Custom authorization with multiple authorities

The LogonUser function takes a third parameter used to identify an
authority for the user name (I assume this is the same intention as the
realm in HTTP authentication). I assumed the idea was to allow
Reporting Services to enable log-ins from users in multiple user
databases. For example, if we are using RS to serve reports on each of
our customers' virtual web sites, then each customer has its own user
database.
The problem is, the IAuthorizationExtension interface does not use
authority strings. I assume the idea is that user names must be unique
amongst all the authorities, perhaps by adding the authority name as a
prefix (e.g., the user "bill" in the user database of customer "Acme"
might have a user name acme.bill for the purposes of authorization. I
assume further that the way this is is achieved is that, after LogonUser
is called as LogonUser("bill", password, "Acme"), then GetUserInfo
returns a userIdentity of "acme.bill" rather than plain "bill". Does
this sound plausible?I wrote:
> I
> assume further that the way this is is achieved is that, after LogonUser
> is called as LogonUser("bill", password, "Acme"), then GetUserInfo
> returns a userIdentity of "acme.bill" rather than plain "bill". Does
> this sound plausible?
After some experimentation, it seems to me that GetUserInfo is *not*
consulted when generating the ticket cookie. I guess this means I need
to feed the qualified user names in to LogonUser, and always use the
same authority string.

Custom authorization with forms authentication

We are currently implementing forms authentication in our RS deployment. The
MSDN sample helped get us started. We are now faced with the authorization
implementation.
How do I go about telling RS which user has access to which folder/report?
Telling RS which users will be administrators? Do I still get to use
role-based security and can create/edit my roles through the Report Manager
or do I need to assign indepentent permissions per user?Ray,
Yes, you would establish role-based security policies just like you would do
with Windows-based security. Your authorization extension will have the
final say if the user is authorized to perform a given action. For example,
if you need to implement role membership rules, you can change the
CheckAccess overloads to account for the addtional rights that the user will
get based on her role membership. Debugging the CheckAccess overloads should
help you clarify how this could be done.
--
Hope this helps.
----
Teo Lachev, MCSD, MCT
Author: "Microsoft Reporting Services in Action"
Publisher website: http://www.manning.com/lachev
Buy it from Amazon.com: http://shrinkster.com/eq
Home page and blog: http://www.prologika.com/
----
"RayG" <RayG@.discussions.microsoft.com> wrote in message
news:40831253-2400-44A3-8A2E-3FF9171C7510@.microsoft.com...
> We are currently implementing forms authentication in our RS deployment.
The
> MSDN sample helped get us started. We are now faced with the
authorization
> implementation.
> How do I go about telling RS which user has access to which folder/report?
> Telling RS which users will be administrators? Do I still get to use
> role-based security and can create/edit my roles through the Report
Manager
> or do I need to assign indepentent permissions per user?|||Ray,
Let me clarify. The default implementation of a custom authentication
extension as demonstrated in the MS sample relies on the role-based policies
the report administrator has established for a report item. This is very
much the same as the Windows-based role-based security the comes by default
with RS. So, for example if you have a web customer with an id of johndoe
and you want him to view a given report by URL, you can grant him Browser
permissions to that report using the Report Manager. This is pretty much all
you have to do to get John Doe set up for Forms Authentication assuming that
you "inherit" the MS sample code.
At the same time, the Forms Authentication model of RS is very flexible. For
example, it is typically impractical to create role-based security policies
for individual users, especially for Internet-facing applications. Then,
what you can do is to implement additional logic in your CheckAccess
overloads to take in consideration the application role membership your
users have.
The beauty of this model is that the authentication and authorization
implementation is totally outside the Report Server and responsibility of
your extension.
Does this all make sense now?
--
Hope this helps.
----
Teo Lachev, MCSD, MCT
Author: "Microsoft Reporting Services in Action"
Publisher website: http://www.manning.com/lachev
Buy it from Amazon.com: http://shrinkster.com/eq
Home page and blog: http://www.prologika.com/
----
"RayG" <RayG@.discussions.microsoft.com> wrote in message
news:B0C6D8D1-B26E-42FA-BB46-CF3918FB15EB@.microsoft.com...
> I think I was under the wrong impression, then.
> Instead of telling RS which user has which type of access to which
resource
> and then letting RS allow or deny access when it receives requests, seems
> like it's me who will decide whether to allow or deny, as I will be
servicing
> the security side of the requests.
> If I am correct and this is the case, how is this role-based security? I
am
> getting a resource and a user and simply responding with a "Yes" or a "No"
> based on my internal logic (security database).
> Please clarify.
> Thanks!
>
> "Teo Lachev" wrote:
> > Ray,
> >
> > Yes, you would establish role-based security policies just like you
would do
> > with Windows-based security. Your authorization extension will have the
> > final say if the user is authorized to perform a given action. For
example,
> > if you need to implement role membership rules, you can change the
> > CheckAccess overloads to account for the addtional rights that the user
will
> > get based on her role membership. Debugging the CheckAccess overloads
should
> > help you clarify how this could be done.
> >
> > --
> > Hope this helps.
> >
> > ----
> > Teo Lachev, MCSD, MCT
> > Author: "Microsoft Reporting Services in Action"
> > Publisher website: http://www.manning.com/lachev
> > Buy it from Amazon.com: http://shrinkster.com/eq
> > Home page and blog: http://www.prologika.com/
> > ----
> >
> > "RayG" <RayG@.discussions.microsoft.com> wrote in message
> > news:40831253-2400-44A3-8A2E-3FF9171C7510@.microsoft.com...
> > > We are currently implementing forms authentication in our RS
deployment.
> > The
> > > MSDN sample helped get us started. We are now faced with the
> > authorization
> > > implementation.
> > >
> > > How do I go about telling RS which user has access to which
folder/report?
> > > Telling RS which users will be administrators? Do I still get to use
> > > role-based security and can create/edit my roles through the Report
> > Manager
> > > or do I need to assign indepentent permissions per user?
>|||Hi Teo,
I am having a problem similar to RayG's, using the forms authentication
sample code. I put some debug statements into the
Microsoft.Samples.ReportingServices.CustomSecurity.Authorization class,
CheckAccess methods. I also commented out the logic in the
AuthenticationExtension and AuthenticationUtilities classes such that all
logon attempts are permitted without password checking (return true).
I found that when accessing report resources using an identity that is
defined in MSRS, that the Authorization.CheckAccess methods are invoked. I
set up security on the Home folder and one subfolder, and was able to use
combinations of groups to restrict access appropriately. I also found that
when you use a logon credential that is not defined in MSRS (that is, not
used in any object's ACL), that the Authorization.CheckAccess methods are not
invoked. For example, I set up a "Users" group, and granted it access to a
folder. Logging on as "Users" I could access this folder. Logging on as
"User" gave me an access denied message, as expected, however, none of the
Authorization.CheckAccess methods were invoked either...unexpected.
This presents a problem, as I am trying to set up groups in MSRS that map to
user groups in my application. It seems that because the
Authorization.CheckAccess methods are not invoked in this case, there is no
opportunity to extend them with custom authorization code which would take
advantage of a user's GenericPrincipal role affiliations (using a
GenericPrincipal object I attached to the HttpContext earlier) to facilitate
group-to-group mapping for confirming or denying access to a resource.
I don't know if this is a bug in MSRS, or if I have simply misconfigured
something. Any ideas? Thanks.
-Rob Hoffman
"Teo Lachev" wrote:
> Ray,
> Yes, you would establish role-based security policies just like you would do
> with Windows-based security. Your authorization extension will have the
> final say if the user is authorized to perform a given action. For example,
> if you need to implement role membership rules, you can change the
> CheckAccess overloads to account for the addtional rights that the user will
> get based on her role membership. Debugging the CheckAccess overloads should
> help you clarify how this could be done.
> --
> Hope this helps.
> ----
> Teo Lachev, MCSD, MCT
> Author: "Microsoft Reporting Services in Action"
> Publisher website: http://www.manning.com/lachev
> Buy it from Amazon.com: http://shrinkster.com/eq
> Home page and blog: http://www.prologika.com/
> ----
> "RayG" <RayG@.discussions.microsoft.com> wrote in message
> news:40831253-2400-44A3-8A2E-3FF9171C7510@.microsoft.com...
> > We are currently implementing forms authentication in our RS deployment.
> The
> > MSDN sample helped get us started. We are now faced with the
> authorization
> > implementation.
> >
> > How do I go about telling RS which user has access to which folder/report?
> > Telling RS which users will be administrators? Do I still get to use
> > role-based security and can create/edit my roles through the Report
> Manager
> > or do I need to assign indepentent permissions per user?
>
>|||Rob,
How did you test that CheckAccess overloads are not invoked? Please note
that they will be invoked only during runtime. If you use the Report Manager
they are not invoked. Instead, GetPermissions will be called. Therefore, you
need to duplicate the same permission checks in GetPermissions as you would
in CheckAccess. I suggest you refactor the common logic from CheckAccess
overloads in a helper function so can be easily reused.
So, just like with Windows authentication, your security authentication
extensions will authenticate the user based on the user identity. In other
words, if I am Bob and I belong to role Sales Reps, I will log in as Bob. In
my authorization extension I will authorize the user based on the user
identity and role membership. Once again, you need to do this in both
CheckAccess and GetPermissions, the later being used by the Report Manager
as a result to a call to the GetPermissions SOAP API.
--
Hope this helps.
----
Teo Lachev, MCSD, MCT
Author: "Microsoft Reporting Services in Action"
Publisher website: http://www.manning.com/lachev
Buy it from Amazon.com: http://shrinkster.com/eq
Home page and blog: http://www.prologika.com/
----
"Rob Hoffman" <RobHoffman@.discussions.microsoft.com> wrote in message
news:7BE3E0A3-95C0-46D3-B589-7AAB38A38B1D@.microsoft.com...
> Hi Teo,
> I am having a problem similar to RayG's, using the forms authentication
> sample code. I put some debug statements into the
> Microsoft.Samples.ReportingServices.CustomSecurity.Authorization class,
> CheckAccess methods. I also commented out the logic in the
> AuthenticationExtension and AuthenticationUtilities classes such that all
> logon attempts are permitted without password checking (return true).
> I found that when accessing report resources using an identity that is
> defined in MSRS, that the Authorization.CheckAccess methods are invoked.
I
> set up security on the Home folder and one subfolder, and was able to use
> combinations of groups to restrict access appropriately. I also found
that
> when you use a logon credential that is not defined in MSRS (that is, not
> used in any object's ACL), that the Authorization.CheckAccess methods are
not
> invoked. For example, I set up a "Users" group, and granted it access to
a
> folder. Logging on as "Users" I could access this folder. Logging on as
> "User" gave me an access denied message, as expected, however, none of the
> Authorization.CheckAccess methods were invoked either...unexpected.
> This presents a problem, as I am trying to set up groups in MSRS that map
to
> user groups in my application. It seems that because the
> Authorization.CheckAccess methods are not invoked in this case, there is
no
> opportunity to extend them with custom authorization code which would take
> advantage of a user's GenericPrincipal role affiliations (using a
> GenericPrincipal object I attached to the HttpContext earlier) to
facilitate
> group-to-group mapping for confirming or denying access to a resource.
> I don't know if this is a bug in MSRS, or if I have simply misconfigured
> something. Any ideas? Thanks.
> -Rob Hoffman
> "Teo Lachev" wrote:
> > Ray,
> >
> > Yes, you would establish role-based security policies just like you
would do
> > with Windows-based security. Your authorization extension will have the
> > final say if the user is authorized to perform a given action. For
example,
> > if you need to implement role membership rules, you can change the
> > CheckAccess overloads to account for the addtional rights that the user
will
> > get based on her role membership. Debugging the CheckAccess overloads
should
> > help you clarify how this could be done.
> >
> > --
> > Hope this helps.
> >
> > ----
> > Teo Lachev, MCSD, MCT
> > Author: "Microsoft Reporting Services in Action"
> > Publisher website: http://www.manning.com/lachev
> > Buy it from Amazon.com: http://shrinkster.com/eq
> > Home page and blog: http://www.prologika.com/
> > ----
> >
> > "RayG" <RayG@.discussions.microsoft.com> wrote in message
> > news:40831253-2400-44A3-8A2E-3FF9171C7510@.microsoft.com...
> > > We are currently implementing forms authentication in our RS
deployment.
> > The
> > > MSDN sample helped get us started. We are now faced with the
> > authorization
> > > implementation.
> > >
> > > How do I go about telling RS which user has access to which
folder/report?
> > > Telling RS which users will be administrators? Do I still get to use
> > > role-based security and can create/edit my roles through the Report
> > Manager
> > > or do I need to assign indepentent permissions per user?
> >
> >
> >|||Teo,
Thanks for turning me on to the GetPermissions method...adding a role check
there did the trick. To check the invocation of the CheckAccess overloads, I
just wrote some debug statements to a log file. Thanks again for your help.
-Rob Hoffman
"Teo Lachev" wrote:
> Rob,
> How did you test that CheckAccess overloads are not invoked? Please note
> that they will be invoked only during runtime. If you use the Report Manager
> they are not invoked. Instead, GetPermissions will be called. Therefore, you
> need to duplicate the same permission checks in GetPermissions as you would
> in CheckAccess. I suggest you refactor the common logic from CheckAccess
> overloads in a helper function so can be easily reused.
> So, just like with Windows authentication, your security authentication
> extensions will authenticate the user based on the user identity. In other
> words, if I am Bob and I belong to role Sales Reps, I will log in as Bob. In
> my authorization extension I will authorize the user based on the user
> identity and role membership. Once again, you need to do this in both
> CheckAccess and GetPermissions, the later being used by the Report Manager
> as a result to a call to the GetPermissions SOAP API.
> --
> Hope this helps.
> ----
> Teo Lachev, MCSD, MCT
> Author: "Microsoft Reporting Services in Action"
> Publisher website: http://www.manning.com/lachev
> Buy it from Amazon.com: http://shrinkster.com/eq
> Home page and blog: http://www.prologika.com/
> ----
[SNIPPED]

Custom Authorization user confusion

hi,
I have read a lot of other posts here about using custom Forms
Authentication, but am still having trouble comprending some points. I
understand the custom authentication piece (LogonUser) and understand how
CheckAccess() works.
Its setting up users that confuses me. Do users have to be defined and
assigned roles with ReportManager? (My users are defined in a custom
database)
If I don't use ReportManager, how can I (programmatically) create users
dynamically and associate these users with a newly defined role? I know I
can use the CreateRole() method for to define a new role - just don't see any
methods that deal with users.
I assume there has to be a way because (again another assumption) I think
ReportManager uses the same interfaces available to me (through the
ReportingService class).
Thanks,
Matt> Its setting up users that confuses me. Do users have to be defined and
> assigned roles with ReportManager? (My users are defined in a custom
> database)
The users can be defined in any datastore. In this case, it's your
database.
> If I don't use ReportManager, how can I (programmatically) create users
> dynamically and associate these users with a newly defined role?
You develop some process to create users. ReportManager doesn't create
users. For example, your application may have a Manage Users screen.
Using Forms Auth you can assign roles to users. For example, the below
function takes a username (valid user from your data store) and a
Report Server folder. Then it assigns the user the Browser role. So if a
valid user in your database is 'TestUser' and you want to add 'TestUser' as
a Browser to 'TestFolder'...
AddUserToFolderPolicy("TestFolder", "TestUser", ref string errMessage)
private bool AddUserToFolderPolicy(string folder, string user, ref string
errMessage)
{
try
{
//Get the Browser role
Role[]roles = m_ReportingService.ListRoles();
Role browserRole = new Role();
foreach (Role r in roles)
{
if (r.Name == "Browser") browserRole = r;
break;
}
Role[] policyRoles = new Role[1];
policyRoles[0] = new Role();
policyRoles[0] =browserRole;
//Get the current policies of the folder in question
string path = "/" + folder;
bool inheritParent = false;
Policy[] currentPolicies = m_ReportingService.GetPolicies(path, out
inheritParent);
//If the user is currently in the current policy set just return
for(int i=0;i<currentPolicies.Length;i++)
if(currentPolicies[i].GroupUserName == user)
return true;
//Create the new policy array and add the new user
ArrayList arrPolicies = new ArrayList(currentPolicies);
Policy p = new Policy();
p.GroupUserName = user;
p.Roles = policyRoles;
arrPolicies.Add(p);
Policy[] finalPolicies = (Policy[])arrPolicies.ToArray(typeof(Policy));
//Set the policies
m_ReportingService.SetPolicies(path,finalPolicies);
}
catch (Exception e)
{
errMessage = e.Message;
return false;
}
return true;
}
HTH|||Yes, this helps - so I can set access to folders by using the SetPolicies()
method. This makes sense now. The user doesn't already have to be defined
in ReportManager, it can be any name (that makes sense - in this case a name
from my user database). And you're right about the ReportManager - I went
back and now I see it works in exactly the same way. This was the missing
piece for me.
I assume I can follow the same procedure for individual reports (and linked
reports) - I just have to specify the full path to the report.
Thanks for your help.
Matt
"FNDS" wrote:
>
> > Its setting up users that confuses me. Do users have to be defined and
> > assigned roles with ReportManager? (My users are defined in a custom
> > database)
> The users can be defined in any datastore. In this case, it's your
> database.
> >
> > If I don't use ReportManager, how can I (programmatically) create users
> > dynamically and associate these users with a newly defined role?
> You develop some process to create users. ReportManager doesn't create
> users. For example, your application may have a Manage Users screen.
> Using Forms Auth you can assign roles to users. For example, the below
> function takes a username (valid user from your data store) and a
> Report Server folder. Then it assigns the user the Browser role. So if a
> valid user in your database is 'TestUser' and you want to add 'TestUser' as
> a Browser to 'TestFolder'...
> AddUserToFolderPolicy("TestFolder", "TestUser", ref string errMessage)
>
> private bool AddUserToFolderPolicy(string folder, string user, ref string
> errMessage)
> {
> try
> {
> //Get the Browser role
> Role[]roles = m_ReportingService.ListRoles();
> Role browserRole = new Role();
> foreach (Role r in roles)
> {
> if (r.Name == "Browser") browserRole = r;
> break;
> }
> Role[] policyRoles = new Role[1];
> policyRoles[0] = new Role();
> policyRoles[0] =browserRole;
> //Get the current policies of the folder in question
> string path = "/" + folder;
> bool inheritParent = false;
> Policy[] currentPolicies = m_ReportingService.GetPolicies(path, out
> inheritParent);
> //If the user is currently in the current policy set just return
> for(int i=0;i<currentPolicies.Length;i++)
> if(currentPolicies[i].GroupUserName == user)
> return true;
> //Create the new policy array and add the new user
> ArrayList arrPolicies = new ArrayList(currentPolicies);
> Policy p = new Policy();
> p.GroupUserName = user;
> p.Roles = policyRoles;
> arrPolicies.Add(p);
> Policy[] finalPolicies = (Policy[])arrPolicies.ToArray(typeof(Policy));
> //Set the policies
> m_ReportingService.SetPolicies(path,finalPolicies);
> }
> catch (Exception e)
> {
> errMessage = e.Message;
> return false;
> }
> return true;
> }
> HTH
>
>|||There is a vocabulary clarification to make. The roles are merely RS roles
(browser, content manager, etc.) that specify sets of permissions. If you
want to have user groups, for what is commonly called "role-based security",
you need to modify the Forms Authentication sample code to support both
users and groups (in CheckAccess, IsValidPrincipal, etc.), and you maintain
the groups alongside the users in your security database -- completely
outside reporting services. Then, you can assign Forms Auth groups to RS
roles as well, just like you do with Windows Authentication.
--
Cheers,
'(' Jeff A. Stucker
\
Business Intelligence
www.criadvantage.com
---
"mshumaker" <mshumaker@.discussions.microsoft.com> wrote in message
news:772301D2-6836-4219-A40B-23DDFB562A9E@.microsoft.com...
> hi,
> I have read a lot of other posts here about using custom Forms
> Authentication, but am still having trouble comprending some points. I
> understand the custom authentication piece (LogonUser) and understand how
> CheckAccess() works.
> Its setting up users that confuses me. Do users have to be defined and
> assigned roles with ReportManager? (My users are defined in a custom
> database)
> If I don't use ReportManager, how can I (programmatically) create users
> dynamically and associate these users with a newly defined role? I know I
> can use the CreateRole() method for to define a new role - just don't see
> any
> methods that deal with users.
> I assume there has to be a way because (again another assumption) I think
> ReportManager uses the same interfaces available to me (through the
> ReportingService class).
> Thanks,
> Matt
>|||Hi,
Was reading through thiis post. I am trying this out currently. m_ReportingService is the webService right? If so, I am getting an error " ListRoles() take 0 Arguements"!
Am I missing something
From http://www.developmentnow.com/g/115_2005_1_0_0_454650/Custom-Authorization-user-confusion.ht
Posted via DevelopmentNow.com Group
http://www.developmentnow.com

Custom authorization on a particular report

Hi,
I have created a report that displays order summaries based on a parameter
CustomerName. I have many customers and want to give them all access to this
report. I've installed the Forms Authentication sample and am able to
authenticate, so each customer has a login.
The problem is that I want each customer to be able to view only his own
order summary (i.e. the CustomerName parameter to the report must be set to
the customer's login id and he cannot change it). Is there a way to pass the
username given in Forms Authentication to the report?
Passing it in the URL is no good because users can modify the URL. The
authorization pieces in the Forms Authentication sample seem only to grant or
deny access on to a particular report, but not on parameters to the report.
Any tips would be greatly appreciated.
Thanks,
DonYou can use the global user!userid, don't pass this as a parameter.
Bruce L-C
"Don" <Don@.discussions.microsoft.com> wrote in message
news:37361218-AD5E-4B95-BF84-3C863FFD1738@.microsoft.com...
> Hi,
> I have created a report that displays order summaries based on a parameter
> CustomerName. I have many customers and want to give them all access to
this
> report. I've installed the Forms Authentication sample and am able to
> authenticate, so each customer has a login.
> The problem is that I want each customer to be able to view only his own
> order summary (i.e. the CustomerName parameter to the report must be set
to
> the customer's login id and he cannot change it). Is there a way to pass
the
> username given in Forms Authentication to the report?
> Passing it in the URL is no good because users can modify the URL. The
> authorization pieces in the Forms Authentication sample seem only to grant
or
> deny access on to a particular report, but not on parameters to the
report.
> Any tips would be greatly appreciated.
> Thanks,
> Don

Custom Authorization in Reporting services

For custom authorization, I am overwriting the CheckAccess method.

But how do I know what I am trying to access in CheckAccess method? I need to know what report the check access method is trying to execute for our requirements.

How do I get that?

I have the same issue! Can anyone help?

Thanks!

Custom Authorization in Reporting services

For custom authorization, I am overwriting the CheckAccess method.

But how do I know what I am trying to access in CheckAccess method? I need to know what report the check access method is trying to execute for our requirements.

How do I get that?

I have the same issue! Can anyone help?

Thanks!

Custom Authorization

Hi,
I was wondering if it was possible to setup RS to use custom
authorization with out implementing custom authentication ? I want to
use windows authentication for authentication, and custom
authorization. If its possible how would I go about configuring it ?
ThanksHello,
you can't implement both (Forms and Windos) authentications together!
Your first question is a bit confusing, I'm not shure if I understand it
correct.
You can find out how to implement forms authentication in the following
article:
http://msdn2.microsoft.com/en-us/library/ms160724.aspx
A sample application can be found in samples bellowe the SQL Server
installation directory. If requiered you can install this sample with the
installation CD or download them as described in the article.
There are some traps in this article, especialy with w2k3 server.
For the report manager the instructions are not working. You need to
configure Windows instate of forms in the config file.
You need to followe the instruction carefully and expect some traps and time
for googling, trial and error etc.
"ismell1@.gmail.com" wrote:
> Hi,
> I was wondering if it was possible to setup RS to use custom
> authorization with out implementing custom authentication ? I want to
> use windows authentication for authentication, and custom
> authorization. If its possible how would I go about configuring it ?
> Thanks
>|||I'm not trying to use both of them together, I'm trying to use windows
<b>AUTHENTICATION</b> and use custom <b>AUTHORIZATION</b>.
I wan't my users to be authenticated via windows security but I wan't
to control what they have access to via my custom extension. I
couldn't find anything in the config files but what I ended up doing
was replacing the windows authorization config line with mine and it
loaded the DLL just fine.
<pre>
<Security>
<!--<Extension Name="Windows"
Type="Microsoft.ReportingServices.Authorization.WindowsAuthorization,
Microsoft.ReportingServices.Authorization"/>-->
<Extension Name="Windows" Type="rxLibrary.rxSecurity, rxSecurity"/>
</Security>
</pre>
Now my problem is that when i try and load the ACL i get a
serialization exception "The input stream is not a valid binary
format. The starting contents (in bytes) are: XX-XX...". After doing
some research I think its because the security description was created
with the windows dll. So now I have to figure out how to clear the old
security descriptions and I can create new ones using my
CreateSecurityDescriptor function.
Any help would be appreciated.
Thanks
On Jan 21, 1:23 pm, Ralf Stofer <RalfSto...@.discussions.microsoft.com>
wrote:
> Hello,
> you can't implement both (Forms and Windos) authentications together!
> Your first question is a bit confusing, I'm not shure if I understand it
> correct.
> You can find out how to implement forms authentication in the following
> article:http://msdn2.microsoft.com/en-us/library/ms160724.aspx
> A sample application can be found in samples bellowe the SQL Server
> installation directory. If requiered you can install this sample with the
> installation CD or download them as described in the article.
> There are some traps in this article, especialy with w2k3 server.
> For the report manager the instructions are not working. You need to
> configure Windows instate of forms in the config file.
> You need to followe the instruction carefully and expect some traps and time
> for googling, trial and error etc.
> "isme...@.gmail.com" wrote:
> > Hi,
> > I was wondering if it was possible to setup RS to use custom
> > authorization with out implementing custom authentication ? I want to
> > use windows authentication for authentication, and custom
> > authorization. If its possible how would I go about configuring it ?
> > Thanks|||I was trying to create custom a authorization extension with out having to
use forms authentication. I didn't see any thing in the config files for
setting that. So what I ended up doing was replacing the Windows
authorization module with my own.
<Security>
<!--<Extension Name="Windows"
Type="Microsoft.ReportingServices.Authorization.WindowsAuthorization,
Microsoft.ReportingServices.Authorization"/>-->
<Extension Name="Windows" Type="rxLibrary.rxSecurity, rxSecurity"/>
</Security>
This seems to work just fine, now my problem is when I try and deserialize
the ACL's I get a "The input stream is not a valid binary format" Exception.
after doing some research i found that the ACL was created using the Default
CreateSecurityDescriptor function, so my extension can't deserialize it.
So now I'm wondering if its possible to clear the secuirty descriptors for
all objects on the server ?
Thanks,
Raul
"Ralf Stofer" wrote:
> Hello,
> you can't implement both (Forms and Windos) authentications together!
> Your first question is a bit confusing, I'm not shure if I understand it
> correct.
> You can find out how to implement forms authentication in the following
> article:
> http://msdn2.microsoft.com/en-us/library/ms160724.aspx
> A sample application can be found in samples bellowe the SQL Server
> installation directory. If requiered you can install this sample with the
> installation CD or download them as described in the article.
> There are some traps in this article, especialy with w2k3 server.
> For the report manager the instructions are not working. You need to
> configure Windows instate of forms in the config file.
> You need to followe the instruction carefully and expect some traps and time
> for googling, trial and error etc.
>
>
>
> "ismell1@.gmail.com" wrote:
> > Hi,
> > I was wondering if it was possible to setup RS to use custom
> > authorization with out implementing custom authentication ? I want to
> > use windows authentication for authentication, and custom
> > authorization. If its possible how would I go about configuring it ?
> >
> > Thanks
> >