Hi,
I am trying to deploy my reports to a new server running reporting
services w/ SQL Server 2000 on the local machine. The ReportServer web site
has anonymous access NOT checked and Windows Integration selected. I'm
logged onto my machine with my domain account and when I try to deploy my
reports in VS 2003 I get "The underlying connection was closed: Could not
establish trust relationship with remote server." I do NOT have "Require
SSL" turned on and I know it has something to do with the way my credentials
are being passed (or not passed). If I turn on the option to allow
anonymous access to the reportserver site then I get a message that my
IUSR_<machinename> has insufficient privleges to perform the actions, which
is fine I don't want anonymous access on anyway.
How do I resolve deploying reports to the report server with my domain
account? I used the same domain account to install SQL Server and Reporting
Services and I am a local administrator on the server.
Thanks, ChrisIn addition to what I've discovered...
I can take the same URL I'm using for the TargetServerURL property and
browse to the report server. I get a pop-up dialog box to input my
credentials and I'm authenticated fine. Based on Microsoft Knowledge Base
Article - 842517 it would seem that the login dialog box should appear, but
it doesn't and just the error "Could not
> establish trust relationship with remote server." appears. The local
administrators are "content managers" for reporting services and I am a
member of that group, though I don't think the deployment process is making
it that far.
Thanks, Chris
"Chris" <chrisf@.unr.edu> wrote in message
news:u03AZPxfEHA.3536@.TK2MSFTNGP12.phx.gbl...
> Hi,
> I am trying to deploy my reports to a new server running reporting
> services w/ SQL Server 2000 on the local machine. The ReportServer web
site
> has anonymous access NOT checked and Windows Integration selected. I'm
> logged onto my machine with my domain account and when I try to deploy my
> reports in VS 2003 I get "The underlying connection was closed: Could not
> establish trust relationship with remote server." I do NOT have "Require
> SSL" turned on and I know it has something to do with the way my
credentials
> are being passed (or not passed). If I turn on the option to allow
> anonymous access to the reportserver site then I get a message that my
> IUSR_<machinename> has insufficient privleges to perform the actions,
which
> is fine I don't want anonymous access on anyway.
> How do I resolve deploying reports to the report server with my domain
> account? I used the same domain account to install SQL Server and
Reporting
> Services and I am a local administrator on the server.
> Thanks, Chris
>|||Chris:
In IE's security settings for the zone, is User Authentication set to
automatic logon or prompt? You might want to check here (Tools ->
Options -> Security -> Custom Level (for the zone your report server
is in).
--
Scott
http://www.OdeToCode.com
On Tue, 10 Aug 2004 12:54:27 -0700, "Chris" <chrisf@.unr.edu> wrote:
>Hi,
> I am trying to deploy my reports to a new server running reporting
>services w/ SQL Server 2000 on the local machine. The ReportServer web site
>has anonymous access NOT checked and Windows Integration selected. I'm
>logged onto my machine with my domain account and when I try to deploy my
>reports in VS 2003 I get "The underlying connection was closed: Could not
>establish trust relationship with remote server." I do NOT have "Require
>SSL" turned on and I know it has something to do with the way my credentials
>are being passed (or not passed). If I turn on the option to allow
>anonymous access to the reportserver site then I get a message that my
>IUSR_<machinename> has insufficient privleges to perform the actions, which
>is fine I don't want anonymous access on anyway.
>How do I resolve deploying reports to the report server with my domain
>account? I used the same domain account to install SQL Server and Reporting
>Services and I am a local administrator on the server.
>Thanks, Chris
>|||Hey Scott,
The IE zone setting changes don't have any affect. Visual Studio
continues to report the trust relationship error. I've tried both secure
and non-secure TargetServerURL properties.
Chris
"Scott Allen" <bitmask@.[nospam].fred.net> wrote in message
news:jp1jh0dq2m82lm982j8rab8flnjjde59o2@.4ax.com...
> Chris:
> In IE's security settings for the zone, is User Authentication set to
> automatic logon or prompt? You might want to check here (Tools ->
> Options -> Security -> Custom Level (for the zone your report server
> is in).
> --
> Scott
> http://www.OdeToCode.com
> On Tue, 10 Aug 2004 12:54:27 -0700, "Chris" <chrisf@.unr.edu> wrote:
> >Hi,
> > I am trying to deploy my reports to a new server running reporting
> >services w/ SQL Server 2000 on the local machine. The ReportServer web
site
> >has anonymous access NOT checked and Windows Integration selected. I'm
> >logged onto my machine with my domain account and when I try to deploy my
> >reports in VS 2003 I get "The underlying connection was closed: Could not
> >establish trust relationship with remote server." I do NOT have "Require
> >SSL" turned on and I know it has something to do with the way my
credentials
> >are being passed (or not passed). If I turn on the option to allow
> >anonymous access to the reportserver site then I get a message that my
> >IUSR_<machinename> has insufficient privleges to perform the actions,
which
> >is fine I don't want anonymous access on anyway.
> >
> >How do I resolve deploying reports to the report server with my domain
> >account? I used the same domain account to install SQL Server and
Reporting
> >Services and I am a local administrator on the server.
> >
> >Thanks, Chris
> >
>|||Well, I changed the security on the web site to require secure connections
and installed the certificate from the server into my machine's certificate
store and the deploy worked. I don't quite fully understand why non-ssl
connections don't work, but turning ssl on and making sure the CA was
trusted fixed the problem. Could this have been a bug or is there some
requirement that a secure connection be used to deploy reporting service
objects?
Chris
"Scott Allen" <bitmask@.[nospam].fred.net> wrote in message
news:jp1jh0dq2m82lm982j8rab8flnjjde59o2@.4ax.com...
> Chris:
> In IE's security settings for the zone, is User Authentication set to
> automatic logon or prompt? You might want to check here (Tools ->
> Options -> Security -> Custom Level (for the zone your report server
> is in).
> --
> Scott
> http://www.OdeToCode.com
> On Tue, 10 Aug 2004 12:54:27 -0700, "Chris" <chrisf@.unr.edu> wrote:
> >Hi,
> > I am trying to deploy my reports to a new server running reporting
> >services w/ SQL Server 2000 on the local machine. The ReportServer web
site
> >has anonymous access NOT checked and Windows Integration selected. I'm
> >logged onto my machine with my domain account and when I try to deploy my
> >reports in VS 2003 I get "The underlying connection was closed: Could not
> >establish trust relationship with remote server." I do NOT have "Require
> >SSL" turned on and I know it has something to do with the way my
credentials
> >are being passed (or not passed). If I turn on the option to allow
> >anonymous access to the reportserver site then I get a message that my
> >IUSR_<machinename> has insufficient privleges to perform the actions,
which
> >is fine I don't want anonymous access on anyway.
> >
> >How do I resolve deploying reports to the report server with my domain
> >account? I used the same domain account to install SQL Server and
Reporting
> >Services and I am a local administrator on the server.
> >
> >Thanks, Chris
> >
>|||I am using integrated security without ssl. I did have a problem once where
I went through an install without unchecking ssl and I was messed up. Don't
remember how I got out of the hole. However, I have done a couple of
installs since then and made sure to un-check ssl and everything went
smoothly.
Bruce L-C
"Chris" <chrisf@.unr.edu> wrote in message
news:%23hQmER7fEHA.140@.TK2MSFTNGP12.phx.gbl...
> Well, I changed the security on the web site to require secure connections
> and installed the certificate from the server into my machine's
certificate
> store and the deploy worked. I don't quite fully understand why non-ssl
> connections don't work, but turning ssl on and making sure the CA was
> trusted fixed the problem. Could this have been a bug or is there some
> requirement that a secure connection be used to deploy reporting service
> objects?
> Chris
> "Scott Allen" <bitmask@.[nospam].fred.net> wrote in message
> news:jp1jh0dq2m82lm982j8rab8flnjjde59o2@.4ax.com...
> > Chris:
> >
> > In IE's security settings for the zone, is User Authentication set to
> > automatic logon or prompt? You might want to check here (Tools ->
> > Options -> Security -> Custom Level (for the zone your report server
> > is in).
> >
> > --
> > Scott
> > http://www.OdeToCode.com
> >
> > On Tue, 10 Aug 2004 12:54:27 -0700, "Chris" <chrisf@.unr.edu> wrote:
> >
> > >Hi,
> > > I am trying to deploy my reports to a new server running reporting
> > >services w/ SQL Server 2000 on the local machine. The ReportServer web
> site
> > >has anonymous access NOT checked and Windows Integration selected. I'm
> > >logged onto my machine with my domain account and when I try to deploy
my
> > >reports in VS 2003 I get "The underlying connection was closed: Could
not
> > >establish trust relationship with remote server." I do NOT have
"Require
> > >SSL" turned on and I know it has something to do with the way my
> credentials
> > >are being passed (or not passed). If I turn on the option to allow
> > >anonymous access to the reportserver site then I get a message that my
> > >IUSR_<machinename> has insufficient privleges to perform the actions,
> which
> > >is fine I don't want anonymous access on anyway.
> > >
> > >How do I resolve deploying reports to the report server with my domain
> > >account? I used the same domain account to install SQL Server and
> Reporting
> > >Services and I am a local administrator on the server.
> > >
> > >Thanks, Chris
> > >
> >
>
Showing posts with label security. Show all posts
Showing posts with label security. Show all posts
Thursday, March 22, 2012
Monday, March 19, 2012
Deploying with custom Forms Security enabled
I have recently enabled a custom Forms Security on my Windows 2003 Server w/ SQL Server 2005 Reporting Services. All the functionality I would expect is working properly, except for the ability to deploy to the reports server from inside my Visual Studio 2005 Reports Project.
The 'Reporting Services Login' window opens, prompting me for a username and password. Regardless of what is supplied, the window keeps reappearing, and I am unable to deploy. I am able to upload the files from within the Report Manager, but that is time consuming and inelegant.
Any help would be greatly appreciated!
Anyone? This is pretty peculiar, and it looks like there was a similar issue with SQL Server 2000 and its reporting services. Has any experienced anything like this?|||I too am stuck:
I have setup Forms Authentication on RS2005 and the report manager is working
swell it redirects to a log in page, authenticates against our data
source/ldap server and returns to the report manager with the appropriate
roles/authorizations.
However, I don't know how to deploy the reports/models to the report server. I no longer have a prompt in Visual Studio after we enabled the
forms authenticaiton; keeping in mind with forms authentication you aren't
using windows authorization/active directory. How do I continue to deploy
reports or report models to the report server/manager with forms
authentication. Specific configuration steps would be helpful. Currently we
get an error something to the effect that user '' doesn't have permissions to
the destination. So basically without a prompt window it doesn't seem to know
who I am anymore. How would I login or use/create a cookie to tell it who I
am if I don't have a login prompt inside the Visual Studio 2005?
Thanks!
I finally figured out that the two project types handle the username string differently. For getting the Report Model to deploy correctly, you must specify an authority before the username even if you don't use one in your custom security extension. (i.e. ANYTHING\username or .\username, \username doesn't work). Done so, the username string gets parsed correctly and the deployment works fine.|||bump.... I'm not even getting a dialog...|||
Not sure if anyone out there is still struggling with the continual login dialog or not. I was and found out what my problem was. I was trying to deploy to "http:\localhost\reports" instead of http:\localhost\ReportServer"!
ugh!
Anyway, hope this helps someone!
Deploying with custom Forms Security enabled
I have recently enabled a custom Forms Security on my Windows 2003 Server w/ SQL Server 2005 Reporting Services. All the functionality I would expect is working properly, except for the ability to deploy to the reports server from inside my Visual Studio 2005 Reports Project.
The 'Reporting Services Login' window opens, prompting me for a username and password. Regardless of what is supplied, the window keeps reappearing, and I am unable to deploy. I am able to upload the files from within the Report Manager, but that is time consuming and inelegant.
Any help would be greatly appreciated!
Anyone? This is pretty peculiar, and it looks like there was a similar issue with SQL Server 2000 and its reporting services. Has any experienced anything like this?|||I too am stuck:
I have setup Forms Authentication on RS2005 and the report manager is working
swell it redirects to a log in page, authenticates against our data
source/ldap server and returns to the report manager with the appropriate
roles/authorizations.
However, I don't know how to deploy the reports/models to the report server. I no longer have a prompt in Visual Studio after we enabled the
forms authenticaiton; keeping in mind with forms authentication you aren't
using windows authorization/active directory. How do I continue to deploy
reports or report models to the report server/manager with forms
authentication. Specific configuration steps would be helpful. Currently we
get an error something to the effect that user '' doesn't have permissions to
the destination. So basically without a prompt window it doesn't seem to know
who I am anymore. How would I login or use/create a cookie to tell it who I
am if I don't have a login prompt inside the Visual Studio 2005?
Thanks!
I finally figured out that the two project types handle the username string differently. For getting the Report Model to deploy correctly, you must specify an authority before the username even if you don't use one in your custom security extension. (i.e. ANYTHING\username or .\username, \username doesn't work). Done so, the username string gets parsed correctly and the deployment works fine.
|||bump.... I'm not even getting a dialog...
|||
Not sure if anyone out there is still struggling with the continual login dialog or not. I was and found out what my problem was. I was trying to deploy to "http:\localhost\reports" instead of http:\localhost\ReportServer"!
ugh!
Anyway, hope this helps someone!
Deploying with custom Forms Security enabled
I have recently enabled a custom Forms Security on my Windows 2003 Server w/ SQL Server 2005 Reporting Services. All the functionality I would expect is working properly, except for the ability to deploy to the reports server from inside my Visual Studio 2005 Reports Project.
The 'Reporting Services Login' window opens, prompting me for a username and password. Regardless of what is supplied, the window keeps reappearing, and I am unable to deploy. I am able to upload the files from within the Report Manager, but that is time consuming and inelegant.
Any help would be greatly appreciated!
Anyone? This is pretty peculiar, and it looks like there was a similar issue with SQL Server 2000 and its reporting services. Has any experienced anything like this?|||I too am stuck:
I have setup Forms Authentication on RS2005 and the report manager is working
swell it redirects to a log in page, authenticates against our data
source/ldap server and returns to the report manager with the appropriate
roles/authorizations.
However, I don't know how to deploy the reports/models to the report server. I no longer have a prompt in Visual Studio after we enabled the
forms authenticaiton; keeping in mind with forms authentication you aren't
using windows authorization/active directory. How do I continue to deploy
reports or report models to the report server/manager with forms
authentication. Specific configuration steps would be helpful. Currently we
get an error something to the effect that user '' doesn't have permissions to
the destination. So basically without a prompt window it doesn't seem to know
who I am anymore. How would I login or use/create a cookie to tell it who I
am if I don't have a login prompt inside the Visual Studio 2005?
Thanks!
I finally figured out that the two project types handle the username string differently. For getting the Report Model to deploy correctly, you must specify an authority before the username even if you don't use one in your custom security extension. (i.e. ANYTHING\username or .\username, \username doesn't work). Done so, the username string gets parsed correctly and the deployment works fine.
|||bump.... I'm not even getting a dialog...
|||
Not sure if anyone out there is still struggling with the continual login dialog or not. I was and found out what my problem was. I was trying to deploy to "http:\localhost\reports" instead of http:\localhost\ReportServer"!
ugh!
Anyway, hope this helps someone!
Deploying with custom Forms Security enabled
I have recently enabled a custom Forms Security on my Windows 2003 Server w/ SQL Server 2005 Reporting Services. All the functionality I would expect is working properly, except for the ability to deploy to the reports server from inside my Visual Studio 2005 Reports Project.
The 'Reporting Services Login' window opens, prompting me for a username and password. Regardless of what is supplied, the window keeps reappearing, and I am unable to deploy. I am able to upload the files from within the Report Manager, but that is time consuming and inelegant.
Any help would be greatly appreciated!
Anyone? This is pretty peculiar, and it looks like there was a similar issue with SQL Server 2000 and its reporting services. Has any experienced anything like this?|||I too am stuck:
I have setup Forms Authentication on RS2005 and the report manager is working
swell it redirects to a log in page, authenticates against our data
source/ldap server and returns to the report manager with the appropriate
roles/authorizations.
However, I don't know how to deploy the reports/models to the report server. I no longer have a prompt in Visual Studio after we enabled the
forms authenticaiton; keeping in mind with forms authentication you aren't
using windows authorization/active directory. How do I continue to deploy
reports or report models to the report server/manager with forms
authentication. Specific configuration steps would be helpful. Currently we
get an error something to the effect that user '' doesn't have permissions to
the destination. So basically without a prompt window it doesn't seem to know
who I am anymore. How would I login or use/create a cookie to tell it who I
am if I don't have a login prompt inside the Visual Studio 2005?
Thanks!
I finally figured out that the two project types handle the username string differently. For getting the Report Model to deploy correctly, you must specify an authority before the username even if you don't use one in your custom security extension. (i.e. ANYTHING\username or .\username, \username doesn't work). Done so, the username string gets parsed correctly and the deployment works fine.|||bump.... I'm not even getting a dialog...|||
Not sure if anyone out there is still struggling with the continual login dialog or not. I was and found out what my problem was. I was trying to deploy to "http:\localhost\reports" instead of http:\localhost\ReportServer"!
ugh!
Anyway, hope this helps someone!
Deploying with custom Forms Security enabled
I have recently enabled a custom Forms Security on my Windows 2003 Server w/ SQL Server 2005 Reporting Services. All the functionality I would expect is working properly, except for the ability to deploy to the reports server from inside my Visual Studio 2005 Reports Project.
The 'Reporting Services Login' window opens, prompting me for a username and password. Regardless of what is supplied, the window keeps reappearing, and I am unable to deploy. I am able to upload the files from within the Report Manager, but that is time consuming and inelegant.
Any help would be greatly appreciated!
Anyone? This is pretty peculiar, and it looks like there was a similar issue with SQL Server 2000 and its reporting services. Has any experienced anything like this?|||I too am stuck:
I have setup Forms Authentication on RS2005 and the report manager is working
swell it redirects to a log in page, authenticates against our data
source/ldap server and returns to the report manager with the appropriate
roles/authorizations.
However, I don't know how to deploy the reports/models to the report server. I no longer have a prompt in Visual Studio after we enabled the
forms authenticaiton; keeping in mind with forms authentication you aren't
using windows authorization/active directory. How do I continue to deploy
reports or report models to the report server/manager with forms
authentication. Specific configuration steps would be helpful. Currently we
get an error something to the effect that user '' doesn't have permissions to
the destination. So basically without a prompt window it doesn't seem to know
who I am anymore. How would I login or use/create a cookie to tell it who I
am if I don't have a login prompt inside the Visual Studio 2005?
Thanks!
I finally figured out that the two project types handle the username string differently. For getting the Report Model to deploy correctly, you must specify an authority before the username even if you don't use one in your custom security extension. (i.e. ANYTHING\username or .\username, \username doesn't work). Done so, the username string gets parsed correctly and the deployment works fine.|||bump.... I'm not even getting a dialog...|||
Not sure if anyone out there is still struggling with the continual login dialog or not. I was and found out what my problem was. I was trying to deploy to "http:\localhost\reports" instead of http:\localhost\ReportServer"!
ugh!
Anyway, hope this helps someone!
Tuesday, February 14, 2012
Denying access to a whole dimension
In AS2K dimension security I could deny access to a whole dimension using the 'Fully Restricted' setting on a role. In AS2005 I can't see how to do the same thing - the only thing I can do is to deny access to every member on every attribute but even then I still see the dimension name in the metadata. BOL suggests it is possible but its descriptions of the UI must have been written before RTM and don't bear much resemblence to the current situation; I've also had a go at setting some of the properties on the permissions object in the XMLA definition of my cube but they don't work either. Is this feature still available? If not, can we have it back?
Chris
Hi Chris.
My recent experience is we had to go "outside" the native role based functionality to achieve the functionality you defined. Our work is probably a demonstration of my ignorance on how to get the same funtionality we had in AS2K expressed in AS2005. When I say go "outside" I mean we used table based security which married the user with the branch of the organization hierarchy they are allowed to see - and ONLY that branch. The user does not see any other members from the organizational hierarchy. I think you're familiar with the solution. If not, let me know and I'll email you the whitepaper.
If Chris is correct - where we can't get the same functionality as we had in AS2K, then I second his suggestion to "have it back."
PGoldy
|||Hello Paul. Have you done this in the old way of dynamic security, by a security fact table or a stored procedure. If there is any new written on this subject I would like to know.
Regards
Thomas Ivarsson
|||Hi Thomas. The security technique was teh "old" way of dynamic security. Nothing new here, except that it works in AS2005. Nothing new written here.
Best Regards,
PGoldy
|||Hi,
Did you try to design a perspective for the role you want to restrict acces ?
Regards
|||Thanks for the feedback, everyone. It does indeed look like a forgotten feature - I'll post it in Connect. Alex - yes, my workaround involves using dimension security to restrict all the members on my dimension then use a perspective to hide the dimension itself.
Chris
|||Thanks Chris and everyone for rasing this issue.
Please go ahead and file the connect case for it.
Edward Melomed.
--
This posting is provided "AS IS" with no warranties, and confers no rights.
I was trying to point the same thing out here:
http://forums.microsoft.com/MSDN/ShowPost.aspx?PostID=785302&SiteID=1
Can I get somehow access to Connect web site (which afaik was closed for new-comming users), I have some other issues as well, which would be nice to handle in next update. I understand that this forum is not intended to collect any errors and that nobody will enter it into Connect programme.
Thanks,
Radim
|||
Hi Radim,
I have no idea whether Connect is closed to new users - it seems a bit strange if it was. It is a bit of a nightmare to navigate through though.
Anyway, I've submitted this issue here:
https://connect.microsoft.com/SQLServer/feedback/ViewFeedback.aspx?FeedbackID=233410
Please vote on it!
Chris
|||Absolutly!
You've had my vote !
Best, Jocke
|||Hi PGoldy,
Can you email me the whitepaper on this? i have the same problem right now on security (how i can restrict the users with the amount of data they can see).
thanks,
cherriesh
|||Hi Cherriesh. Better than a document, here's an on-line link to the information your looking for. The author is Richard Tkachuk who is part of the Analysis Services team at MS - very reliable source. Good luck.
PaulG
http://www.sqlserveranalysisservices.com/OLAPPapers/UsingUserNametoControlDataAccessandDefaultMemberinSSAS.htm
Denying access to a whole dimension
In AS2K dimension security I could deny access to a whole dimension using the 'Fully Restricted' setting on a role. In AS2005 I can't see how to do the same thing - the only thing I can do is to deny access to every member on every attribute but even then I still see the dimension name in the metadata. BOL suggests it is possible but its descriptions of the UI must have been written before RTM and don't bear much resemblence to the current situation; I've also had a go at setting some of the properties on the permissions object in the XMLA definition of my cube but they don't work either. Is this feature still available? If not, can we have it back?
Chris
Hi Chris.
My recent experience is we had to go "outside" the native role based functionality to achieve the functionality you defined. Our work is probably a demonstration of my ignorance on how to get the same funtionality we had in AS2K expressed in AS2005. When I say go "outside" I mean we used table based security which married the user with the branch of the organization hierarchy they are allowed to see - and ONLY that branch. The user does not see any other members from the organizational hierarchy. I think you're familiar with the solution. If not, let me know and I'll email you the whitepaper.
If Chris is correct - where we can't get the same functionality as we had in AS2K, then I second his suggestion to "have it back."
PGoldy
|||Hello Paul. Have you done this in the old way of dynamic security, by a security fact table or a stored procedure. If there is any new written on this subject I would like to know.
Regards
Thomas Ivarsson
|||Hi Thomas. The security technique was teh "old" way of dynamic security. Nothing new here, except that it works in AS2005. Nothing new written here.
Best Regards,
PGoldy
|||Hi,
Did you try to design a perspective for the role you want to restrict acces ?
Regards
|||Thanks for the feedback, everyone. It does indeed look like a forgotten feature - I'll post it in Connect. Alex - yes, my workaround involves using dimension security to restrict all the members on my dimension then use a perspective to hide the dimension itself.
Chris
|||Thanks Chris and everyone for rasing this issue.
Please go ahead and file the connect case for it.
Edward Melomed.
--
This posting is provided "AS IS" with no warranties, and confers no rights.
I was trying to point the same thing out here:
http://forums.microsoft.com/MSDN/ShowPost.aspx?PostID=785302&SiteID=1
Can I get somehow access to Connect web site (which afaik was closed for new-comming users), I have some other issues as well, which would be nice to handle in next update. I understand that this forum is not intended to collect any errors and that nobody will enter it into Connect programme.
Thanks,
Radim|||
Hi Radim,
I have no idea whether Connect is closed to new users - it seems a bit strange if it was. It is a bit of a nightmare to navigate through though.
Anyway, I've submitted this issue here:
https://connect.microsoft.com/SQLServer/feedback/ViewFeedback.aspx?FeedbackID=233410
Please vote on it!
Chris
|||Absolutly!
You've had my vote !
Best, Jocke
|||Hi PGoldy,
Can you email me the whitepaper on this? i have the same problem right now on security (how i can restrict the users with the amount of data they can see).
thanks,
cherriesh
|||Hi Cherriesh. Better than a document, here's an on-line link to the information your looking for. The author is Richard Tkachuk who is part of the Analysis Services team at MS - very reliable source. Good luck.
PaulG
http://www.sqlserveranalysisservices.com/OLAPPapers/UsingUserNametoControlDataAccessandDefaultMemberinSSAS.htm
Denying access to a whole dimension
In AS2K dimension security I could deny access to a whole dimension using the 'Fully Restricted' setting on a role. In AS2005 I can't see how to do the same thing - the only thing I can do is to deny access to every member on every attribute but even then I still see the dimension name in the metadata. BOL suggests it is possible but its descriptions of the UI must have been written before RTM and don't bear much resemblence to the current situation; I've also had a go at setting some of the properties on the permissions object in the XMLA definition of my cube but they don't work either. Is this feature still available? If not, can we have it back?
Chris
Hi Chris.
My recent experience is we had to go "outside" the native role based functionality to achieve the functionality you defined. Our work is probably a demonstration of my ignorance on how to get the same funtionality we had in AS2K expressed in AS2005. When I say go "outside" I mean we used table based security which married the user with the branch of the organization hierarchy they are allowed to see - and ONLY that branch. The user does not see any other members from the organizational hierarchy. I think you're familiar with the solution. If not, let me know and I'll email you the whitepaper.
If Chris is correct - where we can't get the same functionality as we had in AS2K, then I second his suggestion to "have it back."
PGoldy
|||Hello Paul. Have you done this in the old way of dynamic security, by a security fact table or a stored procedure. If there is any new written on this subject I would like to know.
Regards
Thomas Ivarsson
|||Hi Thomas. The security technique was teh "old" way of dynamic security. Nothing new here, except that it works in AS2005. Nothing new written here.
Best Regards,
PGoldy
|||Hi,
Did you try to design a perspective for the role you want to restrict acces ?
Regards
|||Thanks for the feedback, everyone. It does indeed look like a forgotten feature - I'll post it in Connect. Alex - yes, my workaround involves using dimension security to restrict all the members on my dimension then use a perspective to hide the dimension itself.
Chris
|||Thanks Chris and everyone for rasing this issue.
Please go ahead and file the connect case for it.
Edward Melomed.
--
This posting is provided "AS IS" with no warranties, and confers no rights.
I was trying to point the same thing out here:
http://forums.microsoft.com/MSDN/ShowPost.aspx?PostID=785302&SiteID=1
Can I get somehow access to Connect web site (which afaik was closed for new-comming users), I have some other issues as well, which would be nice to handle in next update. I understand that this forum is not intended to collect any errors and that nobody will enter it into Connect programme.
Thanks,
Radim|||
Hi Radim,
I have no idea whether Connect is closed to new users - it seems a bit strange if it was. It is a bit of a nightmare to navigate through though.
Anyway, I've submitted this issue here:
https://connect.microsoft.com/SQLServer/feedback/ViewFeedback.aspx?FeedbackID=233410
Please vote on it!
Chris
|||Absolutly!
You've had my vote !
Best, Jocke
|||Hi PGoldy,
Can you email me the whitepaper on this? i have the same problem right now on security (how i can restrict the users with the amount of data they can see).
thanks,
cherriesh
|||Hi Cherriesh. Better than a document, here's an on-line link to the information your looking for. The author is Richard Tkachuk who is part of the Analysis Services team at MS - very reliable source. Good luck.
PaulG
http://www.sqlserveranalysisservices.com/OLAPPapers/UsingUserNametoControlDataAccessandDefaultMemberinSSAS.htm
Subscribe to:
Posts (Atom)