Role based security issues

I am attempting to set up a new user that has only the ability to run reports in the report manager.

I have created a new ActiveDirectory entry for DOMAIN\ReportUser. I have a created a new folder with the reports, and have set this user as a Browser role on this directory, and all reports in the directory.

I have made it throught the security maze to gain access to these reports as this user, but I cannot dynamically run the reports. As the BUILTIN\Administrator (content manager), I get a grayed background on the parameters and can run the reports. As this DOMAIN\ReportUser, I get what looks like HTML parameter items, and cannot run a dynamic report. Even if I change the role of this user to Content Manager, I still cannot run a dynamic report.

How do you properly set up a user to be able to dynamically run, and only run, a report in Report Manager, and have this user only see reports in a single folder?

I have been fighting the security issues of creating a RS site and properly setting up access, and have yet to find a single site or person explaining the entire process in any coherant method.

Mark

Hello Mark,

I'll tell you how I have mine setup for users only being able to run certain reports.

First off, I created a new item-level role (Site Settings -> Configure item-level role definitions) called Report Viewer and assigned it the 'View reports' & 'View Folders' task. I created my own role just to give the basic amount of permission needed. Then, go to the folder with the reports in it and hit Properties -> Security. Select 'New Role Assignment', check the box for 'Report Viewer', and type the name of your user in the 'Group or user name:' box.

Now, the specific user/group can view the folder and run the reports underneath.

You could also change the security on specific reports instead of the folder if you only want the user(s) to run certain ones.

Hope this helps.

Jarret

|||

Jarret,

This is along the lines as to what I have tried.

Here is a little more about what I am experiencing:

I have a RS management site (e.g. report1.myurl.com/reports) the when I log in (i.e. I get the windows "Connect to report1.myurl.com" login form) with the builtin\administrator account I get full access to all report folders and functionality to manage the site.

I have a ActiveDirectory user Domain\ReportUser1, who is configured in RS as a 'Report Viewer' as you have described in your previous post. However, when I login with this User (i.e. I get the windows "Connect to report1.myurl.com" login form) I enter my Domain\ReportUser1 credentials, I have the same access to the RS management evironment as the builtin\administrator. It does not limit this user to only the folder I have given permissions to. I have checked the entire site, every configuration form, and through SQL2005 Management Studio for RS, and as far as I can tell, this user is set to only see the reports in this directory and does not have Content Manager status.

As an alternative, I have created a parallel named instance of reporting services (e.g report2.myurl.com/reports) and have set up the Directory Security Authentication on the Reports and ReportServer virtual directories to log in as the Domain\ReportUser1. These virtual sites point to the same SQL2005 instance of reporting services as the Default web site virtual directories, and I have access to the report uploaded there.

When I log into RS manager for this alternative site, I am now limited to view only the report folder that was configured for this user, however, I still have the ability to upload files, create folders and database connections (Which I should not, based on the role-based permissions set for this user). In addition, when attempting to run the reports, I do not have access to run them. I.e. Normally the parameters have are in the ReportViewer ActiveX-based control, along with the export, print, refresh, etc. (this has your report parameters in a gray background). When I run for this alternative site, the parameters are visible as what looks like HTML controls and any attempt to run the report returns message:

The selected report is not ready for viewing. The report is still being rendered or a report snapshot is not available. (rsReportNotReady)

The security involved in Reporting services is extremely frustrating to set up properly, as you not only have the windows, sql and IIS security stars to align to even gain access to the RS site, you then need to configure these Roles, which do not seem to be filtering a ActiveDirectory user's access to these reports as I would expect.

What am I missing?

|||I'm having the same issue. Can you keep me in the loop....sql

Role Based Security and Child Groups

Hi All,

I have a report running and I am attempting to assign role based security. I added a group to the site level security. The group I added contains child groups. It doesn't seem that report server is looking into the child groups to see if the logged in user is a member of the child group. Is there anyway to get this to work instead of adding all the groups directly? I suspect that report server is using cominterop and cominterop is not traversing the directory tree?

Thanks,

Darren

Interestingly, if you add a group to a report server that contains logins, then remove that group from Management Studio, everyone in the group still has access to the reports.

DD

Role Based Security and Child Groups

Hi All,

I have a report running and I am attempting to assign role based security. I added a group to the site level security. The group I added contains child groups. It doesn't seem that report server is looking into the child groups to see if the logged in user is a member of the child group. Is there anyway to get this to work instead of adding all the groups directly? I suspect that report server is using cominterop and cominterop is not traversing the directory tree?

Thanks,

Darren

Interestingly, if you add a group to a report server that contains logins, then remove that group from Management Studio, everyone in the group still has access to the reports.

DD

Rights for clickonce Report Builder access?

I'm attempting to grant rights to Report Builder as deployed as part of my TFS install. My problem is that I have to add my users to the builtin\admin group in order for them to see the report builder button on the SQL Server Reporting homepage & then have rights to launch the ReportBuilder click once app. I obviously do not want make users admins on the box, but I've tried adding them to all of the other groups having to do with SQLServer to no avail. How can I grant users access to launch the Report Builder app?

Users need to have the Report Server system permission "Execute Report Definitions" in order to see the Report Builder icon in Report Manager.

1. access Report Manager Site Settings page: http://%machine%/Reports/Pages/Settings.aspx

2. click "Configure site-wide security"

From here you can either modify an existing RS role assignment or create a new one, and give the applicable users permissions to "Execute Report Definitions".

BTW, the Windows security groups created by SQL Server setup aren't used for RS security. Members of the local Administrators get some built-in permissions, which is why making your users local Administrators caused the Report Builder icon to show up.

|||I started with that: the users see the report builder Icon, but then they are prompted with a Sql server logon when the click the report builder icon. I've granted datareader on the sql databases 'tfswarehouse' and 'reportServer' for that user. Is it a sql rights thing?|||

No, I don't think that's going to make a difference. The data that's used in the Report Builder reports is accessed using credentials as per the data source object in Report Server that's bound to the model that Report Builder is consuming.

Making sure I have the right repro:

1. click Report Builder icon in Report Manager

2. see a SQL Server logon dialog

You never see a model selection pane or a design surface?

|||

That's correct. If I give box admin rights to user, all looks and acts normally. With Report builder admin rights & no box admin rights the user sees report builder icon but when he goes to lauch the app he gets security dialog.

|||

Resolved it. Maybe it was me being dense, but the report builder site security page does not make any sense to me. You need to first of all create a group (box or domain) and add the users to it. then use that group name in the security page granting the content manager right. It makes total sense to me now that it's done, but it's not clear on the security page that that is what you need to do. I'd suggest making that page more clear... or the documentation... or both!