Authorization ticket not received by LogonUser

Hi, I integrated with
ReportingServices using Forms Authentication followed the instruction of the
article from microsoft, it works fine on my laptop (Windows 2003 server and
sql2000), but when I try to duplicate it on our company server (windows 2000
and sql2000), I always got the error: Authorization ticket not received by
LogonUser, when I try to login as the ReportAdmin user.
Could someone help?
Thank you at advance.
YanDid you ever find a solution this problem?
I'm having the same issue. It works on my LapTop but when I duplicate
exactly what I have on the Server, it doesn't work.
Thanks.
"Authorization ticket" wrote:
> Hi, I integrated with
> ReportingServices using Forms Authentication followed the instruction of the
> article from microsoft, it works fine on my laptop (Windows 2003 server and
> sql2000), but when I try to duplicate it on our company server (windows 2000
> and sql2000), I always got the error: Authorization ticket not received by
> LogonUser, when I try to login as the ReportAdmin user.
>
> Could someone help?
> Thank you at advance.
> Yan|||Make sure the <UrlRoot> element value in the RSReportServer.config file is
the same URL value you are using to call the ReportService.asmx.
This error will happen if you have <UrlRoot> =http://MACHINENAME/ReportServer and you are calling the web service like
http://localhost/ReportServer/ReportService.asmx
Not sure if that's the issue but it's something to check. For the auth
cookie to work, the cookie domains have to be the same.
--
Adrian M.
MCP
"Jon-Slem" <JonSlem@.discussions.microsoft.com> wrote in message
news:C1AC412B-0DCA-4F69-A590-650CDB81B344@.microsoft.com...
> Did you ever find a solution this problem?
> I'm having the same issue. It works on my LapTop but when I duplicate
> exactly what I have on the Server, it doesn't work.
> Thanks.
> "Authorization ticket" wrote:
>> Hi, I integrated with
>> ReportingServices using Forms Authentication followed the instruction of
>> the
>> article from microsoft, it works fine on my laptop (Windows 2003 server
>> and
>> sql2000), but when I try to duplicate it on our company server (windows
>> 2000
>> and sql2000), I always got the error: Authorization ticket not received
>> by
>> LogonUser, when I try to login as the ReportAdmin user.
>>
>> Could someone help?
>> Thank you at advance.
>> Yan|||I don't get it.
I fixed this and I'm still getting the error. I didn't even have do this on
my laptop.
Did your work right after you made the change? I made the change in the
ReportingService.cs file, I changed it to the machine name. The config file
was already the machine, no change was need there.
If you have any idea, please give my a buzz.
Thank.
"Adrian M." wrote:
> Make sure the <UrlRoot> element value in the RSReportServer.config file is
> the same URL value you are using to call the ReportService.asmx.
> This error will happen if you have <UrlRoot> => http://MACHINENAME/ReportServer and you are calling the web service like
> http://localhost/ReportServer/ReportService.asmx
> Not sure if that's the issue but it's something to check. For the auth
> cookie to work, the cookie domains have to be the same.
> --
> Adrian M.
> MCP
> "Jon-Slem" <JonSlem@.discussions.microsoft.com> wrote in message
> news:C1AC412B-0DCA-4F69-A590-650CDB81B344@.microsoft.com...
> > Did you ever find a solution this problem?
> > I'm having the same issue. It works on my LapTop but when I duplicate
> > exactly what I have on the Server, it doesn't work.
> > Thanks.
> >
> > "Authorization ticket" wrote:
> >
> >> Hi, I integrated with
> >> ReportingServices using Forms Authentication followed the instruction of
> >> the
> >> article from microsoft, it works fine on my laptop (Windows 2003 server
> >> and
> >> sql2000), but when I try to duplicate it on our company server (windows
> >> 2000
> >> and sql2000), I always got the error: Authorization ticket not received
> >> by
> >> LogonUser, when I try to login as the ReportAdmin user.
> >>
> >>
> >> Could someone help?
> >>
> >> Thank you at advance.
> >>
> >> Yan
>
>

authentication to SQL Server 2000 from ASP

please let me know if I need to post this on another SQL forum, and I'll be glad to do so.

I'm trying to set up the equivalent of Integrated Security=SSPI for SQL Server 2000 on IIS5.0. It's my understanding the SSPI string above is for Win NT, but not for Active Dir 2000 domains.

I'm using ASP 2.0 (NOT .Net), so please apprise me to what info I'd need in the connection string.

Currently it reads like this:

Set cn = CreateObject("ADODB.Connection")
cn.CursorLocation = 3 'Client side cursor
cn.Open "Provider=SQLOLEDB;Data Source=191.181.92.73;Integrated Security=SSPI"

Any feedback is welcomed.

Thanks!

Are the WebServer and the SQL Server on the same machine ? Did you enable Windows Authentication for the Website ?

Jens K. Suessmeyer

http://www.sqlserver2005.de
|||Any updates on that, or is the problem solved ?

Jens K. Suessmeyer.

http://www.sqlserver2005.de

Authentication Error with HTTP EndPoints

I keep getting these errors when I try to access an
endpoint I created. I have double checked and it is setup
for integrated authentication, grant connect has been
done on the account I am trying to access as and I still
get this error.
Any ideas or suggestions are welcome and appreciated.
Walt
Event Type:Error
Event Source:MSSQLSERVER
Event Category:Logon
Event ID:26026
Date:6/4/2005
Time:7:36:37 PM
User:N/A
Computer:HWCVS17
Description:
HTTP authentication failed. [CLIENT: X.X.X.X]
For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
Data:
0000: aa 65 00 00 0e 00 00 00 e.....
0008: 08 00 00 00 48 00 57 00 ...H.W.
0010: 43 00 56 00 53 00 31 00 C.V.S.1.
0018: 37 00 00 00 00 00 00 00 7......
Hi Jim,
Could you please post the exact steps you performed to create the HTTP
EndPoints and the URL you used to connect to the SQL Server? This will help
us get a clear picture of the problem.
You may want to refer to the SQLXML chapter and sub-chapters in MSDN for
more information:
http://msdn.microsoft.com/library/en...nch_SQLXML.asp
Sincerely,
William Wang
Microsoft Online Partner Support
When responding to posts, please "Reply to Group" via your newsreader so
that others may learn and benefit from your issue.
This posting is provided "AS IS" with no warranties, and confers no rights.

Authentication Error with HTTP EndPoints

I keep getting these errors when I try to access an
endpoint I created. I have double checked and it is setup
for integrated authentication, grant connect has been
done on the account I am trying to access as and I still
get this error.
Any ideas or suggestions are welcome and appreciated.
Walt
Event Type: Error
Event Source: MSSQLSERVER
Event Category: Logon
Event ID: 26026
Date: 6/4/2005
Time: 7:36:37 PM
User: N/A
Computer: HWCVS17
Description:
HTTP authentication failed. [CLIENT: X.X.X.X]
For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
Data:
0000: aa 65 00 00 0e 00 00 00 e.....
0008: 08 00 00 00 48 00 57 00 ...H.W.
0010: 43 00 56 00 53 00 31 00 C.V.S.1.
0018: 37 00 00 00 00 00 00 00 7......Hi Jim,
Could you please post the exact steps you performed to create the HTTP
EndPoints and the URL you used to connect to the SQL Server? This will help
us get a clear picture of the problem.
You may want to refer to the SQLXML chapter and sub-chapters in MSDN for
more information:
http://msdn.microsoft.com/library/e...anch_SQLXML.asp
Sincerely,
William Wang
Microsoft Online Partner Support
When responding to posts, please "Reply to Group" via your newsreader so
that others may learn and benefit from your issue.
This posting is provided "AS IS" with no warranties, and confers no rights.

Authentication an application using Windows Integrated Authentication

Hi all,

My work is using a shared application which accesses a MSSQL 2000 database. To access the application, the folder on the Windows 2003 Server is shared and users can access the folder through a shared drive.

For the application to access the database, it uses an ODBC connection to the MSSQL server which originally used the SA password.

We have recently switched to using Windows Integrated Authentication because we believe it offers a higher level of security. However the only way in which we have been able to enable this is to add the windows users to the SQL server.

The problem with this is that the application sets permissions for individual users on what records they can see within the database. We have found that by adding the windows users to the SQL Server, they can bypass the permissions the set by the application by simply using any application that can use an ODBC connection, such as Enterprise Manager, and see all the database.

One way around this would be to set up domains of users with access privileges to the tables which reflect the permissions set by the application, and configuring a view of the data so they may only see the records that they have permissions to. However to do this would require a high administrative cost to ensure that changes made in the application are reflected in the privileges of the SQL server.

Instead, is there a way the SQL server can authenticate that the ODBC connection is coming from the correct application using Windows Integrated Authentication?

This would allow the applcation to determine security, and stop users from connecting to the SQL server using other applications.

Alternatively, can the SQL server, using Windows Integrated Authentication, also ask the application to supply a username and password?

Any help with this matter would be greatly appreciated.

Thanks!

The answer to both your questions is no. Windows authentication does not authenticate the application that made the connection request, it just authenticates the context under which the connection request was made. Also, the whole purpose of Windows Authentication is to remove the need to provide a password, so if you want to use a password, you should just continue using SQL Authentication.

Also, your application should not control database access within itself. Database access should be controled in the database or in a mid-tier, not within the client application.

Thanks
Laurentiu

|||

Thanks Laurentiu,

I would love to have control over the application itself and do it and a more securely, but we didn't create the application, and trying to get the vendor to do it is like pulling teeth.

What I'm really after is the best security configuration for the application which will provide the highest level of security, and more importantly please my manager :)

The only things we have control over are whether the application uses the SQL Password or Windows Authentication, and who can access the folder with the application in it.

When using the SQL Password, the application can only log into the database using the one account, which basically must have rights to do everything.

Using Window Authentication, I have to add individual users to the SQL Server to allow the application to access the database when they are using the application. However, this will allow the user to use other applications to access the server, since they have rights to it.

What do you think is the best configuration?

Thanks.

|||

Where does the application store the sa password? If your users can easily get to it, they can connect as sa. Also, if they can debug the application, they can get the password and connect directly as sa. So the drawback of having the application connect as sa is that your users could figure out the sa password and can then become admins.

If you use Windows authentication, the users could connect on their own to the server, but they would probably not be administrators (unless the application makes any Windows login that is used with it an administrator).

I'm not sure which one of these you would prefer.

Thanks
Laurentiu

Authentication an application using Windows Integrated Authentication

Hi all,

My work is using a shared application which accesses a MSSQL 2000 database. To access the application, the folder on the Windows 2003 Server is shared and users can access the folder through a shared drive.

For the application to access the database, it uses an ODBC connection to the MSSQL server which originally used the SA password.

We have recently switched to using Windows Integrated Authentication because we believe it offers a higher level of security. However the only way in which we have been able to enable this is to add the windows users to the SQL server.

The problem with this is that the application sets permissions for individual users on what records they can see within the database. We have found that by adding the windows users to the SQL Server, they can bypass the permissions the set by the application by simply using any application that can use an ODBC connection, such as Enterprise Manager, and see all the database.

One way around this would be to set up domains of users with access privileges to the tables which reflect the permissions set by the application, and configuring a view of the data so they may only see the records that they have permissions to. However to do this would require a high administrative cost to ensure that changes made in the application are reflected in the privileges of the SQL server.

Instead, is there a way the SQL server can authenticate that the ODBC connection is coming from the correct application using Windows Integrated Authentication?

This would allow the applcation to determine security, and stop users from connecting to the SQL server using other applications.

Alternatively, can the SQL server, using Windows Integrated Authentication, also ask the application to supply a username and password?

Any help with this matter would be greatly appreciated.

Thanks!

The answer to both your questions is no. Windows authentication does not authenticate the application that made the connection request, it just authenticates the context under which the connection request was made. Also, the whole purpose of Windows Authentication is to remove the need to provide a password, so if you want to use a password, you should just continue using SQL Authentication.

Also, your application should not control database access within itself. Database access should be controled in the database or in a mid-tier, not within the client application.

Thanks
Laurentiu

|||

Thanks Laurentiu,

I would love to have control over the application itself and do it and a more securely, but we didn't create the application, and trying to get the vendor to do it is like pulling teeth.

What I'm really after is the best security configuration for the application which will provide the highest level of security, and more importantly please my manager :)

The only things we have control over are whether the application uses the SQL Password or Windows Authentication, and who can access the folder with the application in it.

When using the SQL Password, the application can only log into the database using the one account, which basically must have rights to do everything.

Using Window Authentication, I have to add individual users to the SQL Server to allow the application to access the database when they are using the application. However, this will allow the user to use other applications to access the server, since they have rights to it.

What do you think is the best configuration?

Thanks.

|||

Where does the application store the sa password? If your users can easily get to it, they can connect as sa. Also, if they can debug the application, they can get the password and connect directly as sa. So the drawback of having the application connect as sa is that your users could figure out the sa password and can then become admins.

If you use Windows authentication, the users could connect on their own to the server, but they would probably not be administrators (unless the application makes any Windows login that is used with it an administrator).

I'm not sure which one of these you would prefer.

Thanks
Laurentiu

Auhtentification problem with Remote Data Access

Hello

I try to make a pull operation from an SQL SERVER 2005 database to a SQL Mobile 2005. I set Integrated authentification on IIS and SQL SEvrer authentification in the database. It passes the IIS authentification, but not the sql Server one. In addition, I tried to connect directlly to the sql with the same connection string anf it works.

Can you help me with this? Do i have to extra configure that dll(the agent) in the virtual directory, or sometihng llike that?

This is my code:

// Connection String to the SQL Server

//

string rdaOleDbConnectString = "Data Source=Sql07;Initial Catalog=AdventureWorks; " +

"User Id=sa;Password = sql250";

SqlConnection conn = new SqlConnection(rdaOleDbConnectString);

conn.Open();

// Initialize RDA Object

//

SqlCeRemoteDataAccess rda = null;

try

{

// Try the Pull Operation

//

rda = new SqlCeRemoteDataAccess(

"http://192.168.0.79/SqlMobileReplication/sqlcesa30.dll",

"assolutions\\dan.popescu",

"password",

"Data Source=\\my documents\\Baza.sdf");

rda.Pull("Employees", "SELECT * FROM DimEmployee", rdaOleDbConnectString,

RdaTrackOption.TrackingOnWithIndexes, "ErrorTable");

// or, try one of these overloads:

//

// rda.Pull("Employees", "SELECT * FROM DimEmployee", rdaOleDbConnectString,

// RdaTrackOption.TrackingOnWithIndexes);

//

// rda.Pull("Employees", "SELECT * FROM DimEmployee", rdaOleDbConnectString);

}

catch (Exception ex)

{

// Handle errors here

//

}

finally

{

// Dispose of the RDA object

//

rda.Dispose();

}

You can see that I have tried the connection first, and it really works. Isn't it the same thing it's doing at replication?

What is the error you are getting?
Also are you sure that the server has the table DimEmployee in the database?

Auhtentification problem with Remote Data Access

Hello

I try to make a pull operation from an SQL SERVER 2005 database to a SQL Mobile 2005. I set Integrated authentification on IIS and SQL SEvrer authentification in the database. It passes the IIS authentification, but not the sql Server one. In addition, I tried to connect directlly to the sql with the same connection string anf it works.

Can you help me with this? Do i have to extra configure that dll(the agent) in the virtual directory, or sometihng llike that?

This is my code:

// Connection String to the SQL Server

//

string rdaOleDbConnectString = "Data Source=Sql07;Initial Catalog=AdventureWorks; " +

"User Id=sa;Password = sql250";

SqlConnection conn = new SqlConnection(rdaOleDbConnectString);

conn.Open();

// Initialize RDA Object

//

SqlCeRemoteDataAccess rda = null;

try

{

// Try the Pull Operation

//

rda = new SqlCeRemoteDataAccess(

"http://192.168.0.79/SqlMobileReplication/sqlcesa30.dll",

"assolutions\\dan.popescu",

"password",

"Data Source=\\my documents\\Baza.sdf");

rda.Pull("Employees", "SELECT * FROM DimEmployee", rdaOleDbConnectString,

RdaTrackOption.TrackingOnWithIndexes, "ErrorTable");

// or, try one of these overloads:

//

// rda.Pull("Employees", "SELECT * FROM DimEmployee", rdaOleDbConnectString,

// RdaTrackOption.TrackingOnWithIndexes);

//

// rda.Pull("Employees", "SELECT * FROM DimEmployee", rdaOleDbConnectString);

}

catch (Exception ex)

{

// Handle errors here

//

}

finally

{

// Dispose of the RDA object

//

rda.Dispose();

}

You can see that I have tried the connection first, and it really works. Isn't it the same thing it's doing at replication?

What is the error you are getting?
Also are you sure that the server has the table DimEmployee in the database?