Accessing SQL Server Reports Express Edition Remotely

cousin_borat

SQL Server Reporting Services Express edition
Running on W2K3 Server
Reports running on port 80
Works fine locally


I had a question about accessing the report externally.

What I have done so far:

I have migrated the reports to another server located at 216.121.X.Y

The reports work fine internally on the server http://localhost/reportserver


The reports works fine externally i.e. http://216.121.X.Y/reportserver when I use the Windows Administrator account (administrator). I’m running the reports on port 80.

I would prefer not to have to give out the administrator password to my server for 3rd parties to inspect the report.

I created a local user on the reports server box USERABC. The local user is part of the windows user and guest groups. I have given the user account write access to the
C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Temporary ASP.NET Files.

I get the following error when I try to run the report remotely using this USERABC account.

The permissions granted to user 'IMAGE\USERABC are insufficient for performing this operation. (rsAccessDenied) Get Online Help

When I add user USERABC to the administrators group it works fine.

I tried enabling Anonymouse access through IIS on the Report Server virtual directories. When I try to access I get the same error but this time for the IIS user.
IUSR_IMAGE
The permissions granted to user 'IMAGE\IUSR_IMAGE' are insufficient for performing this operation. (rsAccessDenied) Get Online Help

I don't really see anything specific looking online nor on technet.
Any help appreciated

cousin_borat

I just found this on Technet. Looks like I need to do some additional work.
Taken from
http://technet.microsoft.com/en-us/library/bb283249.aspx

Configuring Authentication for Extranet and Internet Access
Integrated Windows authentication is seldom practical for deployment models that require Internet or extranet access. If you are deploying Reporting Services on an Internet-facing Web server, you should replace Windows authentication with a custom authentication extension that gives you more control over how external users are granted access to the report server. Creating a custom authentication extension requires custom code and expertise in ASP.NET security. For more information, see Implementing a Security Extension.

If you do not want to code a custom authentication extension, you can use Microsoft Active Directory groups and accounts, but you should greatly reduce the scope of a report server deployment. The following guidelines describe how to support this scenario:

Create a low-privileged domain user account with read-only permissions. The account must have access to the computer hosting the report server. Provide a custom Web form so that users can log on using the low-privileged domain account.

Create role assignments that map the user account to specific items in the report server folder hierarchy. You can limit access to read-only operations by choosing as the role assignment the Browser predefined role.

Configure reports to use stored credentials to get data for the report. This approach is useful if you want to query the external data source using an account that is different from the account that allows access to the report server. For more information about these options, see Specifying Credential and Connection Information.

Beano

Created the local account did you add them in to the site-wide security settings on reporting services? Go to http://localhost/reports Click on the Properties Tab. Create a new role assignment for the user you created and assign them the Browser role.

You CAN do all the stuff you posted above but if you're only doing this on a small scale (and the fact you are using the express edition suggests you are) then its probably overkill.

cousin_borat

Thanks Beano, spot on. I guess I'm still getting used to SSRS. I must say I'm impressed with the express edition. It has most everything except SQL Server Integration Services but can use Stored Procedures to do Migration and Transform to the Data Warehouse instead of SSIS.