Customize the reporting services interface display reports.

Hello:
We are using the reporting services interface to display reports. By using
the security we restricted some access and everything works fine.
Now we would like to change the way the parameters prompt works.
Is there any way of applying styles to the pages rendered by the reporting
server?
Thanks,
Daniel Bello.You can modify the RSReportServer.config file to specify a custom style
sheet for HTML Viewer. The <HTMLViewerStyleSheet> setting is not included in
the file by default. You must type it into the <Configuration> selection of
the RSReportServer.config file and then specify the style sheet you want to
use. Do not include the .css file extension when specifying the style sheet.
The following example provides an illustration of how to specify the style
sheet:
<Configuration>
...
<HTMLViewerStyleSheet>MyStyleSheet</HTMLViewerStyleSheet>
...Read the full article at:
http://msdn2.microsoft.com/en-us/library/ms345247.aspxThanks,Daniel Bello
Urizarri.

Customising Report Manager

Hi,

I have implemented Forms authentication for my report manager. (using the custom Security sample solution) ie i have added a login page, which upon autentication redirects to report manager.

Now i want to add a "sign out" link in the report manager so that when the user clicks on that, it gets redirects to the login page.

Is it possible, if so can anyone let me know where i can implement the code for the same

Thanks,

Bharath V V

Report manager wasn't exactly meant to be customized. How did you create your login page? Using Visual Studio 2005?

|||

There really is not a lot of customizing that you can do with report manager.

In the past few times I have needed to customize, I just created an entire application to replace report manager.

Then used a combination of the web services and/or report viewer control.

BobP

|||Yes.. using VS 2005, and the CustomSecurity.Sln given in the reporting services samples.|||

Oh thats bad news for me

anyways thanks BobP

bharthvv

Customising Dimension Security

HI, I'm having problems specifying customised security in the Advanced tab (allowed members). I'm fairly new to mdx script and am trying to restrict access to a STAFF dimension which contains a loginname member which I want to restrict access to based on username matching the loginname DIM. Have tried the following which didn't work:
[STAFF_DIM].[Login Name].members(MID( USERNAME, INSTR(1,USERNAME, "\") + 1, 128 ) )

I read somewhere that this can only be used on leaf layer members (this is the first of 3 layers), also should I be using the filter function? Any help with trying to setup would be great help.
Before using this expression for dimension security, you may want to do some experimentation first, by creating a simple MDX query including this expression, and verifying that it evaluates to the expected member...

Hope this helps

Customer Accounts Report

I am on security doubt on how to design a report that must show the accounts
of a customer.
I have an aspx page showing the customer info , then he must push a button a
see its accounts on a report generated by Reporting Services.
Obviously the report can not be accesed via a Customer parameters because
another users could see any customer 's accounts.
How can i solve it.
I am thinking in generating a temp table with a random id an pass it by
parameter, but it is only so as to reduce an intruder access.
ThanksHi Fernando,
If you are using ASP.NET you have more than one option:
1.- Storing in Sessions variables
2.- Using QueryString
3.- Using Server side code (static variables)
4.- Change the report viewer (passsing SOAP params)
The fact is the report params does not to be part of the URL you can easily
hide them using multiples techniques, depends how your app is designed you
may use some of them.
Thanks
Jerry
--
You can use this example to show you how to call the report params.
http://www.rdlcomponents.com/ASPExamples/Default.aspx?sm=b1_a
"Fernando Hunth" wrote:
> I am on security doubt on how to design a report that must show the accounts
> of a customer.
> I have an aspx page showing the customer info , then he must push a button a
> see its accounts on a report generated by Reporting Services.
> Obviously the report can not be accesed via a Customer parameters because
> another users could see any customer 's accounts.
> How can i solve it.
> I am thinking in generating a temp table with a random id an pass it by
> parameter, but it is only so as to reduce an intruder access.
> Thanks|||Thats true we have multiples techniques to pass parameters but not to avoid
access to those public parameters.
When a report is deployed , anyone (authenticated) can access to the report
and can access a report via URL and with the posibility of changing any
parameter value via URL.
That 's what i want to avoid. I am trying to investigate doing it with a
DataProcessingExtension
Thanks.
"Jerry" wrote:
> Hi Fernando,
> If you are using ASP.NET you have more than one option:
> 1.- Storing in Sessions variables
> 2.- Using QueryString
> 3.- Using Server side code (static variables)
> 4.- Change the report viewer (passsing SOAP params)
> The fact is the report params does not to be part of the URL you can easily
> hide them using multiples techniques, depends how your app is designed you
> may use some of them.
> Thanks
> Jerry
> --
> You can use this example to show you how to call the report params.
> http://www.rdlcomponents.com/ASPExamples/Default.aspx?sm=b1_a
> "Fernando Hunth" wrote:
> > I am on security doubt on how to design a report that must show the accounts
> > of a customer.
> > I have an aspx page showing the customer info , then he must push a button a
> > see its accounts on a report generated by Reporting Services.
> > Obviously the report can not be accesed via a Customer parameters because
> > another users could see any customer 's accounts.
> > How can i solve it.
> >
> > I am thinking in generating a temp table with a random id an pass it by
> > parameter, but it is only so as to reduce an intruder access.
> >
> > Thanks|||Check out this link:
http://www.codeproject.com/useritems/SQLRSViewer.asp#TheCodeBehind
It's an ASP.NET app that lets you recreate the entire look of the report
viewer. It also give you flexibilty in what you feed the report.
I was able to use this program and feed in my own parameters. The report
will display and no parameters are visible in the URL.
Look for the variable 'reportParameterValues2' in the code. It's a array
that stores the parameters for your report.
Hope this helps, or at least gets you started.
"Fernando Hunth" wrote:
> Thats true we have multiples techniques to pass parameters but not to avoid
> access to those public parameters.
> When a report is deployed , anyone (authenticated) can access to the report
> and can access a report via URL and with the posibility of changing any
> parameter value via URL.
> That 's what i want to avoid. I am trying to investigate doing it with a
> DataProcessingExtension
> Thanks.
>
> "Jerry" wrote:
> > Hi Fernando,
> >
> > If you are using ASP.NET you have more than one option:
> >
> > 1.- Storing in Sessions variables
> > 2.- Using QueryString
> > 3.- Using Server side code (static variables)
> > 4.- Change the report viewer (passsing SOAP params)
> >
> > The fact is the report params does not to be part of the URL you can easily
> > hide them using multiples techniques, depends how your app is designed you
> > may use some of them.
> >
> > Thanks
> > Jerry
> > --
> > You can use this example to show you how to call the report params.
> > http://www.rdlcomponents.com/ASPExamples/Default.aspx?sm=b1_a
> >
> > "Fernando Hunth" wrote:
> >
> > > I am on security doubt on how to design a report that must show the accounts
> > > of a customer.
> > > I have an aspx page showing the customer info , then he must push a button a
> > > see its accounts on a report generated by Reporting Services.
> > > Obviously the report can not be accesed via a Customer parameters because
> > > another users could see any customer 's accounts.
> > > How can i solve it.
> > >
> > > I am thinking in generating a temp table with a random id an pass it by
> > > parameter, but it is only so as to reduce an intruder access.
> > >
> > > Thanks|||Yes, i previously took a look a this project, but that is another client
solution wher you can pass parameters to a public report.
"Hausbro" wrote:
> Check out this link:
> http://www.codeproject.com/useritems/SQLRSViewer.asp#TheCodeBehind
> It's an ASP.NET app that lets you recreate the entire look of the report
> viewer. It also give you flexibilty in what you feed the report.
> I was able to use this program and feed in my own parameters. The report
> will display and no parameters are visible in the URL.
> Look for the variable 'reportParameterValues2' in the code. It's a array
> that stores the parameters for your report.
> Hope this helps, or at least gets you started.
> "Fernando Hunth" wrote:
> > Thats true we have multiples techniques to pass parameters but not to avoid
> > access to those public parameters.
> > When a report is deployed , anyone (authenticated) can access to the report
> > and can access a report via URL and with the posibility of changing any
> > parameter value via URL.
> > That 's what i want to avoid. I am trying to investigate doing it with a
> > DataProcessingExtension
> >
> > Thanks.
> >
> >
> >
> > "Jerry" wrote:
> >
> > > Hi Fernando,
> > >
> > > If you are using ASP.NET you have more than one option:
> > >
> > > 1.- Storing in Sessions variables
> > > 2.- Using QueryString
> > > 3.- Using Server side code (static variables)
> > > 4.- Change the report viewer (passsing SOAP params)
> > >
> > > The fact is the report params does not to be part of the URL you can easily
> > > hide them using multiples techniques, depends how your app is designed you
> > > may use some of them.
> > >
> > > Thanks
> > > Jerry
> > > --
> > > You can use this example to show you how to call the report params.
> > > http://www.rdlcomponents.com/ASPExamples/Default.aspx?sm=b1_a
> > >
> > > "Fernando Hunth" wrote:
> > >
> > > > I am on security doubt on how to design a report that must show the accounts
> > > > of a customer.
> > > > I have an aspx page showing the customer info , then he must push a button a
> > > > see its accounts on a report generated by Reporting Services.
> > > > Obviously the report can not be accesed via a Customer parameters because
> > > > another users could see any customer 's accounts.
> > > > How can i solve it.
> > > >
> > > > I am thinking in generating a temp table with a random id an pass it by
> > > > parameter, but it is only so as to reduce an intruder access.
> > > >
> > > > Thanks|||Ok.
I decided to write some sample code for the solution i was thinking about
generating a temp table with a random id an pass it by
parameter, or something like this.
I 'll publish it in somewhere.
I 'll go on writing on my blog
http://msdevelopers.blogspot.com/2005/03/reporting-services-filtering.html
Fernando Hunth
Senior Developer
Huddle Group S.A.
fernando@.huddle.com.ar
Huddle Group S.A. | Enterprise Technology Services
Microsoft Certified Partner
Ciudad de Buenos Aires · Argentina
www.huddle.com.ar
"Fernando Hunth" wrote:
> I am on security doubt on how to design a report that must show the accounts
> of a customer.
> I have an aspx page showing the customer info , then he must push a button a
> see its accounts on a report generated by Reporting Services.
> Obviously the report can not be accesed via a Customer parameters because
> another users could see any customer 's accounts.
> How can i solve it.
> I am thinking in generating a temp table with a random id an pass it by
> parameter, but it is only so as to reduce an intruder access.
> Thanks

custom sercurity extention and ssl

can the custome security extension for forms authentication use ssl?yes, you can use forms authentication and ssl at the same the.
We are doing that, and, BTW, it is highly recommended in extranet
environment.
Oleg Yevteyev,
San Diego, CA
It is OK to contact me with a contracting opportunity.
"myfirstname"001atgmaildotcom.
Replace "myfirstname" with Oleg.
--
"Marvin" <Marvin@.discussions.microsoft.com> wrote in message
news:68F16E7C-D64B-4315-B1F4-A68532032AB5@.microsoft.com...
> can the custome security extension for forms authentication use ssl?

Custom Security: How do you manage groups

Dear Anyone,

We are trying to create our own custom security extension for rs2005. We are wondering how will then security extension will manage the authenticated users and how will it be mapped to an existing RS2005 group or role?

Thanks,

Joseph

It completely depends on how you write the extension itself.

I'd recommend that you use the forms auth extension as a start: C:\Program Files\Microsoft SQL Server\90\Samples\Reporting Services\Extension Samples\FormsAuthentication Sample

Change the parts of it that handle authentication, and then leave the parts alone which do authorization for you.

If you go this route, you will continue to use all the same roles you did before: Browser, Content Manager, etc.

|||

How would this dovetail with using Custom roles within the custom authentication database?

I've already implemented a version of the custom authentication extension and have the basic SSRS Forms auth working.

For example, users of my application log in with a companycode and would be put into one or many custom application roles that would ostensibly control the visibility of various folders and reports (you can imagine the various scenarios). Would I have to intercept the ASP.NET authentication pipeline and insert a custom Principal/Identity into the HTTP context? Would SSRS use the "User.IsInRole" construct to determine if the user is in a role that can "see" the restricted SSRS objects?

Just in case I confused anyone...I want to be able to add application-domain roles to the SSRS built-in (and possibly custom) roles and use those to restrict visibility to the SSRS objects.

Thanks,

Matthew Belk

|||Did you ever find an answer to this question? We're wanting to do the same thing (use roles from our custom application DB).|||

You can do this by assigning security within RS using the role names (just like windows groups). To get this to work though you will need to:

1. make your implementation of IAuthenticationExtension.IsValidPrincipalName check against the roles in your custom database
2. Implement IAuthorisationExtension.CheckAccess and in there look up the roles the user belongs to and check the access based on the username and his roles.

A good sample of this is located at:

http://www.devx.com/dotnet/Article/26759 - Part 1
http://www.devx.com/dotnet/Article/27133 - Part 2

Incidentally, I would like to take this further by using the Membership and Role Management Application Services of ASP.NET 2.0 to manage my users and roles.

So far I've been able to get the Forms Authentication working and I've set up the Membership and Role Management features, but when I try to use the 2 together i.e. make my logon.aspx page call Membership.ValidateUser the report server stops working and returns:

An internal error occurred on the report server. See the error log for more details. (rsInternalError) Get Online Help

Object reference not set to an instance of an object.

Custom Security: How do you manage groups

Dear Anyone,

We are trying to create our own custom security extension for rs2005. We are wondering how will then security extension will manage the authenticated users and how will it be mapped to an existing RS2005 group or role?

Thanks,

Joseph

It completely depends on how you write the extension itself.

I'd recommend that you use the forms auth extension as a start: C:\Program Files\Microsoft SQL Server\90\Samples\Reporting Services\Extension Samples\FormsAuthentication Sample

Change the parts of it that handle authentication, and then leave the parts alone which do authorization for you.

If you go this route, you will continue to use all the same roles you did before: Browser, Content Manager, etc.

|||

How would this dovetail with using Custom roles within the custom authentication database?

I've already implemented a version of the custom authentication extension and have the basic SSRS Forms auth working.

For example, users of my application log in with a companycode and would be put into one or many custom application roles that would ostensibly control the visibility of various folders and reports (you can imagine the various scenarios). Would I have to intercept the ASP.NET authentication pipeline and insert a custom Principal/Identity into the HTTP context? Would SSRS use the "User.IsInRole" construct to determine if the user is in a role that can "see" the restricted SSRS objects?

Just in case I confused anyone...I want to be able to add application-domain roles to the SSRS built-in (and possibly custom) roles and use those to restrict visibility to the SSRS objects.

Thanks,

Matthew Belk

|||Did you ever find an answer to this question? We're wanting to do the same thing (use roles from our custom application DB).|||

You can do this by assigning security within RS using the role names (just like windows groups). To get this to work though you will need to:

1. make your implementation of IAuthenticationExtension.IsValidPrincipalName check against the roles in your custom database
2. Implement IAuthorisationExtension.CheckAccess and in there look up the roles the user belongs to and check the access based on the username and his roles.

A good sample of this is located at:

http://www.devx.com/dotnet/Article/26759 - Part 1
http://www.devx.com/dotnet/Article/27133 - Part 2

Incidentally, I would like to take this further by using the Membership and Role Management Application Services of ASP.NET 2.0 to manage my users and roles.

So far I've been able to get the Forms Authentication working and I've set up the Membership and Role Management features, but when I try to use the 2 together i.e. make my logon.aspx page call Membership.ValidateUser the report server stops working and returns:

An internal error occurred on the report server. See the error log for more details. (rsInternalError) Get Online Help

Object reference not set to an instance of an object.sql

Custom Security: How do you manage groups

Dear Anyone,

We are trying to create our own custom security extension for rs2005. We are wondering how will then security extension will manage the authenticated users and how will it be mapped to an existing RS2005 group or role?

Thanks,

Joseph

It completely depends on how you write the extension itself.

I'd recommend that you use the forms auth extension as a start: C:\Program Files\Microsoft SQL Server\90\Samples\Reporting Services\Extension Samples\FormsAuthentication Sample

Change the parts of it that handle authentication, and then leave the parts alone which do authorization for you.

If you go this route, you will continue to use all the same roles you did before: Browser, Content Manager, etc.

|||

How would this dovetail with using Custom roles within the custom authentication database?

I've already implemented a version of the custom authentication extension and have the basic SSRS Forms auth working.

For example, users of my application log in with a companycode and would be put into one or many custom application roles that would ostensibly control the visibility of various folders and reports (you can imagine the various scenarios). Would I have to intercept the ASP.NET authentication pipeline and insert a custom Principal/Identity into the HTTP context? Would SSRS use the "User.IsInRole" construct to determine if the user is in a role that can "see" the restricted SSRS objects?

Just in case I confused anyone...I want to be able to add application-domain roles to the SSRS built-in (and possibly custom) roles and use those to restrict visibility to the SSRS objects.

Thanks,

Matthew Belk

|||Did you ever find an answer to this question? We're wanting to do the same thing (use roles from our custom application DB).|||

You can do this by assigning security within RS using the role names (just like windows groups). To get this to work though you will need to:

1. make your implementation of IAuthenticationExtension.IsValidPrincipalName check against the roles in your custom database
2. Implement IAuthorisationExtension.CheckAccess and in there look up the roles the user belongs to and check the access based on the username and his roles.

A good sample of this is located at:

http://www.devx.com/dotnet/Article/26759 - Part 1
http://www.devx.com/dotnet/Article/27133 - Part 2

Incidentally, I would like to take this further by using the Membership and Role Management Application Services of ASP.NET 2.0 to manage my users and roles.

So far I've been able to get the Forms Authentication working and I've set up the Membership and Role Management features, but when I try to use the 2 together i.e. make my logon.aspx page call Membership.ValidateUser the report server stops working and returns:

An internal error occurred on the report server. See the error log for more details. (rsInternalError) Get Online Help

Object reference not set to an instance of an object.

Custom Security works but i get this error sometimes...

I installed custom security the same way I did on SRS 2000. I've been running
srs2000 for a little over a year with custom security.
I used the 2005 Custom Security project and installed it on a dev box.
Everything seems to work (i get login screen when i try to access report
manager) but when i try to access report server I get a wacky error:
c:\Program Files\Microsoft SQL Server\MSSQL.3\Reporting
Services\reportserver\Logon.aspx(28): error CS0012: The type
'System.Drawing.Color' is defined in an assembly that is not referenced. You
must add a reference to assembly 'System.Drawing, Version=2.0.0.0,
Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a'.
----
The strange thing about this is that I am referencing this module in my
project both within the "References" and in code using the "using" statement.
I can't figure out what I'm missing...
Has anyone else encountered this issue? Any help would be greatly appreciated.
Thanks,
NunoBy the way, I'm referencing this post to SRS 2005.
Nuno
"Nuno" wrote:
> I installed custom security the same way I did on SRS 2000. I've been running
> srs2000 for a little over a year with custom security.
> I used the 2005 Custom Security project and installed it on a dev box.
> Everything seems to work (i get login screen when i try to access report
> manager) but when i try to access report server I get a wacky error:
> c:\Program Files\Microsoft SQL Server\MSSQL.3\Reporting
> Services\reportserver\Logon.aspx(28): error CS0012: The type
> 'System.Drawing.Color' is defined in an assembly that is not referenced. You
> must add a reference to assembly 'System.Drawing, Version=2.0.0.0,
> Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a'.
> ----
> The strange thing about this is that I am referencing this module in my
> project both within the "References" and in code using the "using" statement.
> I can't figure out what I'm missing...
> Has anyone else encountered this issue? Any help would be greatly appreciated.
> Thanks,
> Nuno
>|||I figured out why this happens... I added ForeColor="Red" to the one of the
labels called lblMessage in the Logon.aspx page. I changed it to
Style="Color:Red;" and it now works fine. I have no clue as to why this would
cause an error in the Custom Security Sample solution but I suspect it has
something to do with its connection to a resource(.resx) file.
Nuno
"Nuno" wrote:
> By the way, I'm referencing this post to SRS 2005.
> Nuno
> "Nuno" wrote:
> > I installed custom security the same way I did on SRS 2000. I've been running
> > srs2000 for a little over a year with custom security.
> >
> > I used the 2005 Custom Security project and installed it on a dev box.
> > Everything seems to work (i get login screen when i try to access report
> > manager) but when i try to access report server I get a wacky error:
> >
> > c:\Program Files\Microsoft SQL Server\MSSQL.3\Reporting
> > Services\reportserver\Logon.aspx(28): error CS0012: The type
> > 'System.Drawing.Color' is defined in an assembly that is not referenced. You
> > must add a reference to assembly 'System.Drawing, Version=2.0.0.0,
> > Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a'.
> >
> > ----
> >
> > The strange thing about this is that I am referencing this module in my
> > project both within the "References" and in code using the "using" statement.
> > I can't figure out what I'm missing...
> >
> > Has anyone else encountered this issue? Any help would be greatly appreciated.
> >
> > Thanks,
> >
> > Nuno
> >

Custom Security w/ Standard Edition/

Hello...

I am trying to verify that the ability to use the security extension to use Forms based authentication is available (or not) with SQL 2005 Standard. I have read a few books and articles that state that only the Enterprise edition will allow us to use the security extensions to customize authentication and authorization. But a few recently have told me otherwise.

Does anyone know for sure? We use Standard edition...and would like to customize our security.

thanks

- will

Hello again,

Does anyone know the answer here?

Thanks for any help,

- will

|||

SQL Server 2005 Reporting Services Standard edition allows custom security :-)

http://msdn2.microsoft.com/en-us/library/ms143761.aspx

Features/Reporting Services Enhancements

EE (32-bit) DE (32-bit) EE (64-bit) DE (64-bit)

SE (32-bit) SE (64-bit)

WG (32-bit)

SSE (32-bit)

SSEA (32-bit)

Support for remote and nonrelational data sources

Yes

Yes

No

No

No

DHTML, Excel, PDF, and Image rendering extensions

Yes

Yes

Yes

No

Yes

MHTML, CSV, XML, and Null rendering extensions

Yes

Yes

No

No

No

E-mail and file share delivery extensions

Yes

Yes

No

No

No

Custom data processing, delivery, and rendering extensions

Yes

Yes

No

No

No

Custom authentication extensions

Yes

Yes

Yes

No

No

Custom Security Roles

I am trying to implement forms authentication in reporting services and I
would like to use the report manager for rendering reports. What I don't
want to use is the built-in tools for item level and system level security.
Is there a way to get information as to which item is being accessed in the
Getpermissions and CheckAccess function so I can check my custom database for
authorization?Brent,
I don't think you need to know the item accessed because the CheckAccess
overload is scoped at an item level. In other words, if the user tries to
run a report A, the Report Server will pass the security descriptor for
report A only. The job of the security extension is to find out if the user
has rights to carry the action by examing the security descriptor. Any yes,
you can use application-defined role membership policies to simplify the
user maintanance.
I have a two-part article in the works for the SQL Magazine which discusses
Forms Authentication in detail. It should be out in January-February issues
I think.
--
Hope this helps.
---
Teo Lachev, MVP [SQL Server], MCSD, MCT
Author: "Microsoft Reporting Services in Action"
Publisher website: http://www.manning.com/lachev
Buy it from Amazon.com: http://shrinkster.com/eq
Home page and blog: http://www.prologika.com/
---
"Brent Slezak" <Brent Slezak@.discussions.microsoft.com> wrote in message
news:4614209E-953D-4A4B-B2BD-96EFE79FFDAC@.microsoft.com...
> I am trying to implement forms authentication in reporting services and I
> would like to use the report manager for rendering reports. What I don't
> want to use is the built-in tools for item level and system level
security.
> Is there a way to get information as to which item is being accessed in
the
> Getpermissions and CheckAccess function so I can check my custom database
for
> authorization?|||Teo,
First of all, I want to thank you for your prompt response to my question
and I will be looking for that article when it comes out.
Let me go into further detail as to the situation with the reporting
services and how I would like to use them. I currrently have a proprietary
security system setup for my enterprise-scale application that manages
thousands of users and groups and tens of thousands of roles. I don't want to
have to re-define that information in the ReportSErver database. Actually I
would like it if I had absolutly no security definition at all in the
ReportServer database. That being said. How would I get the unique
identifier of the object (i.e. report,folder,datasource) being accessed so
that I can cross-reference MyDatabase1 for security access.
In a nutshell I want to be able to use the report manager for the report
rendering and not for managing role-based security. I think building our own
custom rendering UI is the only logical alternative.
Please let me know what you would consider the best option with this scenario.
Thank you in advance for your input.
Brent
"Teo Lachev [MVP]" wrote:
> Brent,
> I don't think you need to know the item accessed because the CheckAccess
> overload is scoped at an item level. In other words, if the user tries to
> run a report A, the Report Server will pass the security descriptor for
> report A only. The job of the security extension is to find out if the user
> has rights to carry the action by examing the security descriptor. Any yes,
> you can use application-defined role membership policies to simplify the
> user maintanance.
> I have a two-part article in the works for the SQL Magazine which discusses
> Forms Authentication in detail. It should be out in January-February issues
> I think.
> --
> Hope this helps.
> ---
> Teo Lachev, MVP [SQL Server], MCSD, MCT
> Author: "Microsoft Reporting Services in Action"
> Publisher website: http://www.manning.com/lachev
> Buy it from Amazon.com: http://shrinkster.com/eq
> Home page and blog: http://www.prologika.com/
> ---
> "Brent Slezak" <Brent Slezak@.discussions.microsoft.com> wrote in message
> news:4614209E-953D-4A4B-B2BD-96EFE79FFDAC@.microsoft.com...
> > I am trying to implement forms authentication in reporting services and I
> > would like to use the report manager for rendering reports. What I don't
> > want to use is the built-in tools for item level and system level
> security.
> >
> > Is there a way to get information as to which item is being accessed in
> the
> > Getpermissions and CheckAccess function so I can check my custom database
> for
> > authorization?
>
>|||Brent,
I understand your scenario now. Of course, assuming that the reports will
be rendered on the server side of the application you don't have an issue
since you have an application front end. This is similar to the security
scenario I describe in Chapter 13 of my book.
However, the real problem is with URL addressability and custom security
extension. One approach that may be appropriate in your case is to get the
report path from the URL request. This could be similar to the approach I
describe in the following thread
http://groups.google.com/groups?q=Disable+Hyperlink+in+EXCEL&hl=en&lr=&selm=%23VCcwuh1EHA.1264%40TK2MSFTNGP12.phx.gbl&rnum=1
Once you get the report path, you can get the report identifier (the primary
key in table Catalgo) which is what you may want to use in your custom
security infrastructure.
--
Hope this helps.
---
Teo Lachev, MVP [SQL Server], MCSD, MCT
Author: "Microsoft Reporting Services in Action"
Publisher website: http://www.manning.com/lachev
Buy it from Amazon.com: http://shrinkster.com/eq
Home page and blog: http://www.prologika.com/
---
"Brent Slezak" <BrentSlezak@.discussions.microsoft.com> wrote in message
news:3741B21F-0963-457F-8EC6-A1F6403CB514@.microsoft.com...
> Teo,
> First of all, I want to thank you for your prompt response to my question
> and I will be looking for that article when it comes out.
> Let me go into further detail as to the situation with the reporting
> services and how I would like to use them. I currrently have a
proprietary
> security system setup for my enterprise-scale application that manages
> thousands of users and groups and tens of thousands of roles. I don't want
to
> have to re-define that information in the ReportSErver database. Actually
I
> would like it if I had absolutly no security definition at all in the
> ReportServer database. That being said. How would I get the unique
> identifier of the object (i.e. report,folder,datasource) being accessed so
> that I can cross-reference MyDatabase1 for security access.
> In a nutshell I want to be able to use the report manager for the report
> rendering and not for managing role-based security. I think building our
own
> custom rendering UI is the only logical alternative.
> Please let me know what you would consider the best option with this
scenario.
> Thank you in advance for your input.
> Brent
> "Teo Lachev [MVP]" wrote:
> > Brent,
> >
> > I don't think you need to know the item accessed because the CheckAccess
> > overload is scoped at an item level. In other words, if the user tries
to
> > run a report A, the Report Server will pass the security descriptor for
> > report A only. The job of the security extension is to find out if the
user
> > has rights to carry the action by examing the security descriptor. Any
yes,
> > you can use application-defined role membership policies to simplify the
> > user maintanance.
> >
> > I have a two-part article in the works for the SQL Magazine which
discusses
> > Forms Authentication in detail. It should be out in January-February
issues
> > I think.
> >
> > --
> > Hope this helps.
> >
> > ---
> > Teo Lachev, MVP [SQL Server], MCSD, MCT
> > Author: "Microsoft Reporting Services in Action"
> > Publisher website: http://www.manning.com/lachev
> > Buy it from Amazon.com: http://shrinkster.com/eq
> > Home page and blog: http://www.prologika.com/
> > ---
> >
> > "Brent Slezak" <Brent Slezak@.discussions.microsoft.com> wrote in message
> > news:4614209E-953D-4A4B-B2BD-96EFE79FFDAC@.microsoft.com...
> > > I am trying to implement forms authentication in reporting services
and I
> > > would like to use the report manager for rendering reports. What I
don't
> > > want to use is the built-in tools for item level and system level
> > security.
> > >
> > > Is there a way to get information as to which item is being accessed
in
> > the
> > > Getpermissions and CheckAccess function so I can check my custom
database
> > for
> > > authorization?
> >
> >
> >

Custom Security Forms Authentication for Report Manager

I have reviewed/implemented the examples in MSDN, Brian Larson, and T.
Lachev's works for custom security forms authentication for reporting
server(including Lache's Role based structure outlined in the book and DevX
forums).
However, the documentation falls short of configuring the Report Manager for
custom security-forms authentication as well. What procedures would I need to
complete to remove the Windows authentication requirement from the Report
Manager and replace with forms authentication. Specifically, I want to add a
html redirect page to take to "My App" that handles Single Sign on calls(to
LDAP) which will also call the logon user methods from SSRS to establish the
necessary SSRS cookies and allow us to link to the /Reports/Pages/Folder to
access the report manager from within the application.
Specifically: I need sample settings for each of these Report Manager
configuration files
1) Web.Config
2) RSWebApplication.Config
3) rsmgrpolicy.config
Also what location would I have to store the appropriate redirect page and
what path setting do I need to apply to any of the above files to make this
work.
Thanks for any help you can provide.Answered here:
http://www.sqltalk.org/ftopic9114.html&highlight=forms+authentication
Bottom line was web.config for the report manager has to have
<authentication mode="Windows"/>
<authorization>
<allow users="*" />
</authorization>
<identity impersonate="false"/>
And your RSWebapplication.config
should have <loginUrl>/Home.aspx</loginUrl>
Note that your IIS default content will have your redirect page which you
save in your report manager directory and not the home.aspx.

Custom Security for Reportserver with some ISAPI Filter in progress

hi,

I am new to report server custom security.

I face the following problem and want to ask if there is a simple way to solve.

we have already running an IS API Filter which handles the authentication for all websites. The fiter is built to secure all websites. It verfies access to URLs and authrize users against an LDAP Directory. Affer the user has authenticated he can connect to the website. The ISAPI Filter sets the LOGONUSER Severvariable so the website can do userspecific filtering.

With the same ISAPI Filter we want to secure report server.

We want to setup roles with usernames to allow or deny specific reports. (this usernames should be validated against the servervariable LOGONUser - by String Comparison).

We do not have any windows authenitcation - and do not need.

The ReportServer User Variable should return this LOGON User to allow report secific data filtering

Is this possible - and explanation how?

Best Regards,

HANNES

Nobody an idea?

I really need to know if its possible or how and a hint in howto.

Is it possible with an custom security extension to reportserver?

Best regards,

HANNES

|||

I gathered some references together for a user in a different forum... here they are:

1. this article will help you think about implementing a custom security extension http://www.devx.com/dotnet/Article/27133

2. this article (on a hosting provider) will show you how you might do it if you don't care much about security <g> http://www.webhost4life.com/kb/question.php?qstId=209 -- seriously, it will give you some perspective on how-all this works

3. here is a short post about why it may not be a great idea to write security extensions using forms authentication (basically, I think this might be your "login user" scenario, not sure, so want to mention it) http://msmvps.com/blogs/anguslogan/archive/2004/10/03/14772.aspx

4. I think there is a sample of doing forms-based authentication here
http://blogs.msdn.com/bimusings/archive/2005/12/05/500195.aspx -- if you
can't find the sample read this blog post
http://weblogs.asp.net/plip/archive/2006/09/21/Microsoft-Documentation-_2D00_-Where-is-the-sample-code_3F00_.aspx

5. here is an article (with source) doing something like what you need
http://www.sqlmag.com/Articles/ArticleID/93830/93830.html

6. here is a good overview of writing extensions for RS from an MS blog -- it's another useful perspective
http://blogs.msdn.com/bryanke/archive/2004/03/16/90797.aspx

Hope this helps,

>L<

Custom Security Extensions for SQL RS 2005

Hi,

I'm having a lot of trouble trying to set up a custom security extension with Reporting Services 2005. Following the VB example from McGraw Hill Osborne (http://www.mhprofessional.com/product.php?cat=112&isbn=0072262397&cat=112), I've compiled the .dll for the extension and made the changes to the ReportManager and ReportServer .config files. After I reset IIS and return to the RS website, it displays "The report server has encountered a configuration error..." and I get a message in my System Event log:

The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID
{BA126AD1-2166-11D1-B1D0-00805FC1270E}
to the user MYMACHINE\ASPNET SID (S-1-5-21-1708537768-839522115-1343024091-1005). This security permission can be modified using the Component Services administrative tool.

Wondering if anyone else has had similar trouble and how did they get around it?

Have you modified the RSSrvPolicy.config ?

Here is a guide I followed to successfully implement custom authentication in RS.

http://msdn2.microsoft.com/en-us/library/ms160724.aspx

Look at the section "To modify the RSSrvPolicy.config file"

Regards Andreas|||

Here are the changes I made to .config files before running Reporting Services and getting these errors:

Under the ReportManager directory:

rsmgrpolicy.config - MyComputer code group permission from Execution to FullTrust

rsWebApplication.config - modified <UI> entry, added redirection to login page + URL

Web.config - identify impersonate -> "false"

Under the ReportServer dierctory:

RSReportServer.config - Added <Extension> elements with Name ="Forms" inside both <Security> and <Authentication>

rssvrpolicy.config - added new <CodeGroup> block just under CodeGroup with "$CodeGen$" string

web.config - identify impersonate -> "false"

sql

Custom security extension permission problem

I've created a Reporting Service security extension based on the sample. It works great on my development 2003 servers but when moved into integration environment I am getting the following error in Report Manager when clicking a report:

Could not load file or assembly 'Microsoft.ReportingServices.ProcessingObjectModel, Version=9.0.242.0, Culture=neutral, PublicKeyToken=89845dcd8080cc91' or one of its dependencies. Access is denied.

Navigating folders and creating folders all seems to work in Report Manager. We only get this error when selecting a report. If I uninstall the custom security extension then everything works.

This seems like a difference in security settings between the two server but I'm not sure how to troubleshoot it.

Thanks

William

William

I had a similar problem and it was due to the fact that the user account of the SQL Server Reporting Services (MSSQLSERVER) service did not have access to the C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Temporary ASP.NET Files directory. It needs Modify access. Once I changed that, it worked fine.

Good luck

|||

Thanks.

I had to add modify permissions on C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Temporary ASP.NET Files to the Execution Account I specified in Reporting Services Configuration Manager. This is because I ran a report with a local datasource (with dynamic connectionstring) with setting "Credentials are not required".

Pierre

Custom security extension permission problem

I've created a Reporting Service security extension based on the sample. It works great on my development 2003 servers but when moved into integration environment I am getting the following error in Report Manager when clicking a report:

Could not load file or assembly 'Microsoft.ReportingServices.ProcessingObjectModel, Version=9.0.242.0, Culture=neutral, PublicKeyToken=89845dcd8080cc91' or one of its dependencies. Access is denied.

Navigating folders and creating folders all seems to work in Report Manager. We only get this error when selecting a report. If I uninstall the custom security extension then everything works.

This seems like a difference in security settings between the two server but I'm not sure how to troubleshoot it.

Thanks

William

William

I had a similar problem and it was due to the fact that the user account of the SQL Server Reporting Services (MSSQLSERVER) service did not have access to the C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Temporary ASP.NET Files directory. It needs Modify access. Once I changed that, it worked fine.

Good luck

|||

Thanks.

I had to add modify permissions on C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Temporary ASP.NET Files to the Execution Account I specified in Reporting Services Configuration Manager. This is because I ran a report with a local datasource (with dynamic connectionstring) with setting "Credentials are not required".

Pierre

Custom security extension permission problem

I've created a Reporting Service security extension based on the sample. It works great on my development 2003 servers but when moved into integration environment I am getting the following error in Report Manager when clicking a report:

Could not load file or assembly 'Microsoft.ReportingServices.ProcessingObjectModel, Version=9.0.242.0, Culture=neutral, PublicKeyToken=89845dcd8080cc91' or one of its dependencies. Access is denied.

Navigating folders and creating folders all seems to work in Report Manager. We only get this error when selecting a report. If I uninstall the custom security extension then everything works.

This seems like a difference in security settings between the two server but I'm not sure how to troubleshoot it.

Thanks

William

William

I had a similar problem and it was due to the fact that the user account of the SQL Server Reporting Services (MSSQLSERVER) service did not have access to the C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Temporary ASP.NET Files directory. It needs Modify access. Once I changed that, it worked fine.

Good luck

|||

Thanks.

I had to add modify permissions on C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Temporary ASP.NET Files to the Execution Account I specified in Reporting Services Configuration Manager. This is because I ran a report with a local datasource (with dynamic connectionstring) with setting "Credentials are not required".

Pierre

Custom Security Extension issue...

I have tried to write a custom security extension. When I run the report
manager I get ...
Object Reference is not set to an instance of an object.
It's breaking in GlobalApp.Application_AuthenticationRequest
I figure its because it can't find my extension but I have the correct Url
in the securityextensioncodegroup. Could it be the type attibute in the
extension tag?
Type="RSSecurity.AuthorizationExtension,AuthorizationExtension"You may be getting the exception in the GetWebRequest override in the
derived ReportingService class because the HttpContext.Current.Request is
null which causes the call to the AuthCookie property to fail. I'm having a
similar problem that I'm working through right now. Maybe this will give you
some place to start looking for the problem.
Just a thought...
Garry
"Tad" <Tad@.discussions.microsoft.com> wrote in message
news:CF04B8C0-641A-4D50-9A90-B49625266D90@.microsoft.com...
> I have tried to write a custom security extension. When I run the report
> manager I get ...
> Object Reference is not set to an instance of an object.
> It's breaking in GlobalApp.Application_AuthenticationRequest
> I figure its because it can't find my extension but I have the correct Url
> in the securityextensioncodegroup. Could it be the type attibute in the
> extension tag?
> Type="RSSecurity.AuthorizationExtension,AuthorizationExtension"|||Gary,
Have you found a solution to this issue of the
HttpContext.Current.Request being null or found more information on
what might cause this to be null?
- Jessica
Garry Lenz wrote:
> You may be getting the exception in the GetWebRequest override in the
> derived ReportingService class because the
HttpContext.Current.Request is
> null which causes the call to the AuthCookie property to fail. I'm
having a
> similar problem that I'm working through right now. Maybe this will
give you
> some place to start looking for the problem.
> Just a thought...
> Garry
>
> "Tad" <Tad@.discussions.microsoft.com> wrote in message
> news:CF04B8C0-641A-4D50-9A90-B49625266D90@.microsoft.com...
> > I have tried to write a custom security extension. When I run the
report
> > manager I get ...
> >
> > Object Reference is not set to an instance of an object.
> >
> > It's breaking in GlobalApp.Application_AuthenticationRequest
> >
> > I figure its because it can't find my extension but I have the
correct Url
> > in the securityextensioncodegroup. Could it be the type attibute
in the
> > extension tag?
> >
> > Type="RSSecurity.AuthorizationExtension,AuthorizationExtension"|||This looks familiar. It could be one of a myriad of things. In our case,
the custom security extension called a web service, and there was an invalid
type definition in the web reference. We had to delete all our binaries and
web references from the development environment, reattach the web references
and recompile. Then it worked.
I hope that points you in the right direction. Bottom line issue: don't
lose your cookies.
--
Cheers,
'(' Jeff A. Stucker
\
Business Intelligence
www.criadvantage.com
---
<Jessica.Landisman@.ndchealth.com> wrote in message
news:1105364285.978877.33130@.c13g2000cwb.googlegroups.com...
> Gary,
> Have you found a solution to this issue of the
> HttpContext.Current.Request being null or found more information on
> what might cause this to be null?
> - Jessica
> Garry Lenz wrote:
>> You may be getting the exception in the GetWebRequest override in the
>> derived ReportingService class because the
> HttpContext.Current.Request is
>> null which causes the call to the AuthCookie property to fail. I'm
> having a
>> similar problem that I'm working through right now. Maybe this will
> give you
>> some place to start looking for the problem.
>> Just a thought...
>> Garry
>>
>> "Tad" <Tad@.discussions.microsoft.com> wrote in message
>> news:CF04B8C0-641A-4D50-9A90-B49625266D90@.microsoft.com...
>> > I have tried to write a custom security extension. When I run the
> report
>> > manager I get ...
>> >
>> > Object Reference is not set to an instance of an object.
>> >
>> > It's breaking in GlobalApp.Application_AuthenticationRequest
>> >
>> > I figure its because it can't find my extension but I have the
> correct Url
>> > in the securityextensioncodegroup. Could it be the type attibute
> in the
>> > extension tag?
>> >
>> > Type="RSSecurity.AuthorizationExtension,AuthorizationExtension"
>sql

Custom Security Extension

Hi,

My company has an application in the standard client-server architecture; The client is written in VB 6 and uses reports from the old VB 6 report designer. I am currently undertaking a project which involves transferring these reports to Reporting Services in order to allow access via the internet (a new reporting web front-end is also being designed to work in tandem with the old client). The current client has data restriction features which restrict data and report access depending on a users group - these features can be managed via the client by users with the correct privileges. In order to prevent creation and maintenance of accounts on the both the Report Server and the database for the old client (and to allows non-windows authentication) I have implemented a custom security extension which authenticates users by checking their credentials against the client's database; I also need to authorize users requests against this database however I don't seem to be able to retrieve the identity of the catalogue item that Reporting Services is requesting authorization for.

for example a report is requested; Reporting Services calls the following method:

public bool CheckAccess(string userName, IntPtr userToken, byte[] secDesc, Microsoft.ReportingServices.Interfaces.ReportOperation requiredOperation)

I can't find a way of obtaining the reports name or identity from within this method so I can use it to query the external database to ascertain authorization.

Can anybody help? Am I missing something glaringly obvious?

Your time is very much appreciated.

Adam

I have the same problem.

In RS 2000 Version, I found this information at HttpContext.Request.QueryString[0]

But in 2005 I can't find it in HttpContext..... and I need it urgently.|||I have the solution. Call this Method from IAuthorizationExtension Constructor or from your CheckAccess Method:
<code>
public string GetReportName()
{
HttpContext.Current.Request.InputStream.Position = 0;

StreamReader rd = new StreamReader(HttpContext.Current.Request.InputStream);

XmlDocument SOAPDocument = new XmlDocument();

SOAPDocument.LoadXml(rd.ReadToEnd());

HttpContext.Current.Request.InputStream.Position = 0;

XmlNamespaceManager ns = new XmlNamespaceManager(SOAPDocument.NameTable);
ns.AddNamespace("def","http://schemas.microsoft.com/sqlserver/2005/06/30/reporting/reportingservices");
ns.AddNamespace("soap", "http://schemas.xmlsoap.org/soap/envelope/");

XmlNode result = null;
result = SOAPDocument.SelectSingleNode("//def:Item",ns);

if (result == null)
{
result = SOAPDocument.SelectSingleNode("//def:Report",ns);
}
if (result == null)
{
return HttpContext.Current.Cache["ReportName"].ToString();
}

String ReportPath = result.InnerText;

string[] ReportDescription = ReportPath.Split(new char[] { '/' });

HttpContext.Current.Cache.Insert("ReportName",ReportDescription[ReportDescription.Length-1],null,DateTime.Now.AddMinutes(5),TimeSpan.Zero);

return ReportDescription[ReportDescription.Length - 1];
}
</code>|||I don't think this method will work reliably. Can you elaborate on why you need the path in the security extension - why isn't the ACL that's passed in enough to make access check decisions?|||The ACL passed in check decisions method, is based in roles configured in Report Manager.

The security of my client has his own roles. I need know de report name to ask to my client security framework which type of access has the user to this report name.

PD: Sorry for my bad english.|||

Tudor Trufinescu - MSFT wrote:

I don't think this method will work reliably. Can you elaborate on why you need the path in the security extension - why isn't the ACL that's passed in enough to make access check decisions?

I have posted exactly the same question. The ACL doesn't tell me anything about what the actual object is that the user is trying to get to. It would be helpful to know that User X is trying to execute Report Y in order to do custom authorization....

Custom Security Extension

Hi,

My company has an application in the standard client-server architecture; The client is written in VB 6 and uses reports from the old VB 6 report designer. I am currently undertaking a project which involves transferring these reports to Reporting Services in order to allow access via the internet (a new reporting web front-end is also being designed to work in tandem with the old client). The current client has data restriction features which restrict data and report access depending on a users group - these features can be managed via the client by users with the correct privileges. In order to prevent creation and maintenance of accounts on the both the Report Server and the database for the old client (and to allows non-windows authentication) I have implemented a custom security extension which authenticates users by checking their credentials against the client's database; I also need to authorize users requests against this database however I don't seem to be able to retrieve the identity of the catalogue item that Reporting Services is requesting authorization for.

for example a report is requested; Reporting Services calls the following method:

public bool CheckAccess(string userName, IntPtr userToken, byte[] secDesc, Microsoft.ReportingServices.Interfaces.ReportOperation requiredOperation)

I can't find a way of obtaining the reports name or identity from within this method so I can use it to query the external database to ascertain authorization.

Can anybody help? Am I missing something glaringly obvious?

Your time is very much appreciated.

Adam

I have the same problem.

In RS 2000 Version, I found this information at HttpContext.Request.QueryString[0]

But in 2005 I can't find it in HttpContext..... and I need it urgently.|||I have the solution. Call this Method from IAuthorizationExtension Constructor or from your CheckAccess Method:
<code>
public string GetReportName()
{
HttpContext.Current.Request.InputStream.Position = 0;

StreamReader rd = new StreamReader(HttpContext.Current.Request.InputStream);

XmlDocument SOAPDocument = new XmlDocument();

SOAPDocument.LoadXml(rd.ReadToEnd());

HttpContext.Current.Request.InputStream.Position = 0;

XmlNamespaceManager ns = new XmlNamespaceManager(SOAPDocument.NameTable);
ns.AddNamespace("def","http://schemas.microsoft.com/sqlserver/2005/06/30/reporting/reportingservices");
ns.AddNamespace("soap", "http://schemas.xmlsoap.org/soap/envelope/");

XmlNode result = null;
result = SOAPDocument.SelectSingleNode("//def:Item",ns);

if (result == null)
{
result = SOAPDocument.SelectSingleNode("//def:Report",ns);
}
if (result == null)
{
return HttpContext.Current.Cache["ReportName"].ToString();
}

String ReportPath = result.InnerText;

string[] ReportDescription = ReportPath.Split(new char[] { '/' });

HttpContext.Current.Cache.Insert("ReportName",ReportDescription[ReportDescription.Length-1],null,DateTime.Now.AddMinutes(5),TimeSpan.Zero);

return ReportDescription[ReportDescription.Length - 1];
}
</code>|||I don't think this method will work reliably. Can you elaborate on why you need the path in the security extension - why isn't the ACL that's passed in enough to make access check decisions?|||The ACL passed in check decisions method, is based in roles configured in Report Manager.

The security of my client has his own roles. I need know de report name to ask to my client security framework which type of access has the user to this report name.

PD: Sorry for my bad english.|||

Tudor Trufinescu - MSFT wrote:

I don't think this method will work reliably. Can you elaborate on why you need the path in the security extension - why isn't the ACL that's passed in enough to make access check decisions?

I have posted exactly the same question. The ACL doesn't tell me anything about what the actual object is that the user is trying to get to. It would be helpful to know that User X is trying to execute Report Y in order to do custom authorization....|||I have tried using the suggestion in this thread. Unfortunately, it does not work. Report Server will make many calls to the CheckAccess methods to fill one user request. At some point one of those calls will throw an XML related exception using the GetReportName method. The exception will say "no root node". I don't want to handle this exception by catching it and returning true in the CheckAccess method. So I catch the exception and send back false. Just one false return value will cause the Report Server to send back a failed authorization message to the user if if all of the previous calls to CheckAccess returned true.

Any thoughts on a way to enhance this approach without compromising security?