Showing posts with label security. Show all posts
Showing posts with label security. Show all posts

Monday, March 26, 2012

Problem in connecting to SSAS

I'm facing some security when deploying SSAS and reports using Reporting Services. In my environment, I don't understand why I can access the SSAS via the management studio if I don't have the domain administrator right. The support team have granted this right to me for development purpose.
In the connection dialog of Management Studio, I can only choose Server name after I click Connect --> Analysis Services. The authentication type is dimmed out by default. Please gives me some more relevant links to setup properly.
After deployed my cubes and reports, the other user cannot view the reports as they can't access the SSAS database. What should I do? There're so many security setting and I don't know which one I should tune. Thanks in advance.

Hello! You do not need to be an domain adminstrator in order to access Reporting Services and Analysis Services. It is sufficient to be a local administrator on the server running these two applications.

In Reporting Services you have the option to run a report with windows authentication or an assigned account for Reporting Services access to Analysis Services.

If you run with the first option each user need to mapped to a role in Analysis Services which can be done with individual accounts or windows groups. For the second option it is only the Reporting Services(AS2005) account that needs to mapped to a role in Analysis Services.

You can do this both in BIDS, Report Manager or Management Studio.

This is true for a server where both these applications are running. If Reporting Services is on a separate server things are a little bit more complicated. In this case you will have to set up account delegation in Active Directory. The key word for this setup is 'Kerberos' .

HTH

Thomas Ivarsson

|||Can you give me some more detail on the configuration please? Are there any guides available on the web? Thanks!|||

Hello! I have not found any best official practices regarding SSRS2005 and SSAS2005 integration.

My advice is based on customer cases/practises that I have used and some good writing in a reporting services book.

Regards

Thomas Ivarsson

|||http://technet.microsoft.com/en-us/library/ms175386(SQL.90).aspx

This website provides what I needed.

Problem in connecting to SSAS

I'm facing some security when deploying SSAS and reports using Reporting Services. In my environment, I don't understand why I can access the SSAS via the management studio if I don't have the domain administrator right. The support team have granted this right to me for development purpose.
In the connection dialog of Management Studio, I can only choose Server name after I click Connect --> Analysis Services. The authentication type is dimmed out by default. Please gives me some more relevant links to setup properly.
After deployed my cubes and reports, the other user cannot view the reports as they can't access the SSAS database. What should I do? There're so many security setting and I don't know which one I should tune. Thanks in advance.

Hello! You do not need to be an domain adminstrator in order to access Reporting Services and Analysis Services. It is sufficient to be a local administrator on the server running these two applications.

In Reporting Services you have the option to run a report with windows authentication or an assigned account for Reporting Services access to Analysis Services.

If you run with the first option each user need to mapped to a role in Analysis Services which can be done with individual accounts or windows groups. For the second option it is only the Reporting Services(AS2005) account that needs to mapped to a role in Analysis Services.

You can do this both in BIDS, Report Manager or Management Studio.

This is true for a server where both these applications are running. If Reporting Services is on a separate server things are a little bit more complicated. In this case you will have to set up account delegation in Active Directory. The key word for this setup is 'Kerberos' .

HTH

Thomas Ivarsson

|||Can you give me some more detail on the configuration please? Are there any guides available on the web? Thanks!|||

Hello! I have not found any best official practices regarding SSRS2005 and SSAS2005 integration.

My advice is based on customer cases/practises that I have used and some good writing in a reporting services book.

Regards

Thomas Ivarsson

|||http://technet.microsoft.com/en-us/library/ms175386(SQL.90).aspx

This website provides what I needed.sql

Wednesday, March 21, 2012

Problem getting some users to be able to run reports (probably security of some sort)

I am able to deploy and run reports from my screen at work, but some non-developers cannot run them. They can see the reports, but get the following error message when they click on the report:

  • An error has occurred during report processing. (rsProcessingAborted)

  • Cannot create a connection to data source 'DataSource1'. (rsErrorOpeningConnection)

  • For more information about this error navigate to the report server on the local server machine, or enable remote errors

  • --

  • --

  • - I assume the preceding error has something to do with credentials. I am using Windows security authentication for this. One user has worked through this and is now getting cannot run report query (one of the report queries in the report). Help would be appreciated.

  • Can you make sure that the users who are having issues can actually connect to the SQL Server & database?

    Have you tried running Profiler to see what credentials are actually passed to the SQL Server when the user runs the report?

    Jarret

    |||What was found was a security issue. I got some DBA help in setting up permissions to login to the database and to grant run permissions on the queries. First access was granted to the database itself, the we had to go into security on the database and setup the user and grant permissions. This resolved the problem.
  • Problem getting security for configuration database

    Below is what I have put into an execute sql task container. When I try to run it I have output open and have posted the output. The code runs fine when I have the configuration database set up to only check one server. However, when I add anymore to it, the package will get the security from the first db and then error out. Below is the error output and script. Any help with my problem is greatly appreciated.

    **********Begin script*******************

    declare @.dbname varchar(200)
    declare @.mSql1 varchar(8000)

    DECLARE DBName_Cursor CURSOR FOR
    select name
    from master.dbo.sysdatabases
    where name not in ('mssecurity','tempdb')
    Order by name

    OPEN DBName_Cursor

    FETCH NEXT FROM DBName_Cursor INTO @.dbname

    WHILE @.@.FETCH_STATUS = 0
    BEGIN
    Set @.mSQL1 = ' Insert into [tempdb].[dbo].[DBROLES] ( DBName, UserName, db_owner, db_accessadmin,
    db_securityadmin, db_ddladmin, db_datareader, db_datawriter,
    db_denydatareader, db_denydatawriter )
    SELECT '+''''+@.dbName +''''+ ' as DBName ,UserName, '+char(13)+ '
    Max(CASE RoleName WHEN ''db_owner'' THEN ''Yes'' ELSE ''No'' END) AS db_owner,
    Max(CASE RoleName WHEN ''db_accessadmin '' THEN ''Yes'' ELSE ''No'' END) AS db_accessadmin ,
    Max(CASE RoleName WHEN ''db_securityadmin'' THEN ''Yes'' ELSE ''No'' END) AS db_securityadmin,
    Max(CASE RoleName WHEN ''db_ddladmin'' THEN ''Yes'' ELSE ''No'' END) AS db_ddladmin,
    Max(CASE RoleName WHEN ''db_datareader'' THEN ''Yes'' ELSE ''No'' END) AS db_datareader,
    Max(CASE RoleName WHEN ''db_datawriter'' THEN ''Yes'' ELSE ''No'' END) AS db_datawriter,
    Max(CASE RoleName WHEN ''db_denydatareader'' THEN ''Yes'' ELSE ''No'' END) AS db_denydatareader,
    Max(CASE RoleName WHEN ''db_denydatawriter'' THEN ''Yes'' ELSE ''No'' END) AS db_denydatawriter
    from (
    select b.name as USERName, c.name as RoleName
    from ' + @.dbName+'.dbo.sysmembers a '+char(13)+
    ' join '+ @.dbName+'.dbo.sysusers b '+char(13)+
    ' on a.memberuid = b.uid join '+@.dbName +'.dbo.sysusers c
    on a.groupuid = c.uid )s
    Group by USERName
    order by UserName'

    --Print @.mSql1
    Execute (@.mSql1)

    FETCH NEXT FROM DBName_Cursor INTO @.dbname
    END

    CLOSE DBName_Cursor
    DEALLOCATE DBName_Cursor
    Go

    ****************End Script***********************

    ****************Begin Error Output********************

    [Execute SQL Task] Error: Executing the query "declare @.dbname varchar(200) declare @.mSql1 varchar(8000) DECLARE DBName_Cursor CURSOR FOR select name from master.dbo.sysdatabases where name not in ('mssecurity','tempdb') Order by name OPEN DBName_Cursor FETCH NEXT FROM DBName_Cursor INTO @.dbname WHILE @.@.FETCH_STATUS = 0 BEGIN Set @.mSQL1 = ' Insert into [tempdb].[dbo].[DBROLES] ( DBName, UserName, db_owner, db_accessadmin, db_securityadmin, db_ddladmin, db_datareader, db_datawriter, db_denydatareader, db_denydatawriter ) SELECT '+''''+@.dbName +''''+ ' as DBName ,UserName, '+char(13)+ ' Max(CASE RoleName WHEN ''db_owner'' THEN ''Yes'' ELSE ''No'' END) AS db_owner, Max(CASE RoleName WHEN ''db_accessadmin '' THEN ''Yes'' ELSE ''No'' END) AS db_accessadmin , Max(CASE RoleName WHEN ''db_securityadmin'' THEN ''Yes'' ELSE ''No'' END) AS db_securityadmin, Max(CASE RoleName WHEN ''db_ddladmin'' THEN ''Yes'' ELSE ''No'' END) AS db_ddladmin, Max(CASE RoleName WHEN ''db_datareader'' THEN ''Yes'' ELSE ''No'' END) AS db_datareader, Max(CASE RoleName WHEN ''db_datawriter'' THEN ''Yes'' ELSE ''No'' END) AS db_datawriter, Max(CASE RoleName WHEN ''db_denydatareader'' THEN ''Yes'' ELSE ''No'' END) AS db_denydatareader, Max(CASE RoleName WHEN ''db_denydatawriter'' THEN ''Yes'' ELSE ''No'' END) AS db_denydatawriter from ( select b.name as USERName, c.name as RoleName from ' + @.dbName+'.dbo.sysmembers a '+char(13)+ ' join '+ @.dbName+'.dbo.sysusers b '+char(13)+ ' on a.memberuid = b.uid join '+@.dbName +'.dbo.sysusers c on a.groupuid = c.uid )s Group by USERName order by UserName' --Print @.mSql1 Execute (@.mSql1) FETCH NEXT FROM DBName_Cursor INTO @.dbname END CLOSE DBName_Cursor DEALLOCATE DBName_Cursor " failed with the following error: "Line 15: Incorrect syntax near '-'.". Possible failure reasons: Problems with the query, "ResultSet" property not set correctly, parameters not set correctly, or connection not established correctly.

    **************End Error Output**************

    Not knowing your database names, I'd suspect that one or more of them have names that need to be bracketed in a SQL statement. The error indicates that one might have a hyphen in the name? Try putting brackets around the @.dbname variable. Ex: "from [' + @.dbName+'].dbo.sysmembers"|||I don't get why the SSIS package would work for one database then. I will try what you suggest though. I am attempting to spearhead the SSIS learning in my department and learning has been pretty slow.|||

    kschlap wrote:

    I don't get why the SSIS package would work for one database then. I will try what you suggest though. I am attempting to spearhead the SSIS learning in my department and learning has been pretty slow.

    What you have would work fine for a database named FooBar, but it would fail with the error you posted if the database were named Foo-Bar.
    |||

    I"m sorry, I made a mistake in my last post. I meant to say it worked for one server, but won't work for any other server.

    -Kyle

    |||

    I think I have figured out one of the problems. I need to change the OLE DB Connection Manager. However, it won't let me do this and hit ok because it says that the table in my FROM clause is not in the database. Well of course its not on the database because the table gets built dynamically and the servers are gathered dynamically. How can I change this?

    -Kyle

    |||SSIS tries to validate the tasks when you are editing them; so I guess the table have to exists while you are editing the package. At run time though you can set DelayValidation to true; so the package does not fail validation.|||

    The problem with this is that the connection I am trying to use is generated dynamically too. Thus, there are no servers until run time that I could add the table to to get around this error.

    -Kyle

    |||I don't get that. Does this mean you don't have a development environment where you can create oll required stuff? remebember this is just for validation purposes.|||

    No, I have the proper development environment. I just get an error that says that the table doesn't exist whenever I try to make a change to the OLE DB connection. Here is the message I sent to the template creator yesterday.

    I am having trouble with changing an OLE DB source. The package is set to not validate until run time, but currently it won’t let me change one of the settings. I keep getting an error that the table it is referring to is not valid. However, I know that it isn’t created because it gets created at run-time. Is there a way to change OLE DB sources? As always any help is appreciated.

    |||

    I fixed the problem. The package needed me to make an advanced edit instead of a normal one? Weird, but I don't care why it worked just because it worked. If anybody else is building a sql dba configuration database, mine is from a template by sqlmag, please PM me and we can work together on them.

    -Kyle

    Tuesday, March 20, 2012

    problem for Security in Sql 2005 Express.

    hi
    i am using vc# 2005 and sql 2005 express.
    my problem is does exist any way to set password on sql2005 database ?
    (because i don't want to end users access to sql server's tables and datas and ...)
    how to solve my problem ?
    thanks

    Hi Hamed

    You can download Microsoft SQL Server Management Studio Express and you can create users there for your database.

    Regards,

    Pradeep

    |||

    Hi,

    You don′t set password on databases. You create logins on the server level (server principals) which relate to either a Windows Account (Windows Authentication) or a SQL Server account (SQL Server authewntication). These principals can be either in a overall server role and / or be granted access to individual databases with database principals. these database principals can be granted individual right on the objects within the database (securables) or can be assigned to database roles.

    So, first create a server login for an indivudal user or a Windows groups, then grant the appropiates right either individually or through the role membership within the database.

    HTH, Jens K. Suessmeyer.


    http://www.sqlserver2005.de