Post reply

Security issue in reporting Services. Need help urgent!!!!

  • May 18, 2006 at 6:37 am

    #112253

    Hi,

    We have installed SQL Server ReportingServices on a machine which can

    be accessed from out side. now any one who types

    http:\\sitename.com\reportserver can access the reports hosted here.

    pls give me some solution how to solve this issue.

    We tried removing anonymous access for that reportserver in IIS . but

    then our application is not able to access the reports as we stored the

    URLs of reports in database and call the reports when its required to

    create a report.

    is this the right way to implement the reporting services ?

    Jeswanth

    --------------------------------

  • May 18, 2006 at 8:49 am

    #638760

    > is this the right way to implement the reporting services ?

    Blocking anonymous access is the correct part, yes.

    Remember there are three steps to running reports from an application:

    1.  Set a reference to the Reporting Services Web Service

    2.  Set the security credentials

    3.  Call the methods on the web service (usually .Render).

    You should have set up some security accounts on your report server that can access the reports (either machine-level or domain level).  The web service has a .Credentials property your developers will use to impersonate one of the security accounts.  Lots of info on this in BOL.

    If those URLs in your database are passed to the user, who then browse directly to the URL, then those users will need to connect to the web server via NT authentication, which is why app developers prefer to use the web service and handle the security internally.

    -Eddie

    Eddie Wuerch
    MCM: SQL

  • May 24, 2006 at 7:34 am

    #639766

    Hi

    Thanks Eddie. your feed back was really help full.

    Thanks

    Jeswanth Jaishanker

    --------------------------------

Viewing 3 posts - 1 through 2 (of 2 total)

You must be logged in to reply to this topic. Login to reply