Authentication over the internet

I am building an asp.net app that will use reporting services to show reports within the application. Users login to the application and when they need to see a report I use web services to render the report. The asp.net app and reporting services are on the same windows 2003 server (not using active directory).
Because reporting services uses Windows authentication and does not allow anonymous access, I have created a windows account (called "RSUser") that has access to my reports. When the user runs a report, I pass in the credentials for this windows account like this...
rs.Credentials = New System.Net.NetworkCredential("RSUser", "password", "domain")
This all works, and the report renders using the permissions from RSUser. The problem is that all the reports use treeviews for drill-down (and some use drill-through). When you expand a drill down you are prompted for a windows login. I think this is because this postback is now coming from the client PC, instead if from the asp.net app (i.e. on the server), and so reporting services needs to anthenticate this new user.
The only solution that I have found for this is developing a security extension for reporting services...
http://msdn.microsoft.com/library/?url=/library/en-us/dnsql2k/html/ufairs.asp?frame=true#ufairs_topic3
... but this seems like overkill and a very complicated process, and Microsoft says in the article that this is not fully tested and should not be used in a production environment (but that where I need it for).
Does anyone have a solution ?
Craig HBJust a thought: Have you tried to setup a individual Application pool that works with your RSUser Account?
"Craig HB" wrote:
> I am building an asp.net app that will use reporting services to show reports within the application. Users login to the application and when they need to see a report I use web services to render the report. The asp.net app and reporting services are on the same windows 2003 server (not using active directory).
> Because reporting services uses Windows authentication and does not allow anonymous access, I have created a windows account (called "RSUser") that has access to my reports. When the user runs a report, I pass in the credentials for this windows account like this...
> rs.Credentials = New System.Net.NetworkCredential("RSUser", "password", "domain")
> This all works, and the report renders using the permissions from RSUser. The problem is that all the reports use treeviews for drill-down (and some use drill-through). When you expand a drill down you are prompted for a windows login. I think this is because this postback is now coming from the client PC, instead if from the asp.net app (i.e. on the server), and so reporting services needs to anthenticate this new user.
> The only solution that I have found for this is developing a security extension for reporting services...
> http://msdn.microsoft.com/library/?url=/library/en-us/dnsql2k/html/ufairs.asp?frame=true#ufairs_topic3
> ... but this seems like overkill and a very complicated process, and Microsoft says in the article that this is not fully tested and should not be used in a production environment (but that where I need it for).
> Does anyone have a solution ?
> Craig HB|||Craig,
You are right. You get prompted because the drilldown and drillthough
interactive features require URL acccess and request goes out on the client
side of the application.
In a nutshell, if your reports have interactive features you need to go for
URL access. For Internet-oriented apps this means writing a custom security
extension. It is not that involved to write and I have deployed an
application that uses a custom security extension in a production
environment. There are some gotchas to avoid but in general my experience
writing custom security extensions have been positive and you will learn a
lot about how RS handles authentication and authorization.
--
Hope this helps.
---
Teo Lachev, MCSD, MCT
Author: "Microsoft Reporting Services in Action"
http://www.prologika.com
"Gash" <Gash@.discussions.microsoft.com> wrote in message
news:FFF038F5-4A21-4DFA-846C-6A3A84683D2D@.microsoft.com...
> Just a thought: Have you tried to setup a individual Application pool that
works with your RSUser Account?
> "Craig HB" wrote:
> > I am building an asp.net app that will use reporting services to show
reports within the application. Users login to the application and when they
need to see a report I use web services to render the report. The asp.net
app and reporting services are on the same windows 2003 server (not using
active directory).
> >
> > Because reporting services uses Windows authentication and does not
allow anonymous access, I have created a windows account (called "RSUser")
that has access to my reports. When the user runs a report, I pass in the
credentials for this windows account like this...
> >
> > rs.Credentials = New System.Net.NetworkCredential("RSUser", "password",
"domain")
> >
> > This all works, and the report renders using the permissions from
RSUser. The problem is that all the reports use treeviews for drill-down
(and some use drill-through). When you expand a drill down you are prompted
for a windows login. I think this is because this postback is now coming
from the client PC, instead if from the asp.net app (i.e. on the server),
and so reporting services needs to anthenticate this new user.
> >
> > The only solution that I have found for this is developing a security
extension for reporting services...
> >
> >
http://msdn.microsoft.com/library/?url=/library/en-us/dnsql2k/html/ufairs.asp?frame=true#ufairs_topic3
> >
> > ... but this seems like overkill and a very complicated process, and
Microsoft says in the article that this is not fully tested and should not
be used in a production environment (but that where I need it for).
> >
> > Does anyone have a solution ?
> >
> > Craig HB|||Start here
http://msdn.microsoft.com/library/?url=/library/en-us/dnsql2k/html/ufairs.asp?frame=true#ufairs_topic3
--
Hope this helps.
----
Teo Lachev, MCSD, MCT
Author: "Microsoft Reporting Services in Action"
Publisher website: http://www.manning.com/lachev
Buy it from Amazon.com: http://shrinkster.com/eq
Home page and blog: http://www.prologika.com/
----
"jbmeeh" <jbmeeh@.discussions.microsoft.com> wrote in message
news:3A2F7D63-C267-4CED-A5CC-4B42186B98B6@.microsoft.com...
> Is there any sample code for writing a custom security extension? I have
> already validated the user and I want to provide url access to the report
> server.
> "Teo" wrote:
> > Craig,
> >
> > You are right. You get prompted because the drilldown and drillthough
> > interactive features require URL acccess and request goes out on the
client
> > side of the application.
> >
> > In a nutshell, if your reports have interactive features you need to go
for
> > URL access. For Internet-oriented apps this means writing a custom
security
> > extension. It is not that involved to write and I have deployed an
> > application that uses a custom security extension in a production
> > environment. There are some gotchas to avoid but in general my
experience
> > writing custom security extensions have been positive and you will learn
a
> > lot about how RS handles authentication and authorization.
> >
> > --
> > Hope this helps.
> >
> > ---
> > Teo Lachev, MCSD, MCT
> > Author: "Microsoft Reporting Services in Action"
> > http://www.prologika.com
> >
> >
> > "Gash" <Gash@.discussions.microsoft.com> wrote in message
> > news:FFF038F5-4A21-4DFA-846C-6A3A84683D2D@.microsoft.com...
> > > Just a thought: Have you tried to setup a individual Application pool
that
> > works with your RSUser Account?
> > >
> > > "Craig HB" wrote:
> > >
> > > > I am building an asp.net app that will use reporting services to
show
> > reports within the application. Users login to the application and when
they
> > need to see a report I use web services to render the report. The
asp.net
> > app and reporting services are on the same windows 2003 server (not
using
> > active directory).
> > > >
> > > > Because reporting services uses Windows authentication and does not
> > allow anonymous access, I have created a windows account (called
"RSUser")
> > that has access to my reports. When the user runs a report, I pass in
the
> > credentials for this windows account like this...
> > > >
> > > > rs.Credentials = New System.Net.NetworkCredential("RSUser",
"password",
> > "domain")
> > > >
> > > > This all works, and the report renders using the permissions from
> > RSUser. The problem is that all the reports use treeviews for drill-down
> > (and some use drill-through). When you expand a drill down you are
prompted
> > for a windows login. I think this is because this postback is now coming
> > from the client PC, instead if from the asp.net app (i.e. on the
server),
> > and so reporting services needs to anthenticate this new user.
> > > >
> > > > The only solution that I have found for this is developing a
security
> > extension for reporting services...
> > > >
> > > >
> >
http://msdn.microsoft.com/library/?url=/library/en-us/dnsql2k/html/ufairs.asp?frame=true#ufairs_topic3
> > > >
> > > > ... but this seems like overkill and a very complicated process, and
> > Microsoft says in the article that this is not fully tested and should
not
> > be used in a production environment (but that where I need it for).
> > > >
> > > > Does anyone have a solution ?
> > > >
> > > > Craig HB
> >
> >
> >|||I have seen this article and it is good if I wanted to build a standalone
application to allow access to the report server. However, i have an existing
application with forms authentication in which I want to embed url access to
the report server. I was hoping that there would be code samples or an
article for this particular issue. I don't need to present another form to
the user to capture credentials. Can i use my existing forms authentication
ticket or do I need to create a new one. Do I call the LogonUser webservice
to create a cookie for a user that has been created on the report manager. It
seems like there are a lot of people trying to solve the same problem, but
not too many examples.
"Teo Lachev" wrote:
> Start here
> http://msdn.microsoft.com/library/?url=/library/en-us/dnsql2k/html/ufairs.asp?frame=true#ufairs_topic3
> --
> Hope this helps.
> ----
> Teo Lachev, MCSD, MCT
> Author: "Microsoft Reporting Services in Action"
> Publisher website: http://www.manning.com/lachev
> Buy it from Amazon.com: http://shrinkster.com/eq
> Home page and blog: http://www.prologika.com/
> ----
> "jbmeeh" <jbmeeh@.discussions.microsoft.com> wrote in message
> news:3A2F7D63-C267-4CED-A5CC-4B42186B98B6@.microsoft.com...
> > Is there any sample code for writing a custom security extension? I have
> > already validated the user and I want to provide url access to the report
> > server.
> >
> > "Teo" wrote:
> >
> > > Craig,
> > >
> > > You are right. You get prompted because the drilldown and drillthough
> > > interactive features require URL acccess and request goes out on the
> client
> > > side of the application.
> > >
> > > In a nutshell, if your reports have interactive features you need to go
> for
> > > URL access. For Internet-oriented apps this means writing a custom
> security
> > > extension. It is not that involved to write and I have deployed an
> > > application that uses a custom security extension in a production
> > > environment. There are some gotchas to avoid but in general my
> experience
> > > writing custom security extensions have been positive and you will learn
> a
> > > lot about how RS handles authentication and authorization.
> > >
> > > --
> > > Hope this helps.
> > >
> > > ---
> > > Teo Lachev, MCSD, MCT
> > > Author: "Microsoft Reporting Services in Action"
> > > http://www.prologika.com
> > >
> > >
> > > "Gash" <Gash@.discussions.microsoft.com> wrote in message
> > > news:FFF038F5-4A21-4DFA-846C-6A3A84683D2D@.microsoft.com...
> > > > Just a thought: Have you tried to setup a individual Application pool
> that
> > > works with your RSUser Account?
> > > >
> > > > "Craig HB" wrote:
> > > >
> > > > > I am building an asp.net app that will use reporting services to
> show
> > > reports within the application. Users login to the application and when
> they
> > > need to see a report I use web services to render the report. The
> asp.net
> > > app and reporting services are on the same windows 2003 server (not
> using
> > > active directory).
> > > > >
> > > > > Because reporting services uses Windows authentication and does not
> > > allow anonymous access, I have created a windows account (called
> "RSUser")
> > > that has access to my reports. When the user runs a report, I pass in
> the
> > > credentials for this windows account like this...
> > > > >
> > > > > rs.Credentials = New System.Net.NetworkCredential("RSUser",
> "password",
> > > "domain")
> > > > >
> > > > > This all works, and the report renders using the permissions from
> > > RSUser. The problem is that all the reports use treeviews for drill-down
> > > (and some use drill-through). When you expand a drill down you are
> prompted
> > > for a windows login. I think this is because this postback is now coming
> > > from the client PC, instead if from the asp.net app (i.e. on the
> server),
> > > and so reporting services needs to anthenticate this new user.
> > > > >
> > > > > The only solution that I have found for this is developing a
> security
> > > extension for reporting services...
> > > > >
> > > > >
> > >
> http://msdn.microsoft.com/library/?url=/library/en-us/dnsql2k/html/ufairs.asp?frame=true#ufairs_topic3
> > > > >
> > > > > ... but this seems like overkill and a very complicated process, and
> > > Microsoft says in the article that this is not fully tested and should
> not
> > > be used in a production environment (but that where I need it for).
> > > > >
> > > > > Does anyone have a solution ?
> > > > >
> > > > > Craig HB
> > >
> > >
> > >
>
>|||> Can i use my existing forms authentication
> ticket or do I need to create a new one.
No, you cannot use your app Forms Authentication ticket and you don't have
to have another logon form. Instead, your application needs to call the RS
LogonUser SOAP API once it authenticates the user. You will end up with two
authentication tickets (cookies) but this shouldn't be too much of an issue.
The MS article should be good enough to address you scenario. You just need
to understand how RS Forms Authentication works by debugging the extension.
I have a two-part article in the works for a magazine about Forms
Authentication. Unfortunately, judging by the editors speed, it won't make
it before the end of the year. Meanwhile, you can check the other threads
on this topic. It's been discussed many times.
--
Hope this helps.
----
Teo Lachev, MCSD, MCT
Author: "Microsoft Reporting Services in Action"
Publisher website: http://www.manning.com/lachev
Buy it from Amazon.com: http://shrinkster.com/eq
Home page and blog: http://www.prologika.com/
----
"jbmeeh" <jbmeeh@.discussions.microsoft.com> wrote in message
news:3F687097-1790-4FF9-B8CB-0A163BF3074C@.microsoft.com...
> I have seen this article and it is good if I wanted to build a standalone
> application to allow access to the report server. However, i have an
existing
> application with forms authentication in which I want to embed url access
to
> the report server. I was hoping that there would be code samples or an
> article for this particular issue. I don't need to present another form to
> the user to capture credentials. Can i use my existing forms
authentication
> ticket or do I need to create a new one. Do I call the LogonUser
webservice
> to create a cookie for a user that has been created on the report manager.
It
> seems like there are a lot of people trying to solve the same problem, but
> not too many examples.
> "Teo Lachev" wrote:
> > Start here
> >
http://msdn.microsoft.com/library/?url=/library/en-us/dnsql2k/html/ufairs.asp?frame=true#ufairs_topic3
> >
> > --
> > Hope this helps.
> >
> > ----
> > Teo Lachev, MCSD, MCT
> > Author: "Microsoft Reporting Services in Action"
> > Publisher website: http://www.manning.com/lachev
> > Buy it from Amazon.com: http://shrinkster.com/eq
> > Home page and blog: http://www.prologika.com/
> > ----
> >
> > "jbmeeh" <jbmeeh@.discussions.microsoft.com> wrote in message
> > news:3A2F7D63-C267-4CED-A5CC-4B42186B98B6@.microsoft.com...
> > > Is there any sample code for writing a custom security extension? I
have
> > > already validated the user and I want to provide url access to the
report
> > > server.
> > >
> > > "Teo" wrote:
> > >
> > > > Craig,
> > > >
> > > > You are right. You get prompted because the drilldown and
drillthough
> > > > interactive features require URL acccess and request goes out on the
> > client
> > > > side of the application.
> > > >
> > > > In a nutshell, if your reports have interactive features you need to
go
> > for
> > > > URL access. For Internet-oriented apps this means writing a custom
> > security
> > > > extension. It is not that involved to write and I have deployed an
> > > > application that uses a custom security extension in a production
> > > > environment. There are some gotchas to avoid but in general my
> > experience
> > > > writing custom security extensions have been positive and you will
learn
> > a
> > > > lot about how RS handles authentication and authorization.
> > > >
> > > > --
> > > > Hope this helps.
> > > >
> > > > ---
> > > > Teo Lachev, MCSD, MCT
> > > > Author: "Microsoft Reporting Services in Action"
> > > > http://www.prologika.com
> > > >
> > > >
> > > > "Gash" <Gash@.discussions.microsoft.com> wrote in message
> > > > news:FFF038F5-4A21-4DFA-846C-6A3A84683D2D@.microsoft.com...
> > > > > Just a thought: Have you tried to setup a individual Application
pool
> > that
> > > > works with your RSUser Account?
> > > > >
> > > > > "Craig HB" wrote:
> > > > >
> > > > > > I am building an asp.net app that will use reporting services to
> > show
> > > > reports within the application. Users login to the application and
when
> > they
> > > > need to see a report I use web services to render the report. The
> > asp.net
> > > > app and reporting services are on the same windows 2003 server (not
> > using
> > > > active directory).
> > > > > >
> > > > > > Because reporting services uses Windows authentication and does
not
> > > > allow anonymous access, I have created a windows account (called
> > "RSUser")
> > > > that has access to my reports. When the user runs a report, I pass
in
> > the
> > > > credentials for this windows account like this...
> > > > > >
> > > > > > rs.Credentials = New System.Net.NetworkCredential("RSUser",
> > "password",
> > > > "domain")
> > > > > >
> > > > > > This all works, and the report renders using the permissions
from
> > > > RSUser. The problem is that all the reports use treeviews for
drill-down
> > > > (and some use drill-through). When you expand a drill down you are
> > prompted
> > > > for a windows login. I think this is because this postback is now
coming
> > > > from the client PC, instead if from the asp.net app (i.e. on the
> > server),
> > > > and so reporting services needs to anthenticate this new user.
> > > > > >
> > > > > > The only solution that I have found for this is developing a
> > security
> > > > extension for reporting services...
> > > > > >
> > > > > >
> > > >
> >
http://msdn.microsoft.com/library/?url=/library/en-us/dnsql2k/html/ufairs.asp?frame=true#ufairs_topic3
> > > > > >
> > > > > > ... but this seems like overkill and a very complicated process,
and
> > > > Microsoft says in the article that this is not fully tested and
should
> > not
> > > > be used in a production environment (but that where I need it for).
> > > > > >
> > > > > > Does anyone have a solution ?
> > > > > >
> > > > > > Craig HB
> > > >
> > > >
> > > >
> >
> >
> >|||Is there any sample code for writing a custom security extension? I have
already validated the user and I want to provide url access to the report
server.
"Teo" wrote:
> Craig,
> You are right. You get prompted because the drilldown and drillthough
> interactive features require URL acccess and request goes out on the client
> side of the application.
> In a nutshell, if your reports have interactive features you need to go for
> URL access. For Internet-oriented apps this means writing a custom security
> extension. It is not that involved to write and I have deployed an
> application that uses a custom security extension in a production
> environment. There are some gotchas to avoid but in general my experience
> writing custom security extensions have been positive and you will learn a
> lot about how RS handles authentication and authorization.
> --
> Hope this helps.
> ---
> Teo Lachev, MCSD, MCT
> Author: "Microsoft Reporting Services in Action"
> http://www.prologika.com
>
> "Gash" <Gash@.discussions.microsoft.com> wrote in message
> news:FFF038F5-4A21-4DFA-846C-6A3A84683D2D@.microsoft.com...
> > Just a thought: Have you tried to setup a individual Application pool that
> works with your RSUser Account?
> >
> > "Craig HB" wrote:
> >
> > > I am building an asp.net app that will use reporting services to show
> reports within the application. Users login to the application and when they
> need to see a report I use web services to render the report. The asp.net
> app and reporting services are on the same windows 2003 server (not using
> active directory).
> > >
> > > Because reporting services uses Windows authentication and does not
> allow anonymous access, I have created a windows account (called "RSUser")
> that has access to my reports. When the user runs a report, I pass in the
> credentials for this windows account like this...
> > >
> > > rs.Credentials = New System.Net.NetworkCredential("RSUser", "password",
> "domain")
> > >
> > > This all works, and the report renders using the permissions from
> RSUser. The problem is that all the reports use treeviews for drill-down
> (and some use drill-through). When you expand a drill down you are prompted
> for a windows login. I think this is because this postback is now coming
> from the client PC, instead if from the asp.net app (i.e. on the server),
> and so reporting services needs to anthenticate this new user.
> > >
> > > The only solution that I have found for this is developing a security
> extension for reporting services...
> > >
> > >
> http://msdn.microsoft.com/library/?url=/library/en-us/dnsql2k/html/ufairs.asp?frame=true#ufairs_topic3
> > >
> > > ... but this seems like overkill and a very complicated process, and
> Microsoft says in the article that this is not fully tested and should not
> be used in a production environment (but that where I need it for).
> > >
> > > Does anyone have a solution ?
> > >
> > > Craig HB
>
>|||Teo. Is it possible to use web forms authentication with the standard
edition of RS?
If not, I'm guessing there is no other way to use the viewer over the
Internet..
Thanks, AHH
BTW: I bought your book - best one out there..|||Thanks. No, extending RS requires Enterprise Edition. Sorry.
How about generating reports on the server side of the app and sacrificing
the interactive features and the toolbar?
--
Hope this helps.
----
Teo Lachev, MCSD, MCT
Author: "Microsoft Reporting Services in Action"
Publisher website: http://www.manning.com/lachev
Buy it from Amazon.com: http://shrinkster.com/eq
Home page and blog: http://www.prologika.com/
----
"AHH" <AHH@.discussions.microsoft.com> wrote in message
news:13CACEA1-BD84-4D6A-BB25-63D43E0F56A8@.microsoft.com...
> Teo. Is it possible to use web forms authentication with the standard
> edition of RS?
> If not, I'm guessing there is no other way to use the viewer over the
> Internet..
> Thanks, AHH
> BTW: I bought your book - best one out there..

Authentication and Internet

Hey,

I just installed the lastest verion of ms sql server. I'm new to ms sql so please keep that in mind :-).

I installed the server, and read through a large amount of the help documentation. I then created my nwind directory in my wwwroot folder.

I created a new database, set that as the default database, then I created a simple table in this database with a few entries. I used

http://<SERVERIP>/nwind?sql=SELECT+*+FROM+test+FOR+XML+AUTO&root=root

to query and test my database. it worked, YAY. However at this point in the nwind properties I was using windows authentication.

This worked fine for me, and accross the network. However its not a nice solution as I'd rather not make users log in. (incidently when I got people to test this across the internet they just saw a blank white page, not sure why).

So I decided to use the third option on the security page. (forget the wording, but the option where you send a clear login text, or something to that affect).

When I tested this, the browser said "cannot find server". and displayed the typical you've deleted everything signs. However when I changed it back to windows authentication is started working again.

I then tested the always login as, and created an account. This gave me the same result.

So now, basically I'm trying to get the third option (sending a clear login text) to work. But I have no idea what to do to fix it, and I can't find any useful documentation anywhere.

Thanks A LOT for your time. I'm dieing to play with this but I can't seem to get it to work for me {:-(Hey, I forgot to mension

I'm using Windows 2000 Pro

ISS Server is installed and working fine. And wwwroot is the root dir of the webserver.

.net is installed, and it has every patch (windows) I could find. There is no firewall running. I'm connected to the internet through a router.

I'm forwarding the ports 20, 21, 40 to the computer (but I'm trying to view it internally so none of that should matter at this stage).

thx again

Authentication across internet

From what I have understood, Reporting Services could be configured to use Basic Authentication. In this way, a user can access a RS-server across the internet and he/she will be prompted for a valid username/password when trying to access.

However, from what I can understand this username and password will be sent uncrypted over the Internet (from the client machine to the RS-server), right?

My problem is, I need to give access to users acress the internet to a RS-server. The users uses all kind of operating systems (Windows, Linux, MacOS tec). And the communication needs to be encrypted.

How would you recommend me to implement security for this solution? I guess some kind of "Forms authentication" will have to be used? But how to make sure the data traffic is encrypted? And where do you recommend me to store the username and passwords? In an Active Directory on the server side, or in a separate database on the server side?

regards Andreas

You need to set up your report server to use SSL, that way all communication is encrypted. This would be done in IIS but also requires some config chages to reporting services.

Both Basic authentication and Forms would work in this scenario.

Use AD for the user accounts if possible.

|||

Thank you for your quick reply!
My SSL experience is very limited as well, but I guess it means that I need to buy a certificate from some trusted store? Otherwise the clients will always be warned when trying to connect, right?

Regards Andreas

|||If you have a fix client list, give them a link to download your own CA public key should be good enough. Of coz if its facing internet I suggest you pay for SSL. Not only your authentication, your report data are flying nude via the line, I guess that might be another issue and reason why SSL is required.|||

Ok, thank you for your answers! An SSL-certificate it will be!

Just so that I didn't missunderstood. If I configure IIS to use SSL, the login name and password will be safly encrypted, even if I use Basic authentication, or?

Regards Andreas

|||Yes, ALL communication is encrypted.sql

Authenticating to Native SQL 2005 Web Services

Hi,
In a SOA architecture, is it possible for an Internet (NOT intranet) user
of a Windows Forms app to authenticate with the Native Web Services of SQL
Server 2005 using Windows Integrated Authentication? The users would NOT be
in the same domain or in a trusted domain. If so, could you point me to som
e
configuration instructions please.
Thanks.
--
JohnHello John,
Based on my scope, Integrated Windows Authentication works only in
scenarios where the client computer can contact a domain controller to
validate their credentials or keep a circuit open for point to point
connection to server. In most firewall configurations, this scenario is not
possible and not desirable. Though it is not IIS, the requirement are
similar:
IIS Authentication and Security for Internet Developers
http://msdn.microsoft.com/library/d...-us/dnauth/html
/dnauth_security.asp
264921.KB.EN-US INFO: How IIS Authenticates Browser Clients
http://support.microsoft.com/defaul...KB;EN-US;264921
Internet Information Services 5.0 Authentication Methods
http://www.windowsitpro.com/article...?articleid=8443
IIS 101: The Basics of IIS Authentication
http://www.iisadministrator.com/Art...ArticleID=15843
As for authentication of Web service in SQL 2005, it requests client to
send credential to server directly. Otherwise it fails.
Regards,
Peter Yang
MCSE2000/2003, MCSA, MCDBA
Microsoft Online Partner Support
When responding to posts, please "Reply to Group" via your newsreader so
that others may learn and benefit from your issue.
========================================
=============
This posting is provided "AS IS" with no warranties, and confers no rights.
| Thread-Topic: Authenticating to Native SQL 2005 Web Services
| thread-index: AcXeqMzup44GBeNiRta2Kazq0yKi6Q==
| X-WBNR-Posting-Host: 71.192.119.68
| From: "examnotes" <Jthayer@.online.nospam>
| Subject: Authenticating to Native SQL 2005 Web Services
| Date: Mon, 31 Oct 2005 21:55:02 -0800
| Lines: 9
| Message-ID: <E83A79C0-D7BB-4C3A-9435-166B06A081FA@.microsoft.com>
| MIME-Version: 1.0
| Content-Type: text/plain;
| charset="Utf-8"
| Content-Transfer-Encoding: 7bit
| X-Newsreader: Microsoft CDO for Windows 2000
| Content-Class: urn:content-classes:message
| Importance: normal
| Priority: normal
| X-MimeOLE: Produced By Microsoft MimeOLE V6.00.3790.0
| Newsgroups: microsoft.public.sqlserver.security
| NNTP-Posting-Host: TK2MSFTNGXA03.phx.gbl 10.40.2.250
| Path: TK2MSFTNGXA01.phx.gbl!TK2MSFTNGXA03.phx.gbl
| Xref: TK2MSFTNGXA01.phx.gbl microsoft.public.sqlserver.security:6416
| X-Tomcat-NG: microsoft.public.sqlserver.security
|
| Hi,
| In a SOA architecture, is it possible for an Internet (NOT intranet)
user
| of a Windows Forms app to authenticate with the Native Web Services of
SQL
| Server 2005 using Windows Integrated Authentication? The users would NOT
be
| in the same domain or in a trusted domain. If so, could you point me to
some
| configuration instructions please.
| Thanks.
| --
| John
|

Authenticating a report render from a browser

I am copying the question from another member as it is exactly my problem:
We have an extranet application (internet users) written in ASP using
VB COM. All the security of what reports users can see is handled
through this application. Is there anyway we can link RS reports using
a URL? In otherwords, users will login like they currently do now and
our application will provide a report list for them. When they run a
report, they will basically click on a link that points to the RS
report. Ideally, when the user logs in initially, they will be
validated by the current application and then be validated against RS
(background). We need this to be as transparent as possible.
I have seen this posted in several different ways, but without any
resolution. Is there no way to accomplish this?
Thanks.we have the same situation. One way to do it is to create a custom
security extension for RS and call it through web services SOAP. You
can either redirect to an aspx page that calls it or maybe call the
webservice in your asp page directly. You should read this article as
it explains it all http://www.devx.com/dotnet/Article/26759|||Marv,
I appreciate the reply and have checked out the web site you referenced. I
hate to be a wimp, but I'm kind of a one-man band and don't have a lot of
time (or a lot of the requisite experience) to undertake a project for what I
was hoping to be a simple solution.
I take it there is just no simple way to tell the Report Server to run the
report on request without additional authentication. It seems like there
should be some setting either in the manager or on the command line that
could accomplish this. I have tried various role assignments, but they seem
to be limited to the server on which the RS resides and all our user
authenication comes from a different domain (and we don't use active
directory).
Anyway, thanks for the response.
Dave
"Marv" wrote:
> we have the same situation. One way to do it is to create a custom
> security extension for RS and call it through web services SOAP. You
> can either redirect to an aspx page that calls it or maybe call the
> webservice in your asp page directly. You should read this article as
> it explains it all http://www.devx.com/dotnet/Article/26759
>|||"Dave" wrote:
> I take it there is just no simple way to tell the Report Server to run the
> report on request without additional authentication.
Without getting into the benfits of ADS, the security model and the
vulnerabilities, etc., if you supply (or remove) the necessary credentials to
the data source and can render the report; you could display the report in an
iframe. It would appear as though it was part of your existing application.
src=http://someserver/reportserver?/FolderName/Report&rs:Command=Render&rc:toolbar=false
Caveat emptor. Someone will find the links.
Just a thought.

attempt to copy 2005 db ouside my network shows wrong db?

I connected to an sql 2005 located out on the Internet.
I can export the database I have permissions for and its data ok.
When I right click on the db and choose copy, I get an error at the end of the
wizard saying that Database 'dbThatIsDifferentThanMine' cannot be opened because
it is offline. Error 942.
That database shows up in the managment console, and it is offline, but it is
not the one I right clicked on to copy. I don't have permission to put that
database online, just permissions for the one I want to copy.
How can I resolve this?
--
Thanks in advance, Les CaudleHi
I am not sure why this is not selecting your database when you right click!
Have you tried left clicking before you right click?
An althernative you be to backup and restore the database into a new copy,
you can do this in a query window. If you need to do this often then creating
a script will probably end up being quicker.
John
"Les Caudle" wrote:
> I connected to an sql 2005 located out on the Internet.
> I can export the database I have permissions for and its data ok.
> When I right click on the db and choose copy, I get an error at the end of the
> wizard saying that Database 'dbThatIsDifferentThanMine' cannot be opened because
> it is offline. Error 942.
> That database shows up in the managment console, and it is offline, but it is
> not the one I right clicked on to copy. I don't have permission to put that
> database online, just permissions for the one I want to copy.
> How can I resolve this?
> --
> Thanks in advance, Les Caudle
>|||John - Yes, I'd clicked on the database first. Very strange.
This is on a client's ISP's shared web server. I only have access to his
database - and am going to need to grab it.
Can I backup and restore in this circumstance - as you suggested? I think I'm
going to be limited in what I can do.
Thanks, Les Caudle
On Sun, 25 Jun 2006 00:00:02 -0700, John Bell <jbellnewsposts@.hotmail.com>
wrote:
>Hi
>I am not sure why this is not selecting your database when you right click!
>Have you tried left clicking before you right click?
>An althernative you be to backup and restore the database into a new copy,
>you can do this in a query window. If you need to do this often then creating
>a script will probably end up being quicker.
>John
>"Les Caudle" wrote:
>> I connected to an sql 2005 located out on the Internet.
>> I can export the database I have permissions for and its data ok.
>> When I right click on the db and choose copy, I get an error at the end of the
>> wizard saying that Database 'dbThatIsDifferentThanMine' cannot be opened because
>> it is offline. Error 942.
>> That database shows up in the managment console, and it is offline, but it is
>> not the one I right clicked on to copy. I don't have permission to put that
>> database online, just permissions for the one I want to copy.
>> How can I resolve this?
>> --
>> Thanks in advance, Les Caudle|||Les Caudle wrote:
> John - Yes, I'd clicked on the database first. Very strange.
> This is on a client's ISP's shared web server. I only have access to his
> database - and am going to need to grab it.
> Can I backup and restore in this circumstance - as you suggested? I think I'm
> going to be limited in what I can do.
>
Providing you can connect with Query Analyzer or Management Studio, and
have a directory that SQL can write to, you should be able to use the
BACKUP and RESTORE commands to do a backup and restore.|||Hi
To backup the datbase you will need in the db_backupoperator, db_owner or a
sysadmin role, for restoring you will need to be a sysadmin or in dbcreator
role.
To use sp_attach_db you will need CREATE DATABASE, CREATE ANY DATABASE, or
ALTER ANY DATABASE permission, for sp_detach_db you will need to be a
db_owner.
I suspect that the copy wizard may not be working because you fail on some
or all of these privileges. By doing a manual backup you may get a message
saying that you do not have the privileges to carry out the opertation.
John
"Les Caudle" wrote:
> John - Yes, I'd clicked on the database first. Very strange.
> This is on a client's ISP's shared web server. I only have access to his
> database - and am going to need to grab it.
> Can I backup and restore in this circumstance - as you suggested? I think I'm
> going to be limited in what I can do.
> Thanks, Les Caudle
>
> On Sun, 25 Jun 2006 00:00:02 -0700, John Bell <jbellnewsposts@.hotmail.com>
> wrote:
> >Hi
> >
> >I am not sure why this is not selecting your database when you right click!
> >Have you tried left clicking before you right click?
> >
> >An althernative you be to backup and restore the database into a new copy,
> >you can do this in a query window. If you need to do this often then creating
> >a script will probably end up being quicker.
> >
> >John
> >
> >"Les Caudle" wrote:
> >
> >> I connected to an sql 2005 located out on the Internet.
> >>
> >> I can export the database I have permissions for and its data ok.
> >>
> >> When I right click on the db and choose copy, I get an error at the end of the
> >> wizard saying that Database 'dbThatIsDifferentThanMine' cannot be opened because
> >> it is offline. Error 942.
> >>
> >> That database shows up in the managment console, and it is offline, but it is
> >> not the one I right clicked on to copy. I don't have permission to put that
> >> database online, just permissions for the one I want to copy.
> >>
> >> How can I resolve this?
> >> --
> >> Thanks in advance, Les Caudle
> >>
>

attempt to copy 2005 db ouside my network shows wrong db?

I connected to an sql 2005 located out on the Internet.
I can export the database I have permissions for and its data ok.
When I right click on the db and choose copy, I get an error at the end of
the
wizard saying that Database 'dbThatIsDifferentThanMine' cannot be opened bec
ause
it is offline. Error 942.
That database shows up in the managment console, and it is offline, but it i
s
not the one I right clicked on to copy. I don't have permission to put that
database online, just permissions for the one I want to copy.
How can I resolve this?
--
Thanks in advance, Les CaudleHi
I am not sure why this is not selecting your database when you right click!
Have you tried left clicking before you right click?
An althernative you be to backup and restore the database into a new copy,
you can do this in a query window. If you need to do this often then creatin
g
a script will probably end up being quicker.
John
"Les Caudle" wrote:

> I connected to an sql 2005 located out on the Internet.
> I can export the database I have permissions for and its data ok.
> When I right click on the db and choose copy, I get an error at the end o
f the
> wizard saying that Database 'dbThatIsDifferentThanMine' cannot be opened b
ecause
> it is offline. Error 942.
> That database shows up in the managment console, and it is offline, but it
is
> not the one I right clicked on to copy. I don't have permission to put th
at
> database online, just permissions for the one I want to copy.
> How can I resolve this?
> --
> Thanks in advance, Les Caudle
>|||Hi
I am not sure why this is not selecting your database when you right click!
Have you tried left clicking before you right click?
An althernative you be to backup and restore the database into a new copy,
you can do this in a query window. If you need to do this often then creatin
g
a script will probably end up being quicker.
John
"Les Caudle" wrote:

> I connected to an sql 2005 located out on the Internet.
> I can export the database I have permissions for and its data ok.
> When I right click on the db and choose copy, I get an error at the end o
f the
> wizard saying that Database 'dbThatIsDifferentThanMine' cannot be opened b
ecause
> it is offline. Error 942.
> That database shows up in the managment console, and it is offline, but it
is
> not the one I right clicked on to copy. I don't have permission to put th
at
> database online, just permissions for the one I want to copy.
> How can I resolve this?
> --
> Thanks in advance, Les Caudle
>|||John - Yes, I'd clicked on the database first. Very strange.
This is on a client's ISP's shared web server. I only have access to his
database - and am going to need to grab it.
Can I backup and restore in this circumstance - as you suggested? I think I
'm
going to be limited in what I can do.
Thanks, Les Caudle
On Sun, 25 Jun 2006 00:00:02 -0700, John Bell <jbellnewsposts@.hotmail.com>
wrote:
[vbcol=seagreen]
>Hi
>I am not sure why this is not selecting your database when you right click!
>Have you tried left clicking before you right click?
>An althernative you be to backup and restore the database into a new copy,
>you can do this in a query window. If you need to do this often then creati
ng
>a script will probably end up being quicker.
>John
>"Les Caudle" wrote:
>|||John - Yes, I'd clicked on the database first. Very strange.
This is on a client's ISP's shared web server. I only have access to his
database - and am going to need to grab it.
Can I backup and restore in this circumstance - as you suggested? I think I
'm
going to be limited in what I can do.
Thanks, Les Caudle
On Sun, 25 Jun 2006 00:00:02 -0700, John Bell <jbellnewsposts@.hotmail.com>
wrote:
[vbcol=seagreen]
>Hi
>I am not sure why this is not selecting your database when you right click!
>Have you tried left clicking before you right click?
>An althernative you be to backup and restore the database into a new copy,
>you can do this in a query window. If you need to do this often then creati
ng
>a script will probably end up being quicker.
>John
>"Les Caudle" wrote:
>|||Les Caudle wrote:
> John - Yes, I'd clicked on the database first. Very strange.
> This is on a client's ISP's shared web server. I only have access to his
> database - and am going to need to grab it.
> Can I backup and restore in this circumstance - as you suggested? I think
I'm
> going to be limited in what I can do.
>
Providing you can connect with Query Analyzer or Management Studio, and
have a directory that SQL can write to, you should be able to use the
BACKUP and RESTORE commands to do a backup and restore.|||Les Caudle wrote:
> John - Yes, I'd clicked on the database first. Very strange.
> This is on a client's ISP's shared web server. I only have access to his
> database - and am going to need to grab it.
> Can I backup and restore in this circumstance - as you suggested? I think
I'm
> going to be limited in what I can do.
>
Providing you can connect with Query Analyzer or Management Studio, and
have a directory that SQL can write to, you should be able to use the
BACKUP and RESTORE commands to do a backup and restore.|||Hi
To backup the datbase you will need in the db_backupoperator, db_owner or a
sysadmin role, for restoring you will need to be a sysadmin or in dbcreator
role.
To use sp_attach_db you will need CREATE DATABASE, CREATE ANY DATABASE, or
ALTER ANY DATABASE permission, for sp_detach_db you will need to be a
db_owner.
I suspect that the copy wizard may not be working because you fail on some
or all of these privileges. By doing a manual backup you may get a message
saying that you do not have the privileges to carry out the opertation.
John
"Les Caudle" wrote:

> John - Yes, I'd clicked on the database first. Very strange.
> This is on a client's ISP's shared web server. I only have access to his
> database - and am going to need to grab it.
> Can I backup and restore in this circumstance - as you suggested? I think
I'm
> going to be limited in what I can do.
> Thanks, Les Caudle
>
> On Sun, 25 Jun 2006 00:00:02 -0700, John Bell <jbellnewsposts@.hotmail.com>
> wrote:
>
>|||Hi
To backup the datbase you will need in the db_backupoperator, db_owner or a
sysadmin role, for restoring you will need to be a sysadmin or in dbcreator
role.
To use sp_attach_db you will need CREATE DATABASE, CREATE ANY DATABASE, or
ALTER ANY DATABASE permission, for sp_detach_db you will need to be a
db_owner.
I suspect that the copy wizard may not be working because you fail on some
or all of these privileges. By doing a manual backup you may get a message
saying that you do not have the privileges to carry out the opertation.
John
"Les Caudle" wrote:

> John - Yes, I'd clicked on the database first. Very strange.
> This is on a client's ISP's shared web server. I only have access to his
> database - and am going to need to grab it.
> Can I backup and restore in this circumstance - as you suggested? I think
I'm
> going to be limited in what I can do.
> Thanks, Les Caudle
>
> On Sun, 25 Jun 2006 00:00:02 -0700, John Bell <jbellnewsposts@.hotmail.com>
> wrote:
>
>