Authorization windows - Invalid authorization specification

Hi, Experts.
Another problem with Reporting Services authentication:
We have a windows 2003 server + iis 6.0 +Reporting Setvices
whose reports access to a sql server windows 2003 (both are situated
in the same domain).
Since I must use stored credentials in order to create subscriptions
I've decided to put a user from domain windows in stored
authentication.
As the result I´ve obtain the following error:
Error al procesar el informe. (rsProcessingAborted) Obtener ayuda en
línea
No se puede crear una conexión al origen de datos Ventas.
(rsErrorOpeningConnection) Obtener ayuda en línea
Invalid authorization specification
The user I've chosen is the same that I use to design reports and to
access the sql server usually, so I don´t understand the cause of this
error.
Good. Seeing that it has not work I´ve changed the user to "sa" and
everything works fine.
The unique problem I have that according to the policy secuirty of the
company
it is forbidden to use the sa user in order to execute the reports.
Windows authentication is strongly recommended. Any idea?
Regards
Maciej KiewraHi, Experts.
The ServicePack is the real reason of my problem.
I´ve removed RS and I've installed it again (without applying service pack)
everything ok.
Then I've installed the servicepack and now "windows authentication" does not work.
I know that in the service pack 1 a new System Property has been add that
permits the windows authentication to be disabled, but this parameter is set
to true, so it is not a case.
It seems that Reporting Service is already very premature
Regards
Maciej Kiewra
mkiewra@.mail.fujitsu.es (Maciej Kiewra) wrote in message news:<bc86bf57.0504050912.36611411@.posting.google.com>...
> Hi, Experts.
>
> Another problem with Reporting Services authentication:
> We have a windows 2003 server + iis 6.0 +Reporting Setvices
> whose reports access to a sql server windows 2003 (both are situated
> in the same domain).
> Since I must use stored credentials in order to create subscriptions
> I've decided to put a user from domain windows in stored
> authentication.
> As the result I´ve obtain the following error:
> Error al procesar el informe. (rsProcessingAborted) Obtener ayuda en
> línea
> No se puede crear una conexión al origen de datos Ventas.
> (rsErrorOpeningConnection) Obtener ayuda en línea
> Invalid authorization specification
> The user I've chosen is the same that I use to design reports and to
> access the sql server usually, so I don´t understand the cause of this
> error.
> Good. Seeing that it has not work I´ve changed the user to "sa" and
> everything works fine.
> The unique problem I have that according to the policy secuirty of the
> company
> it is forbidden to use the sa user in order to execute the reports.
> Windows authentication is strongly recommended. Any idea?
> Regards
> Maciej Kiewrasql

Authorization problems with dso and asp (vbscript)

Hi all,
I have an authorization problem while trying to access to Metadata informations of Analysis Services via DSO with vbscript over IIS.
Calling from Browser an ASP page with the following content:
---
dim dsoServer, dsoDatabase, dsoCube
set dsoServer = Server.CreateObject ("DSO.Server")
dsoServer.Connect ("<myServerName>")
...
--
produces the following error:
Unable to connect to the registry on the server (DSCWDMT), or you are not a member of
the OLAP Administrators group on this server.

I found in this forum a similar post, and its proposed solution (apply sp1 to AS) will not work, because I have already SP1 installed (see also article Q297232 on MSDN).

I did the following tests:
1) run examples on \Programs\Microsoft Analysis Services\Samples
Yes, they work, but without DSO. I need DSO
2) Build a dll and register it for wwwroot.
Same error message
3) follow instruction on Q224973 (MSDN)
Same error message

I have the suspect, that the installation and/or the authorizations on W2K are not correct, but I do not know what.
I run SQL2K with unthrusted authorization (i.e. with user logon and password). This use is also allowed to see cubes (at least SELECT) in Analysis services. MDX Commands work fine and I get results.

So the question is: which user is trying to access DSO Services via Internet ?
if it is IUSR_<ServerName>, than it cannot work, because it has only guest auth. on ServerName, and it would not be correct to change it.

Do you have any hint ?

Background Infos:
OS: W2K with sp2
IS: IIS 5
Database: MS SQL2K with sp1
AS: SP1
Language: Visual Basic scripting edition (VBSCRIPT)

Thanks in advance
MatteoHi,

Remember that using Windows 2000 and your web server - IIS 5.0 - all connections and all things that you use from WEB use the default Windows 2000 user account that's IIS_<machine name>...

For example, if you must use a different Regional Settings for your WEB Aplications - ASP - and set it on the server by <b>Administrator</b> account, nothing will be changed by WEB users but the account used to local permissions on IIS is the IIS account ( IIS_<machine name> or IWS_<machine name> - I don't remember now ) .

[ ]'s|||Yes, this is correct. Everything works under the account IUSR_<MachineName>.
The problem ist meanwhile solved.
The error message came because IIUSR_<MachineName> could not read Registry Entries for HKLM/SOFTWARE/Microsoft/OLAP Server/...
So I added IUSR_<MachineName> wit readonly authorisation. This solved the problem.
Anyway this cannot be a good solution, because You change punctually something without a general application rule.
So I keep on searching.

Thanks,
Matteo

Authentification problem with SQL 2k, IIS and Linked Server

Hello,

I have successfully created an Exchange 2000 linked server in Microsoft SQL server 2k. When I use my NT login, I can query it.

I'm now developping a website (ASP.NET in IIS 5). I have successfully created a web page querying my database. But now, I would like to query my linked server via my SQL server. I have try various authentification settings but I always got this error : OLE DB provider 'Exoledb.DataSource.1' reported an error. Authentication failed.

I know it is because the IIS process don't have any rights on the Exchange server but I would like to know what is the way to get around this without given rights to the IIS process (and creating huge security holes).

Thank a lot

Felix Pageau
fpageau@.str.cadid you try distributed queries ?

for example :
INSERT INTO [Database1name].[Owner].[Table]
SELECT *
FROM OPENQUERY ([LinkedServerName], SELECT Database2name.Table.* FROM Database2Name.Table)|||Hello,

this is exactly what I'm trying to do... I would like to know if it is possible to "impersonate" an Exchange Linked Server (with a user defined in the domain...) ?

Thank|||Review information from this KBA (http://support.microsoft.com/default.aspx?scid=kb;EN-US;285833) to go with Linked server authentication.|||Hello,
this is working fine with access but Exchange is using Active Directory login... Those example use plain text login & password. I have already try this way.

Thank a lot

Felix Pageau

Authentication problem - Urgent

During the development of the project I used windows authentication on IIS
and everything was working perfectly. But the user must access the reports
through a web application, so I changed the security to anonymous and set the
rights on RS for the anonymous user and since then, the server has crashed in
a random way (rsProcessingError). If I reapply the security the same thing
happens. Does anyone have any ideas?Possibly - we are using a custom built proxy, and in order to use
System.Net.CredentialCache.DefaultCredentials I had to allow anon access.
When deploying it broke [b/c IUSR_machinename didn't have the correct
priv's]. There is a post on how to allow anon access & be able to deploy
reports [titled "does anonymous access have to be disabled in iis?",
8/10/2004] on how to set it up. Note you do it in reporting services, not
iis. Maybe this will get you on the right path.
Good luck,
John Hennesey
"raph" wrote:
> During the development of the project I used windows authentication on IIS
> and everything was working perfectly. But the user must access the reports
> through a web application, so I changed the security to anonymous and set the
> rights on RS for the anonymous user and since then, the server has crashed in
> a random way (rsProcessingError). If I reapply the security the same thing
> happens. Does anyone have any ideas?|||Thanks for your help.
I already tried to put anonymous user as content manager on RS and PowerUser
on the server. But the problem is the same.The report crashes once
every one hundred times with the same parameters by URL and the same error
message.
The processing of group expression for the table 'table1' cannot be
performed. The comparison failed. Please check the data type returned by
group expression.
Raph
"JohnHennesey" wrote:
> Possibly - we are using a custom built proxy, and in order to use
> System.Net.CredentialCache.DefaultCredentials I had to allow anon access.
> When deploying it broke [b/c IUSR_machinename didn't have the correct
> priv's]. There is a post on how to allow anon access & be able to deploy
> reports [titled "does anonymous access have to be disabled in iis?",
> 8/10/2004] on how to set it up. Note you do it in reporting services, not
> iis. Maybe this will get you on the right path.
> Good luck,
> John Hennesey
> "raph" wrote:
> > During the development of the project I used windows authentication on IIS
> > and everything was working perfectly. But the user must access the reports
> > through a web application, so I changed the security to anonymous and set the
> > rights on RS for the anonymous user and since then, the server has crashed in
> > a random way (rsProcessingError). If I reapply the security the same thing
> > happens. Does anyone have any ideas?

Authentication problem

Hi, all,
I am using SQL Server 2000 SP3 and Windows 2000 Server Sp4.
IIS Server is running on Server A.
SQL Server is running on Server B.
Web Application on Server A will connect to SQL Server on Server B, I want
to use Windows Authentication Mode. How can I do this?
Thanks in advance.
kevinHi, all:
I have found the answer in this news group, on 3-23, raise by Timo, subject
is
<<IIS -> SQLServer on another machine>>.
But now my problem is that: this way doesn't work in Crystal Reports!
Do anyone have any ideas?
Thanks
kevin
"Kevin Dai" <kevin_dzy@.hotmail.com> д?
news:eviJfcfFEHA.3576@.tk2msftngp13.phx.gbl...
> Hi, all,
> I am using SQL Server 2000 SP3 and Windows 2000 Server Sp4.
> IIS Server is running on Server A.
> SQL Server is running on Server B.
> Web Application on Server A will connect to SQL Server on Server B, I want
> to use Windows Authentication Mode. How can I do this?
> Thanks in advance.
> kevin
>|||What's the exact error you get? And is it really specific to Crystal
Reports or does it happen from any 3rd machine? You may be having a
double-hop problem (where IIS can talk to SQL, but a workstation that uses
IIS to talk to SQL has to use Kerberos delegation to pass the workstation's
credentials through IIS to SQL).
Cindy Gross, MCDBA, MCSE
http://cindygross.tripod.com
This posting is provided "AS IS" with no warranties, and confers no rights.

Authentication IIS and SSRS

I have two servers IIS Server and SQL2005.
I have web app using ReportViewer on IIS Server to view reports on SQL
Server SSRS.
Both servers are on domain1.
Authentication was not working so on IIS web app in web.config in system.web
I say identity impersonate="true" userName="domain1\username"
password="password" then it works fine -- but is this correct way to do? I
don't like to have to have an account in there that has admin privs -- I
thought it should be just impersonate="true" and not have to send a domain
username/password?
I read many things on nntp about this topic but was unable to finad anything
to work except for the way I have it above.
Thank you!Why dont you enable anonymouse access and give everyone access in the
report server.
dev648237923 wrote:
> I have two servers IIS Server and SQL2005.
> I have web app using ReportViewer on IIS Server to view reports on SQL
> Server SSRS.
> Both servers are on domain1.
> Authentication was not working so on IIS web app in web.config in system.web
> I say identity impersonate="true" userName="domain1\username"
> password="password" then it works fine -- but is this correct way to do? I
> don't like to have to have an account in there that has admin privs -- I
> thought it should be just impersonate="true" and not have to send a domain
> username/password?
> I read many things on nntp about this topic but was unable to finad anything
> to work except for the way I have it above.
> Thank you!|||The Report Server is not exposed to the Internet -- only my web application
can get at it -- more secure that way (so my IIS server is public but the
SQL is not). I followed what Steve said and it worked great!
Thanks.
"sunil.jaikumar" <sunil.jaikumar@.gmail.com> wrote in message
news:1152863352.300856.43580@.m73g2000cwd.googlegroups.com...
> Why dont you enable anonymouse access and give everyone access in the
> report server.
> dev648237923 wrote:
>> I have two servers IIS Server and SQL2005.
>> I have web app using ReportViewer on IIS Server to view reports on SQL
>> Server SSRS.
>> Both servers are on domain1.
>> Authentication was not working so on IIS web app in web.config in
>> system.web
>> I say identity impersonate="true" userName="domain1\username"
>> password="password" then it works fine -- but is this correct way to do?
>> I
>> don't like to have to have an account in there that has admin privs -- I
>> thought it should be just impersonate="true" and not have to send a
>> domain
>> username/password?
>> I read many things on nntp about this topic but was unable to finad
>> anything
>> to work except for the way I have it above.
>> Thank you!
>|||" I followed what Steve said and it worked great!"
Does this refer to using local reports, as was stated in your other
post?
I've been prototyping using the impersonation and it works, but I don't
know what the security requirement is eventually going to be. I don't
mind cutting the RS server out of the equation.
dev648237923 wrote:
> The Report Server is not exposed to the Internet -- only my web application
> can get at it -- more secure that way (so my IIS server is public but the
> SQL is not). I followed what Steve said and it worked great!
> Thanks.
> "sunil.jaikumar" <sunil.jaikumar@.gmail.com> wrote in message
> news:1152863352.300856.43580@.m73g2000cwd.googlegroups.com...
> > Why dont you enable anonymouse access and give everyone access in the
> > report server.
> >
> > dev648237923 wrote:
> >> I have two servers IIS Server and SQL2005.
> >> I have web app using ReportViewer on IIS Server to view reports on SQL
> >> Server SSRS.
> >> Both servers are on domain1.
> >>
> >> Authentication was not working so on IIS web app in web.config in
> >> system.web
> >> I say identity impersonate="true" userName="domain1\username"
> >> password="password" then it works fine -- but is this correct way to do?
> >> I
> >> don't like to have to have an account in there that has admin privs -- I
> >> thought it should be just impersonate="true" and not have to send a
> >> domain
> >> username/password?
> >>
> >> I read many things on nntp about this topic but was unable to finad
> >> anything
> >> to work except for the way I have it above.
> >>
> >> Thank you!
> >|||> Does this refer to using local reports, as was stated in your other
> post?
I followed what Steve said to get IIS authentication working to SSRS server.
I'm not using local Reports anymore (reason is that I need to be able to use
some of the features only available in Report Server -- see below for some
goo dlinks comparing).
Some links on Local vs Report Server:
http://msdn2.microsoft.com/en-us/library/ms251704.aspx
http://www.devx.com/dotnet/Article/30424/0/page/4|||Anonymous access seems like it would work but wait until you try to
administer RS. Since you are anonymous there is no such thing as
administrator rights. Oops. So then to administer it you have to switch off
of anonymous and then turn it back on. Most people would not want to do
that.
Bruce Loehle-Conger
MVP SQL Server Reporting Services
"sunil.jaikumar" <sunil.jaikumar@.gmail.com> wrote in message
news:1152863352.300856.43580@.m73g2000cwd.googlegroups.com...
> Why dont you enable anonymouse access and give everyone access in the
> report server.
> dev648237923 wrote:
>> I have two servers IIS Server and SQL2005.
>> I have web app using ReportViewer on IIS Server to view reports on SQL
>> Server SSRS.
>> Both servers are on domain1.
>> Authentication was not working so on IIS web app in web.config in
>> system.web
>> I say identity impersonate="true" userName="domain1\username"
>> password="password" then it works fine -- but is this correct way to do?
>> I
>> don't like to have to have an account in there that has admin privs -- I
>> thought it should be just impersonate="true" and not have to send a
>> domain
>> username/password?
>> I read many things on nntp about this topic but was unable to finad
>> anything
>> to work except for the way I have it above.
>> Thank you!
>

Auhtentification problem with Remote Data Access

Hello

I try to make a pull operation from an SQL SERVER 2005 database to a SQL Mobile 2005. I set Integrated authentification on IIS and SQL SEvrer authentification in the database. It passes the IIS authentification, but not the sql Server one. In addition, I tried to connect directlly to the sql with the same connection string anf it works.

Can you help me with this? Do i have to extra configure that dll(the agent) in the virtual directory, or sometihng llike that?

This is my code:

// Connection String to the SQL Server

//

string rdaOleDbConnectString = "Data Source=Sql07;Initial Catalog=AdventureWorks; " +

"User Id=sa;Password = sql250";

SqlConnection conn = new SqlConnection(rdaOleDbConnectString);

conn.Open();

// Initialize RDA Object

//

SqlCeRemoteDataAccess rda = null;

try

{

// Try the Pull Operation

//

rda = new SqlCeRemoteDataAccess(

"http://192.168.0.79/SqlMobileReplication/sqlcesa30.dll",

"assolutions\\dan.popescu",

"password",

"Data Source=\\my documents\\Baza.sdf");

rda.Pull("Employees", "SELECT * FROM DimEmployee", rdaOleDbConnectString,

RdaTrackOption.TrackingOnWithIndexes, "ErrorTable");

// or, try one of these overloads:

//

// rda.Pull("Employees", "SELECT * FROM DimEmployee", rdaOleDbConnectString,

// RdaTrackOption.TrackingOnWithIndexes);

//

// rda.Pull("Employees", "SELECT * FROM DimEmployee", rdaOleDbConnectString);

}

catch (Exception ex)

{

// Handle errors here

//

}

finally

{

// Dispose of the RDA object

//

rda.Dispose();

}

You can see that I have tried the connection first, and it really works. Isn't it the same thing it's doing at replication?

What is the error you are getting?
Also are you sure that the server has the table DimEmployee in the database?

Auhtentification problem with Remote Data Access

Hello

I try to make a pull operation from an SQL SERVER 2005 database to a SQL Mobile 2005. I set Integrated authentification on IIS and SQL SEvrer authentification in the database. It passes the IIS authentification, but not the sql Server one. In addition, I tried to connect directlly to the sql with the same connection string anf it works.

Can you help me with this? Do i have to extra configure that dll(the agent) in the virtual directory, or sometihng llike that?

This is my code:

// Connection String to the SQL Server

//

string rdaOleDbConnectString = "Data Source=Sql07;Initial Catalog=AdventureWorks; " +

"User Id=sa;Password = sql250";

SqlConnection conn = new SqlConnection(rdaOleDbConnectString);

conn.Open();

// Initialize RDA Object

//

SqlCeRemoteDataAccess rda = null;

try

{

// Try the Pull Operation

//

rda = new SqlCeRemoteDataAccess(

"http://192.168.0.79/SqlMobileReplication/sqlcesa30.dll",

"assolutions\\dan.popescu",

"password",

"Data Source=\\my documents\\Baza.sdf");

rda.Pull("Employees", "SELECT * FROM DimEmployee", rdaOleDbConnectString,

RdaTrackOption.TrackingOnWithIndexes, "ErrorTable");

// or, try one of these overloads:

//

// rda.Pull("Employees", "SELECT * FROM DimEmployee", rdaOleDbConnectString,

// RdaTrackOption.TrackingOnWithIndexes);

//

// rda.Pull("Employees", "SELECT * FROM DimEmployee", rdaOleDbConnectString);

}

catch (Exception ex)

{

// Handle errors here

//

}

finally

{

// Dispose of the RDA object

//

rda.Dispose();

}

You can see that I have tried the connection first, and it really works. Isn't it the same thing it's doing at replication?

What is the error you are getting?
Also are you sure that the server has the table DimEmployee in the database?

Audit Table

The current environment is an ASP frontend with IIS 5.0
using (windows authentication) and SQL Server 2000(windows
authentication) on the same machine.
I would like to add two columns onto several tables and
have a timestamp and username inserted into them when a
user performs an update or insert. I believe it's a good
idea to use an insert or update trigger, but I'm not sure
how the asp application delegates who is logged to sql
server.
What is the best way to do this?
Do you need to have IIS and Sql server configured a
certain way in order to grab the username from the asp
application?Front-end code typically has to influence on a trigger. The trigger fires
as a result of the triggering action - INSERT, UPDATE or DELETE. Here's an
example to do what you want:
create trigger triu_MyTable on MyTable after insert, update
as
if @.@.ROWCOUNT = 0
return
update MyTable
set
LastModBy = CURRENT_USER
, LastUpdateDateTime = CURRENT_TIMESTAMP
where
PK in (select PK from inserted)
go
Tom
----
Thomas A. Moreau, BSc, PhD, MCSE, MCDBA
SQL Server MVP
Columnist, SQL Server Professional
Toronto, ON Canada
www.pinnaclepublishing.com/sql
.
"Michelle" <michelle.vanden@.eglin.af.mil> wrote in message
news:034501c3cdc5$1a2f3a60$a401280a@.phx.gbl...
The current environment is an ASP frontend with IIS 5.0
using (windows authentication) and SQL Server 2000(windows
authentication) on the same machine.
I would like to add two columns onto several tables and
have a timestamp and username inserted into them when a
user performs an update or insert. I believe it's a good
idea to use an insert or update trigger, but I'm not sure
how the asp application delegates who is logged to sql
server.
What is the best way to do this?
Do you need to have IIS and Sql server configured a
certain way in order to grab the username from the asp
application?|||Hi Michelle,
Thanks for your post. According to your description, I understand that you
want to record and return the current login username to certain table in
SQL Server, when you performed insert or update action. If I have
misunderstood, please feel free to let me know.
Before we go any further, I would like to collect more information from
you: 1. Which username do you want to record, the usernames used to log on
IIS or SQL Server?
2. Which authentication do you choose to log on IIS?
So far as I know, if we want to record the usernames used for SQL Server,
we can try to use suser_sname() to return the string of the current login
identification name
For more information regarding suser_sname function, please refer to the
following article on SQL Server Books Online.
Topic: "SUSER_SNAME"
On the SQL Server side, it seems hard to record the usernames which are
used to log on IIS.
Thanks for using MSDN newsgroup.
Regards,
Michael Shao
Microsoft Online Partner Support
Get Secure! - www.microsoft.com/security
This posting is provided "as is" with no warranties and confers no rights.|||1). Both IIS and SQL Server if possible. It would be
better if we get the username from IIS and have it
delegated to SQL Server.
2). Basic Authentication w/SSL on IIS on one machine and
windows Authentication w/SSL on another.

quote:

---

>--Original Message--
>Hi Michelle,
>Thanks for your post. According to your description, I

---

understand that you

quote:

---

>want to record and return the current login username to

---

certain table in

quote:

---

>SQL Server, when you performed insert or update action.

---

If I have

quote:

---

>misunderstood, please feel free to let me know.
>Before we go any further, I would like to collect more

---

information from

quote:

---

>you: 1. Which username do you want to record, the

---

usernames used to log on

quote:

---

>IIS or SQL Server?
>2. Which authentication do you choose to log on IIS?
>So far as I know, if we want to record the usernames used

---

for SQL Server,

quote:

---

>we can try to use suser_sname() to return the string of

---

the current login

quote:

---

>identification name
>For more information regarding suser_sname function,

---

please refer to the

quote:

---

>following article on SQL Server Books Online.
>Topic: "SUSER_SNAME"
>On the SQL Server side, it seems hard to record the

---

usernames which are

quote:

---

>used to log on IIS.
>Thanks for using MSDN newsgroup.
>Regards,
>Michael Shao
>Microsoft Online Partner Support
>Get Secure! - www.microsoft.com/security
>This posting is provided "as is" with no warranties and

---

confers no rights.

quote:

---

>
>.
>

---

|||Hi Michelle,
Thanks for your feedback. In this case, as IIS and SQL Server are on the
same machine, a user's credentials (username:password) will be used to
login to SQL Server after that user has logged into IIS using Basic
authentication.
We are able to record the login information (current login username and
timestamp) for SQL Server using the trigger and the related functions
(SUSER_SNAME, GETDATE() etc.). However, it seems impossible to monitor the
logins to IIS from the SQL Server side. SQL Server is unable to be used to
monitor the logins to IIS.
Please feel free to post in the group if this solves your problem or if you
would like further assistance.
Regards,
Michael Shao
Microsoft Online Partner Support
Get Secure! - www.microsoft.com/security
This posting is provided "as is" with no warranties and confers no rights.|||Hi Michelle,
How is this issue going on your side? Based on my further research, it
seems possible to monitor and record the logins to IIS via ASP programming.
To obtain the detailed information regarding monitoring the logins to IIS
using ASP, it is best that you can post in the ASP newsgroup, such as
microsoft.public.inetserver.asp.general,
microsoft.public.inetserver.asp.db. The ASP newsgroup is primarily for
issues involving ASP programming. The reason why we recommend posting
appropriately is you will get the most qualified pool of respondents, and
other partners who read the newsgroups regularly can either share their
knowledge or learn from your interaction with us.
Thanks for using Microsoft newsgroup.
Regards,
Michael Shao
Microsoft Online Partner Support
Get Secure! - www.microsoft.com/security
This posting is provided "as is" with no warranties and confers no rights.