AUTHORIZATION with WINDOWS AUTHENTICATION HELP!

i want to implement authorization with windows authentication and don't
have the slightest clue of how to do this implementation. the basic
windows authentication for this .NET application is already setup. my
problem lies within my inability to manipulate the username captured in
the authentication process and my knowledge of how IIS is involved.

specifically, i have the following questions:
1) what object(s) can be used so that the user's username can be
manipulated for the authorization process?
2) in order to apply roles, do the users need to be placed in groups in
IIS? if so, how does this work?
3) is all the code that the application uses for roles in web.config?
or does global.asax play a role in this matter?
4) does the web.config file know to communicate with IIS because the
authorization type is set to windows?
5) once authorization is in place, can a section of an .aspx file be
visible to a group or can only entire files be secured for a group?

as you can see, i'm trying to figure out the relationship between
authorization and windows authentication so any help would be
appreciated.

thanks,
john
e: phreeskier@.gmail.comThis is the wrong group, try one of the microsoft.*dotnet* groups.

Authorization windows - Invalid authorization specification

Hi, Experts.
Another problem with Reporting Services authentication:
We have a windows 2003 server + iis 6.0 +Reporting Setvices
whose reports access to a sql server windows 2003 (both are situated
in the same domain).
Since I must use stored credentials in order to create subscriptions
I've decided to put a user from domain windows in stored
authentication.
As the result I´ve obtain the following error:
Error al procesar el informe. (rsProcessingAborted) Obtener ayuda en
línea
No se puede crear una conexión al origen de datos Ventas.
(rsErrorOpeningConnection) Obtener ayuda en línea
Invalid authorization specification
The user I've chosen is the same that I use to design reports and to
access the sql server usually, so I don´t understand the cause of this
error.
Good. Seeing that it has not work I´ve changed the user to "sa" and
everything works fine.
The unique problem I have that according to the policy secuirty of the
company
it is forbidden to use the sa user in order to execute the reports.
Windows authentication is strongly recommended. Any idea?
Regards
Maciej KiewraHi, Experts.
The ServicePack is the real reason of my problem.
I´ve removed RS and I've installed it again (without applying service pack)
everything ok.
Then I've installed the servicepack and now "windows authentication" does not work.
I know that in the service pack 1 a new System Property has been add that
permits the windows authentication to be disabled, but this parameter is set
to true, so it is not a case.
It seems that Reporting Service is already very premature
Regards
Maciej Kiewra
mkiewra@.mail.fujitsu.es (Maciej Kiewra) wrote in message news:<bc86bf57.0504050912.36611411@.posting.google.com>...
> Hi, Experts.
>
> Another problem with Reporting Services authentication:
> We have a windows 2003 server + iis 6.0 +Reporting Setvices
> whose reports access to a sql server windows 2003 (both are situated
> in the same domain).
> Since I must use stored credentials in order to create subscriptions
> I've decided to put a user from domain windows in stored
> authentication.
> As the result I´ve obtain the following error:
> Error al procesar el informe. (rsProcessingAborted) Obtener ayuda en
> línea
> No se puede crear una conexión al origen de datos Ventas.
> (rsErrorOpeningConnection) Obtener ayuda en línea
> Invalid authorization specification
> The user I've chosen is the same that I use to design reports and to
> access the sql server usually, so I don´t understand the cause of this
> error.
> Good. Seeing that it has not work I´ve changed the user to "sa" and
> everything works fine.
> The unique problem I have that according to the policy secuirty of the
> company
> it is forbidden to use the sa user in order to execute the reports.
> Windows authentication is strongly recommended. Any idea?
> Regards
> Maciej Kiewrasql

Authorization ticket not received by LogonUser

Hello I am getting an error "Authorization ticket not received by
LogonUser" when trying to render an inline pdf report. It only happens
in VB.Net though.
I think that my authcookie is not being set for some reason.
Some info
I have created this app from scratch(modeled after adventureworks
sample in VB) and modified the adventureworks sample(c#)
the c# sample works but the vb.net does not.
I have set both my webCookie.Domain and netcookie.domain to
".domain.com" <- my domain
The sql server, IIS server and the webreports application are on the
same machine.
If I use the reportViewer control (vs 2003) it works fine and the when
I ask for Request.Cookies.AllKeys
I get
ASP.NET_SessionId
.ASPXAUTH
sqlAuthCookie
as the cookies listed.
This s a good sign but when I call the render function rs.render(all my
parameters) I get the error in vb.net only. Could it be a bad
translation on my part?
THis function may have been translated wrong.
Protected Overloads Overrides Function GetWebResponse(ByVal request As
WebRequest) As WebResponse
Dim response As WebResponse = MyBase.GetWebResponse(request)
Dim cookieName As String = response.Headers("RSAuthenticationHeader")
' If the response contains an auth header, store the cookie
If Not (cookieName Is Nothing) Then
Utilities.CustomAuthCookieName = cookieName
Dim webResponse As HttpWebResponse = CType(response,
HttpWebResponse)
Dim authCookie As Cookie = webResponse.Cookies(cookieName)
' If the auth cookie is null, throw an exception
If authCookie Is Nothing Then
Throw New Exception("Authorization ticket not
received by LogonUser")
End If
' otherwise save it for this request
authCookie = authCookie
' and send it to the client
Utilities.RelayCookieToClient(authCookie)
End If
Return response
End Function 'GetWebResponse
Any sugestions would be much appreciated.
Thanks
MoOne thing I forgot to add is I am using forms authentication and it
seems to be working fine up to the rendering point.|||Are you using forms authentication in the september 2005 CTP by chance?
"M0" wrote:
> One thing I forgot to add is I am using forms authentication and it
> seems to be working fine up to the rendering point.
>

Authorization ticket not received by LogonUser

Hi, I integrated with
ReportingServices using Forms Authentication followed the instruction of the
article from microsoft, it works fine on my laptop (Windows 2003 server and
sql2000), but when I try to duplicate it on our company server (windows 2000
and sql2000), I always got the error: Authorization ticket not received by
LogonUser, when I try to login as the ReportAdmin user.
Could someone help?
Thank you at advance.
YanDid you ever find a solution this problem?
I'm having the same issue. It works on my LapTop but when I duplicate
exactly what I have on the Server, it doesn't work.
Thanks.
"Authorization ticket" wrote:
> Hi, I integrated with
> ReportingServices using Forms Authentication followed the instruction of the
> article from microsoft, it works fine on my laptop (Windows 2003 server and
> sql2000), but when I try to duplicate it on our company server (windows 2000
> and sql2000), I always got the error: Authorization ticket not received by
> LogonUser, when I try to login as the ReportAdmin user.
>
> Could someone help?
> Thank you at advance.
> Yan|||Make sure the <UrlRoot> element value in the RSReportServer.config file is
the same URL value you are using to call the ReportService.asmx.
This error will happen if you have <UrlRoot> =http://MACHINENAME/ReportServer and you are calling the web service like
http://localhost/ReportServer/ReportService.asmx
Not sure if that's the issue but it's something to check. For the auth
cookie to work, the cookie domains have to be the same.
--
Adrian M.
MCP
"Jon-Slem" <JonSlem@.discussions.microsoft.com> wrote in message
news:C1AC412B-0DCA-4F69-A590-650CDB81B344@.microsoft.com...
> Did you ever find a solution this problem?
> I'm having the same issue. It works on my LapTop but when I duplicate
> exactly what I have on the Server, it doesn't work.
> Thanks.
> "Authorization ticket" wrote:
>> Hi, I integrated with
>> ReportingServices using Forms Authentication followed the instruction of
>> the
>> article from microsoft, it works fine on my laptop (Windows 2003 server
>> and
>> sql2000), but when I try to duplicate it on our company server (windows
>> 2000
>> and sql2000), I always got the error: Authorization ticket not received
>> by
>> LogonUser, when I try to login as the ReportAdmin user.
>>
>> Could someone help?
>> Thank you at advance.
>> Yan|||I don't get it.
I fixed this and I'm still getting the error. I didn't even have do this on
my laptop.
Did your work right after you made the change? I made the change in the
ReportingService.cs file, I changed it to the machine name. The config file
was already the machine, no change was need there.
If you have any idea, please give my a buzz.
Thank.
"Adrian M." wrote:
> Make sure the <UrlRoot> element value in the RSReportServer.config file is
> the same URL value you are using to call the ReportService.asmx.
> This error will happen if you have <UrlRoot> => http://MACHINENAME/ReportServer and you are calling the web service like
> http://localhost/ReportServer/ReportService.asmx
> Not sure if that's the issue but it's something to check. For the auth
> cookie to work, the cookie domains have to be the same.
> --
> Adrian M.
> MCP
> "Jon-Slem" <JonSlem@.discussions.microsoft.com> wrote in message
> news:C1AC412B-0DCA-4F69-A590-650CDB81B344@.microsoft.com...
> > Did you ever find a solution this problem?
> > I'm having the same issue. It works on my LapTop but when I duplicate
> > exactly what I have on the Server, it doesn't work.
> > Thanks.
> >
> > "Authorization ticket" wrote:
> >
> >> Hi, I integrated with
> >> ReportingServices using Forms Authentication followed the instruction of
> >> the
> >> article from microsoft, it works fine on my laptop (Windows 2003 server
> >> and
> >> sql2000), but when I try to duplicate it on our company server (windows
> >> 2000
> >> and sql2000), I always got the error: Authorization ticket not received
> >> by
> >> LogonUser, when I try to login as the ReportAdmin user.
> >>
> >>
> >> Could someone help?
> >>
> >> Thank you at advance.
> >>
> >> Yan
>
>

Authorization problems with SQL Developer's edition

I just installed developer's edition on a new laptop. Other machines in the
network cannot connect to this new instance.
At first it was TIMEOUTS - so I turned off the new WINDOWS firewall feature
(we are inside a small network anyway - no need for local firewalls - I
guess).
Then it was trying to connect as USERNAME = GUEST. I found GUEST as a
username under COMPUTER MANAGEMENT and disabled it.
Now it's getting login failed for user NULL.
Seems it's not on the network like the old laptop was. The old laptop did
not authenticate to the network, it logged in locally, but the SQL instance
was visible and connectable.
I cannot seem to add DOMAIN\usernames to this instance.
Any direction would be greatly appreciated.
I would try to connect to it via its IP address using a SQL Server login just
in case it is a DNS issue. Just a thought...
Thomas
"Steve Z" wrote:

> I just installed developer's edition on a new laptop. Other machines in the
> network cannot connect to this new instance.
> At first it was TIMEOUTS - so I turned off the new WINDOWS firewall feature
> (we are inside a small network anyway - no need for local firewalls - I
> guess).
> Then it was trying to connect as USERNAME = GUEST. I found GUEST as a
> username under COMPUTER MANAGEMENT and disabled it.
> Now it's getting login failed for user NULL.
> Seems it's not on the network like the old laptop was. The old laptop did
> not authenticate to the network, it logged in locally, but the SQL instance
> was visible and connectable.
> I cannot seem to add DOMAIN\usernames to this instance.
> Any direction would be greatly appreciated.
|||I am not a network person - and it really does show sometimes...
I did not join the domain properly with this new laptop.
Now that I've done that it's all set...
"Thomas" wrote:
[vbcol=seagreen]
> I would try to connect to it via its IP address using a SQL Server login just
> in case it is a DNS issue. Just a thought...
> --
> Thomas
>
> "Steve Z" wrote:

Authorization problems with SQL Developer's edition

I just installed developer's edition on a new laptop. Other machines in the
network cannot connect to this new instance.
At first it was TIMEOUTS - so I turned off the new WINDOWS firewall feature
(we are inside a small network anyway - no need for local firewalls - I
guess).
Then it was trying to connect as USERNAME = GUEST. I found GUEST as a
username under COMPUTER MANAGEMENT and disabled it.
Now it's getting login failed for user NULL.
Seems it's not on the network like the old laptop was. The old laptop did
not authenticate to the network, it logged in locally, but the SQL instance
was visible and connectable.
I cannot seem to add DOMAIN\usernames to this instance.
Any direction would be greatly appreciated.I would try to connect to it via its IP address using a SQL Server login just
in case it is a DNS issue. Just a thought...
--
Thomas
"Steve Z" wrote:
> I just installed developer's edition on a new laptop. Other machines in the
> network cannot connect to this new instance.
> At first it was TIMEOUTS - so I turned off the new WINDOWS firewall feature
> (we are inside a small network anyway - no need for local firewalls - I
> guess).
> Then it was trying to connect as USERNAME = GUEST. I found GUEST as a
> username under COMPUTER MANAGEMENT and disabled it.
> Now it's getting login failed for user NULL.
> Seems it's not on the network like the old laptop was. The old laptop did
> not authenticate to the network, it logged in locally, but the SQL instance
> was visible and connectable.
> I cannot seem to add DOMAIN\usernames to this instance.
> Any direction would be greatly appreciated.|||I am not a network person - and it really does show sometimes...
I did not join the domain properly with this new laptop.
Now that I've done that it's all set...
"Thomas" wrote:
> I would try to connect to it via its IP address using a SQL Server login just
> in case it is a DNS issue. Just a thought...
> --
> Thomas
>
> "Steve Z" wrote:
> > I just installed developer's edition on a new laptop. Other machines in the
> > network cannot connect to this new instance.
> >
> > At first it was TIMEOUTS - so I turned off the new WINDOWS firewall feature
> > (we are inside a small network anyway - no need for local firewalls - I
> > guess).
> >
> > Then it was trying to connect as USERNAME = GUEST. I found GUEST as a
> > username under COMPUTER MANAGEMENT and disabled it.
> >
> > Now it's getting login failed for user NULL.
> >
> > Seems it's not on the network like the old laptop was. The old laptop did
> > not authenticate to the network, it logged in locally, but the SQL instance
> > was visible and connectable.
> >
> > I cannot seem to add DOMAIN\usernames to this instance.
> >
> > Any direction would be greatly appreciated.

Authorization problems with SQL Developer's edition

I just installed developer's edition on a new laptop. Other machines in the
network cannot connect to this new instance.
At first it was TIMEOUTS - so I turned off the new WINDOWS firewall feature
(we are inside a small network anyway - no need for local firewalls - I
guess).
Then it was trying to connect as USERNAME = GUEST. I found GUEST as a
username under COMPUTER MANAGEMENT and disabled it.
Now it's getting login failed for user NULL.
Seems it's not on the network like the old laptop was. The old laptop did
not authenticate to the network, it logged in locally, but the SQL instance
was visible and connectable.
I cannot seem to add DOMAIN\usernames to this instance.
Any direction would be greatly appreciated.I would try to connect to it via its IP address using a SQL Server login jus
t
in case it is a DNS issue. Just a thought...
--
Thomas
"Steve Z" wrote:

> I just installed developer's edition on a new laptop. Other machines in t
he
> network cannot connect to this new instance.
> At first it was TIMEOUTS - so I turned off the new WINDOWS firewall featur
e
> (we are inside a small network anyway - no need for local firewalls - I
> guess).
> Then it was trying to connect as USERNAME = GUEST. I found GUEST as a
> username under COMPUTER MANAGEMENT and disabled it.
> Now it's getting login failed for user NULL.
> Seems it's not on the network like the old laptop was. The old laptop did
> not authenticate to the network, it logged in locally, but the SQL instanc
e
> was visible and connectable.
> I cannot seem to add DOMAIN\usernames to this instance.
> Any direction would be greatly appreciated.|||I am not a network person - and it really does show sometimes...
I did not join the domain properly with this new laptop.
Now that I've done that it's all set...
"Thomas" wrote:
[vbcol=seagreen]
> I would try to connect to it via its IP address using a SQL Server login j
ust
> in case it is a DNS issue. Just a thought...
> --
> Thomas
>
> "Steve Z" wrote:
>sql

Authorization problems with dso and asp (vbscript)

Hi all,
I have an authorization problem while trying to access to Metadata informations of Analysis Services via DSO with vbscript over IIS.
Calling from Browser an ASP page with the following content:
---
dim dsoServer, dsoDatabase, dsoCube
set dsoServer = Server.CreateObject ("DSO.Server")
dsoServer.Connect ("<myServerName>")
...
--
produces the following error:
Unable to connect to the registry on the server (DSCWDMT), or you are not a member of
the OLAP Administrators group on this server.

I found in this forum a similar post, and its proposed solution (apply sp1 to AS) will not work, because I have already SP1 installed (see also article Q297232 on MSDN).

I did the following tests:
1) run examples on \Programs\Microsoft Analysis Services\Samples
Yes, they work, but without DSO. I need DSO
2) Build a dll and register it for wwwroot.
Same error message
3) follow instruction on Q224973 (MSDN)
Same error message

I have the suspect, that the installation and/or the authorizations on W2K are not correct, but I do not know what.
I run SQL2K with unthrusted authorization (i.e. with user logon and password). This use is also allowed to see cubes (at least SELECT) in Analysis services. MDX Commands work fine and I get results.

So the question is: which user is trying to access DSO Services via Internet ?
if it is IUSR_<ServerName>, than it cannot work, because it has only guest auth. on ServerName, and it would not be correct to change it.

Do you have any hint ?

Background Infos:
OS: W2K with sp2
IS: IIS 5
Database: MS SQL2K with sp1
AS: SP1
Language: Visual Basic scripting edition (VBSCRIPT)

Thanks in advance
MatteoHi,

Remember that using Windows 2000 and your web server - IIS 5.0 - all connections and all things that you use from WEB use the default Windows 2000 user account that's IIS_<machine name>...

For example, if you must use a different Regional Settings for your WEB Aplications - ASP - and set it on the server by <b>Administrator</b> account, nothing will be changed by WEB users but the account used to local permissions on IIS is the IIS account ( IIS_<machine name> or IWS_<machine name> - I don't remember now ) .

[ ]'s|||Yes, this is correct. Everything works under the account IUSR_<MachineName>.
The problem ist meanwhile solved.
The error message came because IIUSR_<MachineName> could not read Registry Entries for HKLM/SOFTWARE/Microsoft/OLAP Server/...
So I added IUSR_<MachineName> wit readonly authorisation. This solved the problem.
Anyway this cannot be a good solution, because You change punctually something without a general application rule.
So I keep on searching.

Thanks,
Matteo

Authorization Error in Reporting Services on Windows 2003

Hi,
I have just reinstalled Reporting Services on win 2003 server that was
added to a domain and has been renamed. Two strange things happen:
1) In IE I am prompted for an ID and password with a basic security
prompt.
2) After supplying the credentials I get some of the report manager web
page but it has a 401 error instead of the folder and options to manage
projects.
The page looks like this:
Error
The request failed with HTTP status 401: Unauthorized.
Home
The reporting services error log contains the following error:
Unknown!ui!ed8!2/9/2005-20:44:32:: v VERBOSE: User
map'<Users><User><Name>DOMAIN\Administrator</Name><Paths><Pa=ADth>/reports/= Home.aspx</Path><NrReq>1</NrReq></Paths></User><=AD/Users>'
Unknown!ui!a24!2/9/2005-20:44:33:: v VERBOSE: User
map'<Users><User><Name>DOMAIN\Administrator</Name><Paths><Pa=ADth>/reports/= Pages/Folder.aspx</Path><NrReq>1</NrReq></Paths>=AD</User></Users>'
Unknown!ui!a24!2/9/2005-20:44:34:: e ERROR: The request failed with
HTTP status 401: Unauthorized.
Unknown!ui!a24!2/9/2005-20:44:35:: e ERROR: HTTP status code --> 500
I have not changed any of the config files that are installed.
Thanks for any help in advance,
EricTry restarting IIS. I think that is how they fixed the problem here.|||Try restarting IIS. I think that is how they cured the problem here.

authorization error in reporting services on win2003

Hi,
I have just reinstalled Reporting Services on win 2003 server that was
added to a domain and has been renamed. Two strange things happen:
1) In IE I am prompted for an ID and password with a basic security
prompt.
2) After supplying the credentials I get some of the report manager web
page but it has a 401 error instead of the folder and options to manage
projects.

The page looks like this:
Error

The request failed with HTTP status 401: Unauthorized.

Home

The reporting services error log contains the following error:
Unknown!ui!ed8!2/9/2005-20:44:32:: v VERBOSE: User
map'<Users><User><Name>DOMAIN\Administrator</Name><Paths><Path>/reports/Home.aspx</Path><NrReq>1</NrReq></Paths></User></Users>'
Unknown!ui!a24!2/9/2005-20:44:33:: v VERBOSE: User
map'<Users><User><Name>DOMAIN\Administrator</Name><Paths><Path>/reports/Pages/Folder.aspx</Path><NrReq>1</NrReq></Paths></User></Users>'
Unknown!ui!a24!2/9/2005-20:44:34:: e ERROR: The request failed with
HTTP status 401: Unauthorized.
Unknown!ui!a24!2/9/2005-20:44:35:: e ERROR: HTTP status code --> 500

I have not changed any of the config files that are installed.

Thanks for any help in advance,

EricI have no idea, although there if you search Google groups for "sql
2000 reporting services http 401" there are a number of hits which may
be useful. You will probably get a better answer in
microsoft.public.sqlserver.reportingsvcs.

Simon

Authorization Based on UserId and Parameter Data

Hi All,
I am novice for reporting services.
Is it possible to get the parameters of the report and do authorisation
check based on the parameter value and UserId ?
Or is there other alternative to this kind of requirement..
Thanks,
RaghuHi,
It is possible but not advisable, there is no field mask for the password
field. Best bet is to use custom form for the password authentication.
Amarnath
"RAV" wrote:
> Hi All,
> I am novice for reporting services.
> Is it possible to get the parameters of the report and do authorisation
> check based on the parameter value and UserId ?
> Or is there other alternative to this kind of requirement..
> Thanks,
> Raghu
>

authorization and permissions

Hi All,
I'm development a system, and I have doubts about login (authorization and
permissions)
This system need be very secure.
The systems have clients that connect in a web service and this web service
connects in SQL Server.
My doubt is:
What is the best:
Logins here is: Name and password(hash) and what each user can do.
Store logins in one table in my database and always WebServise use SA
account to manipulate data base?
Use SQL logins for each users?
Use Windows logins for each users?
Thanks
First of all, abstraction is the easiest to manage and administrate. In all
regards, use Windows Authentication whenever possible. If this is public
facing, in all likelihood, you will not have Windows Domain Accounts
available for use.
In this case, and in cases where the applicaiton needs to control the
security of the users (that is, keep explicit user identification and
permissions within the application database), it would be better to use a
single Windows Authenticated account to manipulate database calls.
Also, you should not have the Web Services directly manipulate the database.
In stead, you should have application layer services resident on another
server from you Web Server and have the web call these services. The
application tier should then use this single application, Windows
Authenticated account control the connections and calls to the Data Services
tier.
The interfaces exposed from the DBMS should all be done through stored
procedures and ad-hoc requests for reporting and administrative services
should be exposed through Views. No direct base table access should be
granted outside of the development/application support staff, and even then,
restricted to DML activities alone. The DBA should be the only user
authorized to make system level changes, including DDL, and only through a
formalized Change Control process.
Sincerely,
Anthony Thomas

"ReTF" <re.tf@.newsgroup.nospam> wrote in message
news:O3KN$thaFHA.3048@.TK2MSFTNGP12.phx.gbl...
Hi All,
I'm development a system, and I have doubts about login (authorization and
permissions)
This system need be very secure.
The systems have clients that connect in a web service and this web service
connects in SQL Server.
My doubt is:
What is the best:
Logins here is: Name and password(hash) and what each user can do.
Store logins in one table in my database and always WebServise use SA
account to manipulate data base?
Use SQL logins for each users?
Use Windows logins for each users?
Thanks
|||The most secure option is to force all users to have their own login and
make them all trusted logins. Of course, there are typically practical
problems with that approach from web apps as the user that hits the web
server needs to be authenticated against AD for the trusted SQL login
from the web server to work properly and for externally accessible web
apps authenticating the users against AD is often not possible. But
purely from a SQL perspective trusted logins are the most secure method
of connecting.
Storing passwords in your DB is never a good idea if solid security is
what you're aiming for. Storing localised application permissions in
some user table in your DB is fine as long as you have the table locked
down so if a user hacks in somehow they can't "tweak" the permissions
table to change their level of permissions within the app. As far as
SQL permissions go, each different "role" within your app (eg. clerk,
manager, administrator, etc.) should have a corresponding role within
the DB (see sp_addrole and sp_addrolemember in BOL) with the necessary
SQL permissions assigned to the DB roles.
It's best not to use the 'sa' login for anything. In fact, if you have
Windows Authentication only then you cannot login with 'sa' because it's
a SQL login (not a trusted login).
HTH
*mike hodgson* |/ database administrator/ | mallesons stephen jaques
*T* +61 (2) 9296 3668 |* F* +61 (2) 9296 3885 |* M* +61 (408) 675 907
*E* mailto:mike.hodgson@.mallesons.nospam.com |* W* http://www.mallesons.com
ReTF wrote:

>Hi All,
>
>I'm development a system, and I have doubts about login (authorization and
>permissions)
>This system need be very secure.
>
>The systems have clients that connect in a web service and this web service
>connects in SQL Server.
>
>My doubt is:
>
>What is the best:
>
>Logins here is: Name and password(hash) and what each user can do.
>
>Store logins in one table in my database and always WebServise use SA
>account to manipulate data base?
>
>Use SQL logins for each users?
>
>Use Windows logins for each users?
>
>Thanks
>
>
sql

authorization and permissions

Hi All,
I'm development a system, and I have doubts about login (authorization and
permissions)
This system need be very secure.
The systems have clients that connect in a web service and this web service
connects in SQL Server.
My doubt is:
What is the best:
Logins here is: Name and password(hash) and what each user can do.
Store logins in one table in my database and always WebServise use SA
account to manipulate data base?
Use SQL logins for each users?
Use Windows logins for each users?
ThanksFirst of all, abstraction is the easiest to manage and administrate. In all
regards, use Windows Authentication whenever possible. If this is public
facing, in all likelihood, you will not have Windows Domain Accounts
available for use.
In this case, and in cases where the applicaiton needs to control the
security of the users (that is, keep explicit user identification and
permissions within the application database), it would be better to use a
single Windows Authenticated account to manipulate database calls.
Also, you should not have the Web Services directly manipulate the database.
In stead, you should have application layer services resident on another
server from you Web Server and have the web call these services. The
application tier should then use this single application, Windows
Authenticated account control the connections and calls to the Data Services
tier.
The interfaces exposed from the DBMS should all be done through stored
procedures and ad-hoc requests for reporting and administrative services
should be exposed through Views. No direct base table access should be
granted outside of the development/application support staff, and even then,
restricted to DML activities alone. The DBA should be the only user
authorized to make system level changes, including DDL, and only through a
formalized Change Control process.
Sincerely,
Anthony Thomas
"ReTF" <re.tf@.newsgroup.nospam> wrote in message
news:O3KN$thaFHA.3048@.TK2MSFTNGP12.phx.gbl...
Hi All,
I'm development a system, and I have doubts about login (authorization and
permissions)
This system need be very secure.
The systems have clients that connect in a web service and this web service
connects in SQL Server.
My doubt is:
What is the best:
Logins here is: Name and password(hash) and what each user can do.
Store logins in one table in my database and always WebServise use SA
account to manipulate data base?
Use SQL logins for each users?
Use Windows logins for each users?
Thanks|||This is a multi-part message in MIME format.
--090003030806010808040200
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
The most secure option is to force all users to have their own login and
make them all trusted logins. Of course, there are typically practical
problems with that approach from web apps as the user that hits the web
server needs to be authenticated against AD for the trusted SQL login
from the web server to work properly and for externally accessible web
apps authenticating the users against AD is often not possible. But
purely from a SQL perspective trusted logins are the most secure method
of connecting.
Storing passwords in your DB is never a good idea if solid security is
what you're aiming for. Storing localised application permissions in
some user table in your DB is fine as long as you have the table locked
down so if a user hacks in somehow they can't "tweak" the permissions
table to change their level of permissions within the app. As far as
SQL permissions go, each different "role" within your app (eg. clerk,
manager, administrator, etc.) should have a corresponding role within
the DB (see sp_addrole and sp_addrolemember in BOL) with the necessary
SQL permissions assigned to the DB roles.
It's best not to use the 'sa' login for anything. In fact, if you have
Windows Authentication only then you cannot login with 'sa' because it's
a SQL login (not a trusted login).
HTH
--
*mike hodgson* |/ database administrator/ | mallesons stephen jaques
*T* +61 (2) 9296 3668 |* F* +61 (2) 9296 3885 |* M* +61 (408) 675 907
*E* mailto:mike.hodgson@.mallesons.nospam.com |* W* http://www.mallesons.com
ReTF wrote:
>Hi All,
>
>I'm development a system, and I have doubts about login (authorization and
>permissions)
>This system need be very secure.
>
>The systems have clients that connect in a web service and this web service
>connects in SQL Server.
>
>My doubt is:
>
>What is the best:
>
>Logins here is: Name and password(hash) and what each user can do.
>
>Store logins in one table in my database and always WebServise use SA
>account to manipulate data base?
>
>Use SQL logins for each users?
>
>Use Windows logins for each users?
>
>Thanks
>
>
--090003030806010808040200
Content-Type: text/html; charset=ISO-8859-1
Content-Transfer-Encoding: 7bit
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta content="text/html;charset=ISO-8859-1" http-equiv="Content-Type">
</head>
<body bgcolor="#ffffff" text="#000000">
<tt>The most secure option is to force all users to have their own
login and make them all trusted logins. Of course, there are typically
practical problems with that approach from web apps as the user that
hits the web server needs to be authenticated against AD for the
trusted SQL login from the web server to work properly and for
externally accessible web apps authenticating the users against AD is
often not possible. But purely from a SQL perspective trusted logins
are the most secure method of connecting.<br>
<br>
Storing passwords in your DB is never a good idea if solid security is
what you're aiming for. Storing localised application permissions in
some user table in your DB is fine as long as you have the table locked
down so if a user hacks in somehow they can't "tweak" the permissions
table to change their level of permissions within the app. As far as
SQL permissions go, each different "role" within your app (eg. clerk,
manager, administrator, etc.) should have a corresponding role within
the DB (see sp_addrole and sp_addrolemember in BOL) with the necessary
SQL permissions assigned to the DB roles.<br>
<br>
It's best not to use the 'sa' login for anything. In fact, if you have
Windows Authentication only then you cannot login with 'sa' because
it's a SQL login (not a trusted login).<br>
<br>
HTH<br>
</tt>
<div class="moz-signature">
<title></title>
<meta http-equiv="Content-Type" content="text/html; ">
<p><span lang="en-au"><font face="Tahoma" size="2">--<br>
</font> </span><b><span lang="en-au"><font face="Tahoma" size="2">mike
hodgson</font></span></b><span lang="en-au"> <font face="Tahoma"
size="2">|</font><i><font face="Tahoma"> </font><font face="Tahoma"
size="2"> database administrator</font></i><font face="Tahoma" size="2">
| mallesons</font><font face="Tahoma"> </font><font face="Tahoma"
size="2">stephen</font><font face="Tahoma"> </font><font face="Tahoma"
size="2"> jaques</font><font face="Tahoma"><br>
</font><b><font face="Tahoma" size="2">T</font></b><font face="Tahoma"
size="2"> +61 (2) 9296 3668 |</font><b><font face="Tahoma"> </font><font
face="Tahoma" size="2"> F</font></b><font face="Tahoma" size="2"> +61
(2) 9296 3885 |</font><b><font face="Tahoma"> </font><font
face="Tahoma" size="2">M</font></b><font face="Tahoma" size="2"> +61
(408) 675 907</font><br>
<b><font face="Tahoma" size="2">E</font></b><font face="Tahoma" size="2">
<a href="http://links.10026.com/?link=mailto:mike.hodgson@.mallesons.nospam.com">
mailto:mike.hodgson@.mallesons.nospam.com</a> |</font><b><font
face="Tahoma"> </font><font face="Tahoma" size="2">W</font></b><font
face="Tahoma" size="2"> <a href="http://links.10026.com/?link=/">http://www.mallesons.com">
http://www.mallesons.com</a></font></span> </p>
</div>
<br>
<br>
ReTF wrote:
<blockquote cite="midO3KN$thaFHA.3048@.TK2MSFTNGP12.phx.gbl" type="cite">
<pre wrap="">Hi All,
I'm development a system, and I have doubts about login (authorization and
permissions)
This system need be very secure.
The systems have clients that connect in a web service and this web service
connects in SQL Server.
My doubt is:
What is the best:
Logins here is: Name and password(hash) and what each user can do.
Store logins in one table in my database and always WebServise use SA
account to manipulate data base?
Use SQL logins for each users?
Use Windows logins for each users?
Thanks
</pre>
</blockquote>
</body>
</html>
--090003030806010808040200--

authorization and permissions

Hi All,
I'm development a system, and I have doubts about login (authorization and
permissions)
This system need be very secure.
The systems have clients that connect in a web service and this web service
connects in SQL Server.
My doubt is:
What is the best:
Logins here is: Name and password(hash) and what each user can do.
Store logins in one table in my database and always WebServise use SA
account to manipulate data base?
Use SQL logins for each users?
Use Windows logins for each users?
ThanksFirst of all, abstraction is the easiest to manage and administrate. In all
regards, use Windows Authentication whenever possible. If this is public
facing, in all likelihood, you will not have Windows Domain Accounts
available for use.
In this case, and in cases where the applicaiton needs to control the
security of the users (that is, keep explicit user identification and
permissions within the application database), it would be better to use a
single Windows Authenticated account to manipulate database calls.
Also, you should not have the Web Services directly manipulate the database.
In stead, you should have application layer services resident on another
server from you Web Server and have the web call these services. The
application tier should then use this single application, Windows
Authenticated account control the connections and calls to the Data Services
tier.
The interfaces exposed from the DBMS should all be done through stored
procedures and ad-hoc requests for reporting and administrative services
should be exposed through Views. No direct base table access should be
granted outside of the development/application support staff, and even then,
restricted to DML activities alone. The DBA should be the only user
authorized to make system level changes, including DDL, and only through a
formalized Change Control process.
Sincerely,
Anthony Thomas
"ReTF" <re.tf@.newsgroup.nospam> wrote in message
news:O3KN$thaFHA.3048@.TK2MSFTNGP12.phx.gbl...
Hi All,
I'm development a system, and I have doubts about login (authorization and
permissions)
This system need be very secure.
The systems have clients that connect in a web service and this web service
connects in SQL Server.
My doubt is:
What is the best:
Logins here is: Name and password(hash) and what each user can do.
Store logins in one table in my database and always WebServise use SA
account to manipulate data base?
Use SQL logins for each users?
Use Windows logins for each users?
Thanks|||The most secure option is to force all users to have their own login and
make them all trusted logins. Of course, there are typically practical
problems with that approach from web apps as the user that hits the web
server needs to be authenticated against AD for the trusted SQL login
from the web server to work properly and for externally accessible web
apps authenticating the users against AD is often not possible. But
purely from a SQL perspective trusted logins are the most secure method
of connecting.
Storing passwords in your DB is never a good idea if solid security is
what you're aiming for. Storing localised application permissions in
some user table in your DB is fine as long as you have the table locked
down so if a user hacks in somehow they can't "tweak" the permissions
table to change their level of permissions within the app. As far as
SQL permissions go, each different "role" within your app (eg. clerk,
manager, administrator, etc.) should have a corresponding role within
the DB (see sp_addrole and sp_addrolemember in BOL) with the necessary
SQL permissions assigned to the DB roles.
It's best not to use the 'sa' login for anything. In fact, if you have
Windows Authentication only then you cannot login with 'sa' because it's
a SQL login (not a trusted login).
HTH
*mike hodgson* |/ database administrator/ | mallesons stephen jaques
*T* +61 (2) 9296 3668 |* F* +61 (2) 9296 3885 |* M* +61 (408) 675 907
*E* mailto:mike.hodgson@.mallesons.nospam.com |* W* http://www.mallesons.com
ReTF wrote:

>Hi All,
>
>I'm development a system, and I have doubts about login (authorization and
>permissions)
>This system need be very secure.
>
>The systems have clients that connect in a web service and this web service
>connects in SQL Server.
>
>My doubt is:
>
>What is the best:
>
>Logins here is: Name and password(hash) and what each user can do.
>
>Store logins in one table in my database and always WebServise use SA
>account to manipulate data base?
>
>Use SQL logins for each users?
>
>Use Windows logins for each users?
>
>Thanks
>
>

authorization and permissions

Hi All,
I'm development a system, and I have doubts about login (authorization and
permissions)
This system need be very secure.
The systems have clients that connect in a web service and this web service
connects in SQL Server.
My doubt is:
What is the best:
Logins here is: Name and password(hash) and what each user can do.
Store logins in one table in my database and always WebServise use SA
account to manipulate data base?
Use SQL logins for each users?
Use Windows logins for each users?
ThanksHello,
I notice you have posted the same question in our SQLServer newsgroup,
which have been responded. So please check the answers there.
Sophie Guo
Microsoft Online Partner Support
Get Secure! - www.microsoft.com/security
========================================
=============
When responding to posts, please "Reply to Group" via your newsreader so
that others may learn and benefit from your issue.
========================================
=============
This posting is provided "AS IS" with no warranties, and confers no rights.

authorization

how do you alter authorization to set the database owner to a valid login? and simultaneously how do you add the database diagram support objects in sql server 2005 express.

thanksThere's two ways to change the owner to a valid login:

1) Using the management UI
a) Right click on the database in Object Explorer, select properties
b) in the properties dialog, switch to the "Files" page
c) Enter the name of a login in the "Owner" edit box (or click the "..." button to browse for a login)
d) click OK

2) Using T-SQL execute the following:

ALTER AUTHORIZATION ON DATABASE::{database_name} TO {principal_name}
To install the database diagram support objects:

1) Launch Management Studio and log in as an administrator or as dbo in the database.
2) Make sure the database compatibility level is set to SQL Server 2005. You can set this in the database properties dialog on the Options page.
3) In Object Explorer, right click on the "Database Diagrams" folder for the database and select "Install Diagram Support". Click Yes in the prompt to install support objects that is displayed.

If you need to, you can set the database compatibility to a backwards compatibility mode after the diagram support objects are installed and you'll still be able to work with diagrams.

Authorization

Hi,

How to develop the application will run under user who have permission to view the reports.

When multiple users are accessing reports for example in this case i have 5 users.

could anyone help to me.

regards

kumar

first i have some question are the user in Domain or not if so then you can give each user the privileges on the reports you want on the reporting service

and by code you get the identity of the user in the context and then he will gain the privileges on the reports he can view

this is a great article which explain how you can do this

http://msdn2.microsoft.com/en-us/library/ms159846.aspx

http://msdn2.microsoft.com/en-us/library/ms159778.aspx

sql

Authentication and authorization in MS Reports 2000

Hi,
I am Strug'ling from 1 week. Please help me with following problem.
1. I am developing ASP.net, C# web application.
2. I am using MS Reporting Services 2000 for Report Generation.
3. I am using Report Viewer Control for Displaying the Reports into my web
application.
4. I am able to see my all reports in report viewer control but for that
either i have to have Anonymous access true in IIS Or I have to add that user
to Report Server.
My problem :-
I don't want to use Anonymous access, because then it will become public.
I use form authentication in My application and based on this i want to
validate the report to be seen to user.
So how do i do this.
Please help me.
Thanks in advance.
Labhesh Shrimali
BangaloreReporting services by default using Windows authentication as you have
discovered. If you want to use forms authentication you have to use the
security extensions which allow you to authenticate the users rather than
Reporting Services. Here is a link to start off with.
http://msdn.microsoft.com/library/default.asp?url=/library/en-us/dnsql2k/html/ufairs.asp
Bruce Loehle-Conger
MVP SQL Server Reporting Services
"Labhesh Shrimali - Bangalore"
<LabheshShrimaliBangalore@.discussions.microsoft.com> wrote in message
news:B2053588-9CAF-4FA0-9F65-1B5621FAD01A@.microsoft.com...
> Hi,
> I am Strug'ling from 1 week. Please help me with following problem.
> 1. I am developing ASP.net, C# web application.
> 2. I am using MS Reporting Services 2000 for Report Generation.
> 3. I am using Report Viewer Control for Displaying the Reports into my web
> application.
> 4. I am able to see my all reports in report viewer control but for that
> either i have to have Anonymous access true in IIS Or I have to add that
> user
> to Report Server.
> My problem :-
> I don't want to use Anonymous access, because then it will become public.
> I use form authentication in My application and based on this i want to
> validate the report to be seen to user.
> So how do i do this.
> Please help me.
> Thanks in advance.
> Labhesh Shrimali
> Bangalore
>sql