> news:%23wKtYcOcFHA.3492@.TK2MSFTNGP14.phx.gbl...
>> Hi,
>> I have a custom aspx page which access RS (Reporting Services) using the
>> webservice interface.
>> I'm using the delegation (defautcredentialcache) to send the user
>> authentication to RS.
>> RS and my web application are on the same server.
>> this works fine in 2 cases:
>> * NT authentication used in both virtual directories (/reportserver & /
>> mycustomapp)
>> * Basic authentication used for /mycustomapp but NT authentication for
>> /reportserver
>> But I want to setup the Basic authentication for both the /reportserver
>> &
>> /
>> mycustomapp virtual folders.
>> I don't understand why using the default credential cache doesn't works.
>> my current work around is to detect if I'm in Basic authentication mode,
>> then a create a networkcredential object base on the current user login
>> &
>> password.
>> does it a RS related issue? or an ASP.Net one?
>>
>>
>|||yes.
Dim header As String = Page.Request.ServerVariables("HTTP_AUTHORIZATION")
If header.StartsWith("Basic") Or header = "" Then
oServ.Credentials = New
Net.NetworkCredential(Page.Request.ServerVariables("AUTH_USER"),
Page.Request.ServerVariables("AUTH_PASSWORD"))
Else
oServ.PreAuthenticate = True
oServ.Credentials = Net.CredentialCache.DefaultCredentials
End If
I have also tried with PreAuthenticate = true with basic authentication.
This code works fine if integrated security is disabled for the reportserver
virtual folder (so both web sites used the same security model)
There is a way to force the preferred authentication method used when I call
the webservice?
"Joe Kaplan (MVP - ADSI)" <joseph.e.kaplan@.removethis.accenture.com> wrote
in message news:%23mxnFAadFHA.1448@.TK2MSFTNGP14.phx.gbl...
> If the front end server is using basic auth, are you capturing the user
> name and password from that and passing those in your NetworkCredential
> object or are you using DefaultCredentials?
> Joe K.
> "Jéjé" <willgart_A_@.hotmail_A_.com> wrote in message
> news:uxrxFQZdFHA.1036@.tk2msftngp13.phx.gbl...
>> mmm
>> I allready have tested this without more success.
>> now the only problem I have is this:
>> * Frontend custom app using Basic authentication
>> * Reportserver using both NTLM & Basic authentication
>> in this case, I send the username + password of the active user, but I
>> receive a permission error!
>> I think the system try to use the integrated security...
>> "Duane Laflotte" <dlaflotte@.criticalsites.com> wrote in message
>> news:O$tSasOcFHA.3712@.TK2MSFTNGP09.phx.gbl...
>> Hello,
>> I've had issues with webservices and credential delegation many
>> times.
>> I have a quick article I wrote here that may help. If not let me know
>> and
>> I can try to help out.
>> article
>> http://www.criticalsites.com/dlaflotte/default.aspx?date=2004-08-31
>> Good Luck,
>> Duane
>>
>> --
>> Duane Laflotte
>> MCSE, MCSD, MCDBA, MCSA, MCT, MCP+I
>> dlaflotte@.criticalsites.com
>> http://www.criticalsites.com/dlaflotte
>>
>> "Jéjé" <willgart_A_@.hotmail_A_.com> wrote in message
>> news:%23wKtYcOcFHA.3492@.TK2MSFTNGP14.phx.gbl...
>> Hi,
>> I have a custom aspx page which access RS (Reporting Services) using
>> the
>> webservice interface.
>> I'm using the delegation (defautcredentialcache) to send the user
>> authentication to RS.
>> RS and my web application are on the same server.
>> this works fine in 2 cases:
>> * NT authentication used in both virtual directories (/reportserver & /
>> mycustomapp)
>> * Basic authentication used for /mycustomapp but NT authentication for
>> /reportserver
>> But I want to setup the Basic authentication for both the /reportserver
>> &
>> /
>> mycustomapp virtual folders.
>> I don't understand why using the default credential cache doesn't
>> works.
>> my current work around is to detect if I'm in Basic authentication
>> mode,
>> then a create a networkcredential object base on the current user login
>> &
>> password.
>> does it a RS related issue? or an ASP.Net one?
>>
>>
>>
>|||As far as I know you can't force the client to only do one authentication
method, but I could be wrong. Typically, the client and server will
negotiate based on what the server accepts and the client can provide.
What happens if you specify a domain in the NetworkCredential (or does the
AUTH_USER header already have a domain name like "domain\user" or a upn like
user@.domain.com?)?
Joe K.
"Jéjé" <willgart_A_@.hotmail_A_.com> wrote in message
news:eHVxsjadFHA.2556@.TK2MSFTNGP10.phx.gbl...
> yes.
> Dim header As String = Page.Request.ServerVariables("HTTP_AUTHORIZATION")
> If header.StartsWith("Basic") Or header = "" Then
> oServ.Credentials = New
> Net.NetworkCredential(Page.Request.ServerVariables("AUTH_USER"),
> Page.Request.ServerVariables("AUTH_PASSWORD"))
> Else
> oServ.PreAuthenticate = True
> oServ.Credentials = Net.CredentialCache.DefaultCredentials
> End If
>
> I have also tried with PreAuthenticate = true with basic authentication.
> This code works fine if integrated security is disabled for the
> reportserver virtual folder (so both web sites used the same security
> model)
> There is a way to force the preferred authentication method used when I
> call the webservice?
>
> "Joe Kaplan (MVP - ADSI)" <joseph.e.kaplan@.removethis.accenture.com> wrote
> in message news:%23mxnFAadFHA.1448@.TK2MSFTNGP14.phx.gbl...
>> If the front end server is using basic auth, are you capturing the user
>> name and password from that and passing those in your NetworkCredential
>> object or are you using DefaultCredentials?
>> Joe K.
>> "Jéjé" <willgart_A_@.hotmail_A_.com> wrote in message
>> news:uxrxFQZdFHA.1036@.tk2msftngp13.phx.gbl...
>> mmm
>> I allready have tested this without more success.
>> now the only problem I have is this:
>> * Frontend custom app using Basic authentication
>> * Reportserver using both NTLM & Basic authentication
>> in this case, I send the username + password of the active user, but I
>> receive a permission error!
>> I think the system try to use the integrated security...
>> "Duane Laflotte" <dlaflotte@.criticalsites.com> wrote in message
>> news:O$tSasOcFHA.3712@.TK2MSFTNGP09.phx.gbl...
>> Hello,
>> I've had issues with webservices and credential delegation many
>> times.
>> I have a quick article I wrote here that may help. If not let me know
>> and
>> I can try to help out.
>> article
>> http://www.criticalsites.com/dlaflotte/default.aspx?date=2004-08-31
>> Good Luck,
>> Duane
>>
>> --
>> Duane Laflotte
>> MCSE, MCSD, MCDBA, MCSA, MCT, MCP+I
>> dlaflotte@.criticalsites.com
>> http://www.criticalsites.com/dlaflotte
>>
>> "Jéjé" <willgart_A_@.hotmail_A_.com> wrote in message
>> news:%23wKtYcOcFHA.3492@.TK2MSFTNGP14.phx.gbl...
>> Hi,
>> I have a custom aspx page which access RS (Reporting Services) using
>> the
>> webservice interface.
>> I'm using the delegation (defautcredentialcache) to send the user
>> authentication to RS.
>> RS and my web application are on the same server.
>> this works fine in 2 cases:
>> * NT authentication used in both virtual directories (/reportserver &
>> /
>> mycustomapp)
>> * Basic authentication used for /mycustomapp but NT authentication for
>> /reportserver
>> But I want to setup the Basic authentication for both the
>> /reportserver &
>> /
>> mycustomapp virtual folders.
>> I don't understand why using the default credential cache doesn't
>> works.
>> my current work around is to detect if I'm in Basic authentication
>> mode,
>> then a create a networkcredential object base on the current user
>> login &
>> password.
>> does it a RS related issue? or an ASP.Net one?
>>
>>
>>
>>
>|||the domain is allready in the auth_user variable.
well... nothing works, so I'm using my workaround.
which is creating a second "reportserver" virtual folder, where only basic
authentication is used, and then there is no problems.
I think RS prefer to use the NT authentication instead-of the basic
authentication.
"Joe Kaplan (MVP - ADSI)" <joseph.e.kaplan@.removethis.accenture.com> wrote
in message news:uwPu75adFHA.4040@.TK2MSFTNGP14.phx.gbl...
> As far as I know you can't force the client to only do one authentication
> method, but I could be wrong. Typically, the client and server will
> negotiate based on what the server accepts and the client can provide.
> What happens if you specify a domain in the NetworkCredential (or does the
> AUTH_USER header already have a domain name like "domain\user" or a upn
> like user@.domain.com?)?
> Joe K.
> "Jéjé" <willgart_A_@.hotmail_A_.com> wrote in message
> news:eHVxsjadFHA.2556@.TK2MSFTNGP10.phx.gbl...
>> yes.
>> Dim header As String = Page.Request.ServerVariables("HTTP_AUTHORIZATION")
>> If header.StartsWith("Basic") Or header = "" Then
>> oServ.Credentials = New
>> Net.NetworkCredential(Page.Request.ServerVariables("AUTH_USER"),
>> Page.Request.ServerVariables("AUTH_PASSWORD"))
>> Else
>> oServ.PreAuthenticate = True
>> oServ.Credentials = Net.CredentialCache.DefaultCredentials
>> End If
>>
>> I have also tried with PreAuthenticate = true with basic authentication.
>> This code works fine if integrated security is disabled for the
>> reportserver virtual folder (so both web sites used the same security
>> model)
>> There is a way to force the preferred authentication method used when I
>> call the webservice?
>>
>> "Joe Kaplan (MVP - ADSI)" <joseph.e.kaplan@.removethis.accenture.com>
>> wrote in message news:%23mxnFAadFHA.1448@.TK2MSFTNGP14.phx.gbl...
>> If the front end server is using basic auth, are you capturing the user
>> name and password from that and passing those in your NetworkCredential
>> object or are you using DefaultCredentials?
>> Joe K.
>> "Jéjé" <willgart_A_@.hotmail_A_.com> wrote in message
>> news:uxrxFQZdFHA.1036@.tk2msftngp13.phx.gbl...
>> mmm
>> I allready have tested this without more success.
>> now the only problem I have is this:
>> * Frontend custom app using Basic authentication
>> * Reportserver using both NTLM & Basic authentication
>> in this case, I send the username + password of the active user, but I
>> receive a permission error!
>> I think the system try to use the integrated security...
>> "Duane Laflotte" <dlaflotte@.criticalsites.com> wrote in message
>> news:O$tSasOcFHA.3712@.TK2MSFTNGP09.phx.gbl...
>> Hello,
>> I've had issues with webservices and credential delegation many
>> times.
>> I have a quick article I wrote here that may help. If not let me
>> know and
>> I can try to help out.
>> article
>> http://www.criticalsites.com/dlaflotte/default.aspx?date=2004-08-31
>> Good Luck,
>> Duane
>>
>> --
>> Duane Laflotte
>> MCSE, MCSD, MCDBA, MCSA, MCT, MCP+I
>> dlaflotte@.criticalsites.com
>> http://www.criticalsites.com/dlaflotte
>>
>> "Jéjé" <willgart_A_@.hotmail_A_.com> wrote in message
>> news:%23wKtYcOcFHA.3492@.TK2MSFTNGP14.phx.gbl...
>> Hi,
>> I have a custom aspx page which access RS (Reporting Services) using
>> the
>> webservice interface.
>> I'm using the delegation (defautcredentialcache) to send the user
>> authentication to RS.
>> RS and my web application are on the same server.
>> this works fine in 2 cases:
>> * NT authentication used in both virtual directories (/reportserver &
>> /
>> mycustomapp)
>> * Basic authentication used for /mycustomapp but NT authentication
>> for
>> /reportserver
>> But I want to setup the Basic authentication for both the
>> /reportserver &
>> /
>> mycustomapp virtual folders.
>> I don't understand why using the default credential cache doesn't
>> works.
>> my current work around is to detect if I'm in Basic authentication
>> mode,
>> then a create a networkcredential object base on the current user
>> login &
>> password.
>> does it a RS related issue? or an ASP.Net one?
>>
>>
>>
>>
>>
>