ReportViewer Control Permission

  • Thread starter Thread starter AG
  • Start date Start date
A

AG

I am using a ReportViewer control in an ASP.NET 2.0 WAP aspx page in remote
processing mode.

The report server is on a shared web host.

Can anyone tell me or point me to an example of how to pass user name and
password to the report server via the ReportViewer control?
 
Have you tried something like this?


ReportDocument report = new ReportDocument();
report.Load("myreport.rpt", "AppServerName");
report.SetDatabaseLogon("user", "pass", "server", "dbname");

// ...
// do whatever you want with your report.



Or do you need to pass credentials to the actual server itself to log
on?
 
Thanks for the response Donn.
I think you are referring to a Crystal Reports object.
I am working with SQL Server 2005 Reporting Services.
 
Hi AG,

Have you tried ReportViewer.ServerReport.SetDataSourceCredentials:

http://msdn2.microsoft.com/en-us/library/microsoft.reporting.webforms.server
report.setdatasourcecredentials(VS.80).aspx


Further reference:

#How to bypass/disable the authentication for reportviewer in a web form? -
MSDN Forums
http://forums.microsoft.com/MSDN/ShowPost.aspx?PostID=530501&SiteID=1
<quote>
You can disable prompting for data source credentials by using
ReportViewer.ShowCredentialPrompts = false. But you will still need to
manually supply the credentials to run the report using
ReportViewer.ServerReport.SetDataSourceCredentials().
</quote>


Please feel free to let me know if there's anything unclear. Thanks.


Regards,
Walter Wang ([email protected], remove 'online.')
Microsoft Online Community Support

==================================================
When responding to posts, please "Reply to Group" via your newsreader so
that others may learn and benefit from your issue.
==================================================

This posting is provided "AS IS" with no warranties, and confers no rights.
 
Thanks Walter.

As usual, help is wofully lacking on SetDataSourceCredentials, but it seems
like that applies to the report's datasource, not the report (server)
itself.

What I need is ReportServerCredentials.
I found this http://forums.asp.net/t/986174.aspx

When running the WAP on my development machine (Win XP IIS5), I can set the
report server to be the one on the shared web host and pass the credentials.
The reports work.
However, when I run the WAP on the shared web host and pass the same
credentials, I get the 401 unauthorized error.

Any ideas as to how to correct this?
 
Hi AG,

Sorry for the misunderstanding.

The new issue you mentioned is actually about how to make two IIS
server/web application accessing each other.

By default, a web application on IIS 6.0 runs in the default Application
Pool, which by default is running under the NETWORK SERVICE account. This
account is very limited, although it have network access, but you need to
grant it in either your local or remote sql/report server:

http://msdn2.microsoft.com/en-us/library/ms998320.aspx
<quote>
If you are accessing a database on another server in the same domain (or in
a trusted domain), the Network Service account's network credentials are
used to authenticate to the database. The Network Service account's
credentials are of the form DomainName\AspNetServer$, where DomainName is
the domain of the ASP.NET server and AspNetServer is your Web server name.

For example, if your ASP.NET application runs on a server named SVR1 in the
domain CONTOSO, the SQL Server sees a database access request from
CONTOSO\SVR1$.

To access a remote SQL Server using Network Service

To grant access to a remote database server in the same domain or a trusted
domain, follow the steps described earlier for a local database, except in
step 4, use the DomainName\AspNetServer$ account to create the database
login.
</quote>


Also:

http://msdn2.microsoft.com/en-us/library/ms998320.aspx
<quote>
In some scenarios, using a custom domain service account is a better
approach than using the Network Service account. You should use a custom
domain service account if:
You want to isolate multiple applications on a single server from one
another.
You need different access controls for each application on local and remote
resources. For example, other applications cannot access your application's
databases if access is restricted to your application's account.
You want to use Windows auditing to track the activity of each application
separately.
You want to prevent any accidental or deliberate changes to the access
controls or permissions associated with the general purpose Network Service
account from affecting your application.
</quote>

In this case, you will need to create a separate Application Pool in IIS
6.0 and configure it to use a custom domain service account; then configure
your web application to run in this Application Pool.

Pleaset let me know if you have anything unclear. Thanks.


Regards,
Walter Wang ([email protected], remove 'online.')
Microsoft Online Community Support

==================================================
When responding to posts, please "Reply to Group" via your newsreader so
that others may learn and benefit from your issue.
==================================================

This posting is provided "AS IS" with no warranties, and confers no rights.
 
Thanks Walter,

The problem is not authenticating to the SQL Server, but to the report
server.
I am checking with the webhost to find out if both machines are on the same
domain.

So, lets say the 'WebServer' is on 'Domain1' and the 'ReportServer' is on
'Domain2'.
There are three parameters to pass to the NetworkCredential - username,
password and domain.
Obviously username and password would be that for a user on the ReportServer
with the appropriate permissions to view the report in question.
What do I pass for the domain parameter? Domain1, Domain2, Domain1\Webserver
or what?

What if they are on the same domain?

Why would it work from my machine? My machine is definitely not in the
ReportServer's domain.

--

AG
Email: discussATadhdataDOTcom
"Walter Wang [MSFT]" said:
Hi AG,

Sorry for the misunderstanding.

The new issue you mentioned is actually about how to make two IIS
server/web application accessing each other.

By default, a web application on IIS 6.0 runs in the default Application
Pool, which by default is running under the NETWORK SERVICE account. This
account is very limited, although it have network access, but you need to
grant it in either your local or remote sql/report server:

http://msdn2.microsoft.com/en-us/library/ms998320.aspx
<quote>
If you are accessing a database on another server in the same domain (or
in
a trusted domain), the Network Service account's network credentials are
used to authenticate to the database. The Network Service account's
credentials are of the form DomainName\AspNetServer$, where DomainName is
the domain of the ASP.NET server and AspNetServer is your Web server name.

For example, if your ASP.NET application runs on a server named SVR1 in
the
domain CONTOSO, the SQL Server sees a database access request from
CONTOSO\SVR1$.

To access a remote SQL Server using Network Service

To grant access to a remote database server in the same domain or a
trusted
domain, follow the steps described earlier for a local database, except in
step 4, use the DomainName\AspNetServer$ account to create the database
login.
</quote>


Also:

http://msdn2.microsoft.com/en-us/library/ms998320.aspx
<quote>
In some scenarios, using a custom domain service account is a better
approach than using the Network Service account. You should use a custom
domain service account if:
You want to isolate multiple applications on a single server from one
another.
You need different access controls for each application on local and
remote
resources. For example, other applications cannot access your
application's
databases if access is restricted to your application's account.
You want to use Windows auditing to track the activity of each application
separately.
You want to prevent any accidental or deliberate changes to the access
controls or permissions associated with the general purpose Network
Service
account from affecting your application.
</quote>

In this case, you will need to create a separate Application Pool in IIS
6.0 and configure it to use a custom domain service account; then
configure
your web application to run in this Application Pool.

Pleaset let me know if you have anything unclear. Thanks.


Regards,
Walter Wang ([email protected], remove 'online.')
Microsoft Online Community Support

==================================================
When responding to posts, please "Reply to Group" via your newsreader so
that others may learn and benefit from your issue.
==================================================

This posting is provided "AS IS" with no warranties, and confers no
rights.
Click to expand...
 
Hi AG,

Not sure if it's the same issue, but give it a try:

#The request failed with HTTP status 401: Unauthorized? in
dotnet.framework.aspnet.webservices
http://msdn.microsoft.com/newsgroups/managed/default.aspx?dg=microsoft.publi
c.dotnet.framework.aspnet.webservices&tid=e1dcda98-a208-430c-96ed-a35e0a2460
25&m=1&p=1
<quote>
This solution solved my problem:
http://aspadvice.com/blogs/ssmith/archive/2007/02/09/SQL-Reporting-Services-
401-Error.aspx
</quote>

Basically it's fixed by this KB:

#You receive error 401.1 when you browse a Web site that uses Integrated
Authentication and is hosted on IIS 5.1 or IIS 6
http://support.microsoft.com/default.aspx?scid=kb;en-us;896861


Regards,
Walter Wang ([email protected], remove 'online.')
Microsoft Online Community Support

==================================================
When responding to posts, please "Reply to Group" via your newsreader so
that others may learn and benefit from your issue.
==================================================

This posting is provided "AS IS" with no warranties, and confers no rights.
 
Walter,

I have found out that the report server and web server are the same machine,
so I don't understand why there should be a problem, especially since
running the web app on my machine (far removed from both), the reports work
fine.

Since it works from my development machine, could it be that something needs
to be different in the passed network credential when the web app and report
server are on the same machine?

I am passing the credential using the code from
http://forums.asp.net/t/986174.aspx.
 
Hi AG,

I've done some test locally and cannot reproduce the issue on my side. I
tried both a domain user account and a local user account (on the report
server). To make sure we're using the similar configuration and code,
here's my relevant code and configuration:

1) ServerA: installed SQL Server 2005 with Reporting Service; all are
configured correctly to make sure visiting http://ServerA/ReportServer/
success
2) WorkstationB: developing system, Vista.
3) ServerA and WorkstationB are in the same domain.
4) Setup a local user account on ServerA and give this account "Browse"
permission on the server.
5) Used following code to pass the user account:

public class MyCredentials : IReportServerCredentials
{
private string m_user, m_pwd, m_domain;
public MyCredentials(string user, string pwd, string domain)
{
m_user = user;
m_pwd = pwd;
m_domain = domain;
}

#region IReportServerCredentials Members

public bool GetFormsCredentials(out System.Net.Cookie authCookie,
out string userName, out string password, out string authority)
{
authCookie = null;
userName = password = authority = null;
return false;
}

public System.Security.Principal.WindowsIdentity ImpersonationUser
{
get { return null; }
}

public System.Net.ICredentials NetworkCredentials
{
get
{
return new NetworkCredential(m_user, m_pwd, m_domain);
}
}

#endregion
}


6) Published the website to ServerA and verified it works correctly.
7) Repeat step 4) but with a domain user account.

-----------

Now would you please help me check following points so that we could
further troubleshoot this issue on your side:

* Check the event log, "Security" part, see the relevant "Failure Audit"
and post some of the records here.
* On the server or your workstation, right-click on IE shortcut and select
"Run As", and use the account that you're passing to the report server to
run IE, then visit http://yourserver/ReportServer to see if it works
* Check kb http://support.microsoft.com/kb/907273, especially this kb:
http://support.microsoft.com/kb/896861 to see if the registry fix (to
disable loopback check) helps or not. In my case, I don't need to do this
fix but yours scenario may vary.
* Check your IIS log on the server to see if there's any interesting logs
when the 401 error occurs.

By the way, I'm using the same web site on IIS server as the my asp.net web
application and the report server's web service, but running in two
different Application Pool, both application pools are using NETWORK
SERVICE account.



Regards,
Walter Wang ([email protected], remove 'online.')
Microsoft Online Community Support

==================================================
When responding to posts, please "Reply to Group" via your newsreader so
that others may learn and benefit from your issue.
==================================================

This posting is provided "AS IS" with no warranties, and confers no rights.
 
Walter,

I set up a similar arrangement here on a Windows 2003 Server and it also
works for me.
I spoke to the web host and asked him to review the logs and kb articles.
Also tried your suggestion of running IE (from my workstatiion) under the
same login as I am using for rs and still get the 401 error. I don't have
access to the server, so can't try that.

Waiting for results.

--

AG
Email: discussATadhdataDOTcom
"Walter Wang [MSFT]" said:
Hi AG,

I've done some test locally and cannot reproduce the issue on my side. I
tried both a domain user account and a local user account (on the report
server). To make sure we're using the similar configuration and code,
here's my relevant code and configuration:

1) ServerA: installed SQL Server 2005 with Reporting Service; all are
configured correctly to make sure visiting http://ServerA/ReportServer/
success
2) WorkstationB: developing system, Vista.
3) ServerA and WorkstationB are in the same domain.
4) Setup a local user account on ServerA and give this account "Browse"
permission on the server.
5) Used following code to pass the user account:

public class MyCredentials : IReportServerCredentials
{
private string m_user, m_pwd, m_domain;
public MyCredentials(string user, string pwd, string domain)
{
m_user = user;
m_pwd = pwd;
m_domain = domain;
}

#region IReportServerCredentials Members

public bool GetFormsCredentials(out System.Net.Cookie authCookie,
out string userName, out string password, out string authority)
{
authCookie = null;
userName = password = authority = null;
return false;
}

public System.Security.Principal.WindowsIdentity ImpersonationUser
{
get { return null; }
}

public System.Net.ICredentials NetworkCredentials
{
get
{
return new NetworkCredential(m_user, m_pwd, m_domain);
}
}

#endregion
}


6) Published the website to ServerA and verified it works correctly.
7) Repeat step 4) but with a domain user account.

-----------

Now would you please help me check following points so that we could
further troubleshoot this issue on your side:

* Check the event log, "Security" part, see the relevant "Failure Audit"
and post some of the records here.
* On the server or your workstation, right-click on IE shortcut and select
"Run As", and use the account that you're passing to the report server to
run IE, then visit http://yourserver/ReportServer to see if it works
* Check kb http://support.microsoft.com/kb/907273, especially this kb:
http://support.microsoft.com/kb/896861 to see if the registry fix (to
disable loopback check) helps or not. In my case, I don't need to do this
fix but yours scenario may vary.
* Check your IIS log on the server to see if there's any interesting logs
when the 401 error occurs.

By the way, I'm using the same web site on IIS server as the my asp.net
web
application and the report server's web service, but running in two
different Application Pool, both application pools are using NETWORK
SERVICE account.



Regards,
Walter Wang ([email protected], remove 'online.')
Microsoft Online Community Support

==================================================
When responding to posts, please "Reply to Group" via your newsreader so
that others may learn and benefit from your issue.
==================================================

This posting is provided "AS IS" with no warranties, and confers no
rights.
Click to expand...
 
Problem solved! Just heard back from the web host.
The report server site was set to integrated Windows authentication, while
web app site was set to basic.
Changed the report server site to basic and it works now.

--

AG
Email: discussATadhdataDOTcom
"Walter Wang [MSFT]" said:
Hi AG,

I've done some test locally and cannot reproduce the issue on my side. I
tried both a domain user account and a local user account (on the report
server). To make sure we're using the similar configuration and code,
here's my relevant code and configuration:

1) ServerA: installed SQL Server 2005 with Reporting Service; all are
configured correctly to make sure visiting http://ServerA/ReportServer/
success
2) WorkstationB: developing system, Vista.
3) ServerA and WorkstationB are in the same domain.
4) Setup a local user account on ServerA and give this account "Browse"
permission on the server.
5) Used following code to pass the user account:

public class MyCredentials : IReportServerCredentials
{
private string m_user, m_pwd, m_domain;
public MyCredentials(string user, string pwd, string domain)
{
m_user = user;
m_pwd = pwd;
m_domain = domain;
}

#region IReportServerCredentials Members

public bool GetFormsCredentials(out System.Net.Cookie authCookie,
out string userName, out string password, out string authority)
{
authCookie = null;
userName = password = authority = null;
return false;
}

public System.Security.Principal.WindowsIdentity ImpersonationUser
{
get { return null; }
}

public System.Net.ICredentials NetworkCredentials
{
get
{
return new NetworkCredential(m_user, m_pwd, m_domain);
}
}

#endregion
}


6) Published the website to ServerA and verified it works correctly.
7) Repeat step 4) but with a domain user account.

-----------

Now would you please help me check following points so that we could
further troubleshoot this issue on your side:

* Check the event log, "Security" part, see the relevant "Failure Audit"
and post some of the records here.
* On the server or your workstation, right-click on IE shortcut and select
"Run As", and use the account that you're passing to the report server to
run IE, then visit http://yourserver/ReportServer to see if it works
* Check kb http://support.microsoft.com/kb/907273, especially this kb:
http://support.microsoft.com/kb/896861 to see if the registry fix (to
disable loopback check) helps or not. In my case, I don't need to do this
fix but yours scenario may vary.
* Check your IIS log on the server to see if there's any interesting logs
when the 401 error occurs.

By the way, I'm using the same web site on IIS server as the my asp.net
web
application and the report server's web service, but running in two
different Application Pool, both application pools are using NETWORK
SERVICE account.



Regards,
Walter Wang ([email protected], remove 'online.')
Microsoft Online Community Support

==================================================
When responding to posts, please "Reply to Group" via your newsreader so
that others may learn and benefit from your issue.
==================================================

This posting is provided "AS IS" with no warranties, and confers no
rights.
Click to expand...
 
Hi AG,

I'm glad to hear to that the issue is not solved. Thanks for sharing the
cause here.


Regards,
Walter Wang ([email protected], remove 'online.')
Microsoft Online Community Support

==================================================
When responding to posts, please "Reply to Group" via your newsreader so
that others may learn and benefit from your issue.
==================================================

This posting is provided "AS IS" with no warranties, and confers no rights.
 
Back
Top