May 3, 2011 at 12:08 pm
I'm going to do my best to explain this scenario. I have several users who are in an AD group called IT PMO. IT PMO is in another AD group called IT GLOBAL. The IT GLOBAL group has been given access to a specific SSRS Report at a lower level than HOME (SSRS). They only want IT GLOBAL to have access to this specific report not every report in SSRS. Most of the users in IT PMO can access the report just fine. However, there are several users in IT PMO who can't even access Reporting Services. They get "permissions granted to user Domain\UserName are insufficient for performing this operation" when they try to open the default SSRS connection in IE. However, if I grant access to their specific user id, that user can access Reporting Services, but still can't see the specific report. Does anyone know why a User who has access to reporting services (thru an AD group (IT PMO) nested in another AD Group (IT GLOBAL)) can't access reporting services at all but some of the users in the same AD group can?
Please feel free to ask clarification questions. I know this is a bit confusing and I may not have explained it well.
Here is the error message from SSRS with Domain\UserName in place of real user info.
w3wp!library!a!5/3/2011-11:55:56:: e ERROR: Throwing Microsoft.ReportingServices.Diagnostics.Utilities.AccessDeniedException: The permissions granted to user 'Domain\UserName' are insufficient for performing this operation., ;
Info: Microsoft.ReportingServices.Diagnostics.Utilities.AccessDeniedException: The permissions granted to user 'Domain\UserName' are insufficient for performing this operation.
w3wp!ui!a!5/3/2011-11:55:56:: e ERROR: The permissions granted to user 'Domain\UserName' are insufficient for performing this operation.
w3wp!ui!a!5/3/2011-11:55:56:: e ERROR: HTTP status code --> 500
-------Details--------
Microsoft.ReportingServices.Diagnostics.Utilities.AccessDeniedException: The permissions granted to user 'Domain\UserName' are insufficient for performing this operation.
w3wp!ui!a!5/3/2011-11:55:56:: e ERROR: Exception in ShowErrorPage: System.Threading.ThreadAbortException: Thread was being aborted.
at System.Threading.Thread.AbortInternal()
at System.Threading.Thread.Abort(Object stateInfo)
at System.Web.HttpResponse.End()
at System.Web.HttpServerUtility.Transfer(String path, Boolean preserveForm)
at Microsoft.ReportingServices.UI.ReportingPage.ShowErrorPage(String errMsg) at at System.Threading.Thread.AbortInternal()
at System.Threading.Thread.Abort(Object stateInfo)
at System.Web.HttpResponse.End()
at System.Web.HttpServerUtility.Transfer(String path, Boolean preserveForm)
at Microsoft.ReportingServices.UI.ReportingPage.ShowErrorPage(String errMsg)
w3wp!library!6!5/3/2011-12:27:09:: e ERROR: Throwing Microsoft.ReportingServices.Diagnostics.Utilities.AccessDeniedException: The permissions granted to user 'Domain\UserName' are insufficient for performing this operation., ;
Info: Microsoft.ReportingServices.Diagnostics.Utilities.AccessDeniedException: The permissions granted to user 'Domain\UserName' are insufficient for performing this operation.
w3wp!ui!6!5/3/2011-12:27:09:: e ERROR: The permissions granted to user 'Domain\UserName' are insufficient for performing this operation.
w3wp!ui!6!5/3/2011-12:27:09:: e ERROR: HTTP status code --> 500
-------Details--------
Microsoft.ReportingServices.Diagnostics.Utilities.AccessDeniedException: The permissions granted to user 'Domain\UserName' are insufficient for performing this operation.
w3wp!ui!6!5/3/2011-12:27:10:: e ERROR: Exception in ShowErrorPage: System.Threading.ThreadAbortException: Thread was being aborted.
at System.Threading.Thread.AbortInternal()
at System.Threading.Thread.Abort(Object stateInfo)
at System.Web.HttpResponse.End()
at System.Web.HttpServerUtility.Transfer(String path, Boolean preserveForm)
at Microsoft.ReportingServices.UI.ReportingPage.ShowErrorPage(String errMsg) at at System.Threading.Thread.AbortInternal()
at System.Threading.Thread.Abort(Object stateInfo)
at System.Web.HttpResponse.End()
at System.Web.HttpServerUtility.Transfer(String path, Boolean preserveForm)
at Microsoft.ReportingServices.UI.ReportingPage.ShowErrorPage(String errMsg)
w3wp!library!f!5/3/2011-12:27:15:: e ERROR: Throwing Microsoft.ReportingServices.Diagnostics.Utilities.AccessDeniedException: The permissions granted to user 'Domain\UserName' are insufficient for performing this operation., ;
Info: Microsoft.ReportingServices.Diagnostics.Utilities.AccessDeniedException: The permissions granted to user 'Domain\UserName' are insufficient for performing this operation.
w3wp!ui!f!5/3/2011-12:27:15:: e ERROR: The permissions granted to user 'Domain\UserName' are insufficient for performing this operation.
w3wp!ui!f!5/3/2011-12:27:15:: e ERROR: HTTP status code --> 500
-------Details--------
Microsoft.ReportingServices.Diagnostics.Utilities.AccessDeniedException: The permissions granted to user 'Domain\UserName' are insufficient for performing this operation.
w3wp!ui!f!5/3/2011-12:27:15:: e ERROR: Exception in ShowErrorPage: System.Threading.ThreadAbortException: Thread was being aborted.
at System.Threading.Thread.AbortInternal()
at System.Threading.Thread.Abort(Object stateInfo)
May 3, 2011 at 12:14 pm
Are the people who can't access it a member of a different group that has been denied access?
Jason...AKA CirqueDeSQLeil
_______________________________________________
I have given a name to my pain...MCM SQL Server, MVP
SQL RNNR
Posting Performance Based Questions - Gail Shaw[/url]
Learn Extended Events
May 3, 2011 at 12:32 pm
No. But, they had problems with this access originally when this SSRS install was on a physical SSRS server. This SSRS server was just moved to a virtual machine. These issues started happening just after the move. According to the server admin, the VM is an exact clone of the old physical box. However, I have no way to verify this.
Also, sorry I forgot to mention the VM move in the original post....That's kind of important.:-)
May 3, 2011 at 12:36 pm
Since they had the issue prior to virtualization, it could be that something with the local groups is causing the issue. Have you checked the local security groups for the server to see if these people might be denied there, or that the people for whom it works might be added to an admin group at the server level? Worth checking.
Jason...AKA CirqueDeSQLeil
_______________________________________________
I have given a name to my pain...MCM SQL Server, MVP
SQL RNNR
Posting Performance Based Questions - Gail Shaw[/url]
Learn Extended Events
May 3, 2011 at 12:44 pm
We checked AD. One of the users who had access to the specific report was in an additional group, NW_Reports. The user who did not have access to the report was not in NW_Reports. We have added the non-access user to NW_Reports and are waiting for it to replicate out thru AD. I'm going to have the user test access at that point.
May 3, 2011 at 1:35 pm
The non-access user that was added to NW_Reports now has access to the specific report. Could this be an issue in AD?
May 3, 2011 at 1:41 pm
Not necessarily an issue in AD but somewhere down the pipe some permissions are granted to that group that are not granted to the original group.
Jason...AKA CirqueDeSQLeil
_______________________________________________
I have given a name to my pain...MCM SQL Server, MVP
SQL RNNR
Posting Performance Based Questions - Gail Shaw[/url]
Learn Extended Events
May 3, 2011 at 1:49 pm
Both users were originally in IT GLOBAL which has Browser and My reports access to the specific report. However, only the user that had access was originally in NW_REPORTS and it has Browser, Content Manager, My Reports, Publisher, Report Builder. From an SSRS standpoint, both users should have had access originally.
May 3, 2011 at 1:57 pm
Thank you for all your help!
May 3, 2011 at 2:03 pm
You're welcome.
Jason...AKA CirqueDeSQLeil
_______________________________________________
I have given a name to my pain...MCM SQL Server, MVP
SQL RNNR
Posting Performance Based Questions - Gail Shaw[/url]
Learn Extended Events
Viewing 10 posts - 1 through 9 (of 9 total)
You must be logged in to reply to this topic. Login to reply