Create Subscription For Rpt Service with Windows integrated security !!!

hi All,
I m nicky here.
I have problem on Create Subscription for my report if my Data Source is use Windows Integrated Security, with this error message:

"Subscriptions cannot be created because the credentials used to run the report are not stored, or if a linked report , the linked is no longer valid"

Please Help ....

Thank you
From
nicky

For subscriptions to work the data source must either store credentials nor not require them (none option in the UI).

-Lukasz

|||Does this open the report so that anyone can see it?|||Yep, it sure does. A big pain. You could have multiple copies of the one report and change the data source of each report. Then secure the report via user groups. A pain, but if you only had a few users it might be ok. If you have hundreds however......|||

Not sure I understand. When you say multiple copies of a report, you lose me.

I have a report that has stored credentials so that the subscription will work. Unfortunately this also means that anyone can log on to the server and view the report. How do stop everyone from viewing the report?

|||

Hey,

Sorry about the delay in responding, Xmas and project work got in the way!

I mean that you publish the one copy of a report, several times to different folders. You don't use a shared data source, but instead use a data source specificially for each report. Now you edit the connection string of each report based data source to match each specific user. Finially, if it is possible, you have each of these reports in a unique folder that have security defined on it per user.

As I said, not pretty, but a possible solution!

Mark

|||Btw, is this report against an Analysis Service DB?|||

I got my issue fixed. The problem was that anonymous connections were set within IIS and this meant that RS security was rendered useless. Now that this issue is corrected, everything that I have read works correctly. (If not for the rock in the hoof of the lead horse...)

Thanks for all your help!

Create Subscription For Rpt Service with Windows integrated security !!!

hi All,
I m nicky here.
I have problem on Create Subscription for my report if my Data Source is use Windows Integrated Security, with this error message:

"Subscriptions cannot be created because the credentials used to run the report are not stored, or if a linked report , the linked is no longer valid"

Please Help ....

Thank you
From
nicky

For subscriptions to work the data source must either store credentials nor not require them (none option in the UI).

-Lukasz

|||Does this open the report so that anyone can see it?|||Yep, it sure does. A big pain. You could have multiple copies of the one report and change the data source of each report. Then secure the report via user groups. A pain, but if you only had a few users it might be ok. If you have hundreds however......|||

Not sure I understand. When you say multiple copies of a report, you lose me.

I have a report that has stored credentials so that the subscription will work. Unfortunately this also means that anyone can log on to the server and view the report. How do stop everyone from viewing the report?

|||

Hey,

Sorry about the delay in responding, Xmas and project work got in the way!

I mean that you publish the one copy of a report, several times to different folders. You don't use a shared data source, but instead use a data source specificially for each report. Now you edit the connection string of each report based data source to match each specific user. Finially, if it is possible, you have each of these reports in a unique folder that have security defined on it per user.

As I said, not pretty, but a possible solution!

Mark

|||Btw, is this report against an Analysis Service DB?|||

I got my issue fixed. The problem was that anonymous connections were set within IIS and this meant that RS security was rendered useless. Now that this issue is corrected, everything that I have read works correctly. (If not for the rock in the hoof of the lead horse...)

Thanks for all your help!

Create Subscription For Rpt Service with Windows integrated security !!!

hi All,
I m nicky here.
I have problem on Create Subscription for my report if my Data Source is use Windows Integrated Security, with this error message:

"Subscriptions cannot be created because the credentials used to run the report are not stored, or if a linked report , the linked is no longer valid"

Please Help ....

Thank you
From
nicky

For subscriptions to work the data source must either store credentials nor not require them (none option in the UI).

-Lukasz

|||Does this open the report so that anyone can see it?|||Yep, it sure does. A big pain. You could have multiple copies of the one report and change the data source of each report. Then secure the report via user groups. A pain, but if you only had a few users it might be ok. If you have hundreds however......|||

Not sure I understand. When you say multiple copies of a report, you lose me.

I have a report that has stored credentials so that the subscription will work. Unfortunately this also means that anyone can log on to the server and view the report. How do stop everyone from viewing the report?

|||

Hey,

Sorry about the delay in responding, Xmas and project work got in the way!

I mean that you publish the one copy of a report, several times to different folders. You don't use a shared data source, but instead use a data source specificially for each report. Now you edit the connection string of each report based data source to match each specific user. Finially, if it is possible, you have each of these reports in a unique folder that have security defined on it per user.

As I said, not pretty, but a possible solution!

Mark

|||Btw, is this report against an Analysis Service DB?|||

I got my issue fixed. The problem was that anonymous connections were set within IIS and this meant that RS security was rendered useless. Now that this issue is corrected, everything that I have read works correctly. (If not for the rock in the hoof of the lead horse...)

Thanks for all your help!

sql

Create Subscription For Rpt Service with Windows integrated security !!!

hi All,
I m nicky here.
I have problem on Create Subscription for my report if my Data Source is use Windows Integrated Security, with this error message:

"Subscriptions cannot be created because the credentials used to run the report are not stored, or if a linked report , the linked is no longer valid"

Please Help ....

Thank you
From
nicky

For subscriptions to work the data source must either store credentials nor not require them (none option in the UI).

-Lukasz

|||Does this open the report so that anyone can see it?|||Yep, it sure does. A big pain. You could have multiple copies of the one report and change the data source of each report. Then secure the report via user groups. A pain, but if you only had a few users it might be ok. If you have hundreds however......|||

Not sure I understand. When you say multiple copies of a report, you lose me.

I have a report that has stored credentials so that the subscription will work. Unfortunately this also means that anyone can log on to the server and view the report. How do stop everyone from viewing the report?

|||

Hey,

Sorry about the delay in responding, Xmas and project work got in the way!

I mean that you publish the one copy of a report, several times to different folders. You don't use a shared data source, but instead use a data source specificially for each report. Now you edit the connection string of each report based data source to match each specific user. Finially, if it is possible, you have each of these reports in a unique folder that have security defined on it per user.

As I said, not pretty, but a possible solution!

Mark

|||Btw, is this report against an Analysis Service DB?|||

I got my issue fixed. The problem was that anonymous connections were set within IIS and this meant that RS security was rendered useless. Now that this issue is corrected, everything that I have read works correctly. (If not for the rock in the hoof of the lead horse...)

Thanks for all your help!

Create permission

Is there such granularity in SQL 2K security that might allow a user to
create a temp table (as in a stored proc) but restrict them from creating a
permanent user table?
Message posted via http://www.sqlmonster.com
All users can create temp tables by default.
HTH
Jasper Smith (SQL Server MVP)
http://www.sqldbatips.com
I support PASS - the definitive, global
community for SQL Server professionals -
http://www.sqlpass.org
"Robert Richards via SQLMonster.com" <forum@.SQLMonster.com> wrote in message
news:4b1a04ce369e4b069715c04b3466fdf2@.SQLMonster.c om...
> Is there such granularity in SQL 2K security that might allow a user to
> create a temp table (as in a stored proc) but restrict them from creating
> a
> permanent user table?
> --
> Message posted via http://www.sqlmonster.com

Create permission

Is there such granularity in SQL 2K security that might allow a user to
create a temp table (as in a stored proc) but restrict them from creating a
permanent user table?
Message posted via http://www.droptable.comAll users can create temp tables by default.
HTH
Jasper Smith (SQL Server MVP)
http://www.sqldbatips.com
I support PASS - the definitive, global
community for SQL Server professionals -
http://www.sqlpass.org
"Robert Richards via droptable.com" <forum@.droptable.com> wrote in message
news:4b1a04ce369e4b069715c04b3466fdf2@.SQ
droptable.com...
> Is there such granularity in SQL 2K security that might allow a user to
> create a temp table (as in a stored proc) but restrict them from creating
> a
> permanent user table?
> --
> Message posted via http://www.droptable.com

Create permission

Is there such granularity in SQL 2K security that might allow a user to
create a temp table (as in a stored proc) but restrict them from creating a
permanent user table?
--
Message posted via http://www.sqlmonster.comAll users can create temp tables by default.
--
HTH
Jasper Smith (SQL Server MVP)
http://www.sqldbatips.com
I support PASS - the definitive, global
community for SQL Server professionals -
http://www.sqlpass.org
"Robert Richards via SQLMonster.com" <forum@.SQLMonster.com> wrote in message
news:4b1a04ce369e4b069715c04b3466fdf2@.SQLMonster.com...
> Is there such granularity in SQL 2K security that might allow a user to
> create a temp table (as in a stored proc) but restrict them from creating
> a
> permanent user table?
> --
> Message posted via http://www.sqlmonster.com

CREATE GLOBAL CUBE in dataset MDX query.

Hello,
I am attempting to use a CREATE GLOBAL CUBE command when defining a data set in MSRS. The intent is to use the MSRS security and scheduling capabilities to dump local cube files from our data warehouse to a file share, then use MSRS's delivery mechanisms to deliver the cubes to the intended recipient(s). The problem (I believe) is that the command does not return any data, so when rendering the report I bound the dataset to, the server just stops responding. I assume it is waiting for data that will never come. The report itself only contains a text box with a string literal. The good news is that when I try to render the report, the local cube file is generated...I just need the server to finish rendering the "dummy" report. Any ideas? Thanks.
-Rob HoffmanRob, did you look at DTS as an alternative solution?
Reporting Services isn't really meant to be used in the way you're trying to
use it. One area of concern is that you mention the server stops
responding. It it only this particular report that doesn't get rendered, or
does the server stop responding to any request?
-Lukasz
--
This posting is provided "AS IS" with no warranties, and confers no rights.
"Rob Hoffman" <Rob Hoffman@.discussions.microsoft.com> wrote in message
news:6E2F8425-C095-4F36-9A40-C1CD6ADD73DD@.microsoft.com...
> Hello,
> I am attempting to use a CREATE GLOBAL CUBE command when defining a data
> set in MSRS. The intent is to use the MSRS security and scheduling
> capabilities to dump local cube files from our data warehouse to a file
> share, then use MSRS's delivery mechanisms to deliver the cubes to the
> intended recipient(s). The problem (I believe) is that the command does
> not return any data, so when rendering the report I bound the dataset to,
> the server just stops responding. I assume it is waiting for data that
> will never come. The report itself only contains a text box with a string
> literal. The good news is that when I try to render the report, the local
> cube file is generated...I just need the server to finish rendering the
> "dummy" report. Any ideas? Thanks.
> -Rob Hoffman|||Lukasz,
Yes, but RS looked like a better choice out of the box because of its built-in security model, job scheduling, delivery mechanisms and extensibility. The requirements of the project I'm working on make it an expedient alternative to writing code that allows users to define, schedule and deliver local OLAP cubes from our data warehouse source.
To answer your question, when I view (view tab) my dummy report in Report Manager, the report never renders, and my aspnet_wp process consumes all processing power on the server. When I open a second browser window and try to access Report Manager, the page never loads. It looks like there is some sort of infinite loop occurring. I have never observed a timeout, but I have waited several minutes for the process to complete. I ended up having to close the first browser window (stop rendering the dummy report) to get RS to return to normal operation. When I do that, the second browser window finishes rendering my Report Manager screen almost immediately. I'd appreciate any help you or anyone else can provide in resolving this.
-Rob
"Lukasz Pawlowski [MSFT]" wrote:
> Rob, did you look at DTS as an alternative solution?
> Reporting Services isn't really meant to be used in the way you're trying to
> use it. One area of concern is that you mention the server stops
> responding. It it only this particular report that doesn't get rendered, or
> does the server stop responding to any request?
> -Lukasz
> --
> This posting is provided "AS IS" with no warranties, and confers no rights.
>
> "Rob Hoffman" <Rob Hoffman@.discussions.microsoft.com> wrote in message
> news:6E2F8425-C095-4F36-9A40-C1CD6ADD73DD@.microsoft.com...
> > Hello,
> >
> > I am attempting to use a CREATE GLOBAL CUBE command when defining a data
> > set in MSRS. The intent is to use the MSRS security and scheduling
> > capabilities to dump local cube files from our data warehouse to a file
> > share, then use MSRS's delivery mechanisms to deliver the cubes to the
> > intended recipient(s). The problem (I believe) is that the command does
> > not return any data, so when rendering the report I bound the dataset to,
> > the server just stops responding. I assume it is waiting for data that
> > will never come. The report itself only contains a text box with a string
> > literal. The good news is that when I try to render the report, the local
> > cube file is generated...I just need the server to finish rendering the
> > "dummy" report. Any ideas? Thanks.
> >
> > -Rob Hoffman
>
>

CREATE Credential Secret Storage

I am hoping to use SQL Server Agent 2k5 to run jobs in the security context of another account. I have successfully done this, so I know it works.

My question is: what mechanism does SQL 2k5 use to encrypt the secret that I enter when setting up the credentials for the job account using the CREATE CREDENTIAL statement? Is the secret protected using DPAPI? If so, what precautions must I take if I when managing the SQL Server Agent service account?

Many thanks, Kevin

The secret part of the credential is encrypted by the service master key (SMK). The SMK itself is protected by DPAPI using the SQL Server service account credentials. Changing the Agent service account shouldn't have any impact on the credentials, but changing the SQL Server service account will have an impact. If you change the service account manually, you will end up with a SMK that cannot be decrypted (in newer SQL Server builds we are mitigating this problem to some extent). My strong advice is to always have available an up-to-date backup of the SMK. This way, you can always restore the SMK if it becomes undecryptable. Losing the SMK is equivalent with losing all your encrypted data, so you should be extra careful about keeping backups of the SMK.

As a side note, SMK backups store the SMK encrypted with a password using 3DES and on Windows 2003 we enforce the password policy strength settings as we do for SQL Server logins.

For some additional information on the SMK, you can also look at the following:

http://blogs.msdn.com/lcris/archive/2005/07/08/437048.aspx

Thanks
Laurentiu

|||The credential secret is protected by service master key (see CREATE CREDENTIAL in BOL for details) which is in turm protected by DPAPI.

However encrypted credential secred as well as encrypted service master key is persisted in master database. Thus anybody who runs under the same windows account as SQLServer (i.e. NETWORK SERVICE by default) have an access to it. There is no published or unpublished interface to read these secrets, but this data can be eventually obtained from master.mdf file or even by implementing xp on a live server.

In short your job account credentials are protected by one or more ACLs granted to account under which SQLServer runs. It will be a good practice to run SQLServer under a unique account, so that no other machine task or service is using it. In that case only NT box admin has access to it. But this is normal, since any secret on local machine is available to NTBox admin.