Manage Individual Subscriptions task problem, cannot edit email address

Hi,

The Browser role has the task Manage Individual Subscriptions. Fine, the user can create a subscription. The problem is that the reportserver populate the email address text box with the Windows User ID and does not let the user change this to put his email address instead. The text box is greyed out.

I found that to enable the text box I have to add the task Manage all subscriptions to the role "Browser".

This is a major security problem because with this setting any user can edit any subscription.

I suspect that I could work at the Active Directory level to populate a field that would in turn populate the email address with the correct data., however this is not an option for me. I have absolutely no way to do it or get it done. Does anybody has an idea on how I could allow a user to edit his email address in his subscriptions and not let him tamper with other users subscriptions?

Thanks

Philippe

Actually, you don't need to grant the Manage All Subscriptions task to the user. There is a setting called SendEmailToUserAlias in the rsreportserver.config file that you can modify to allow users to type in an email address/list of addresses. Defaul it set to True, you can set it to False to enable this field for your users.

Also, there are a couple of other settings you might want to set at that time. The DefaultHostName element determines what host is appended if only an alias is supplied. If none is specified, the mail server determines that setting (if it's an Exchange server it resolves to known mail boxes). The other one that's useful is PermittedHosts. It limits to which hosts users can send e-mails. For example, at Microsoft, we might only include microsoft.com in the list. That way reports are not sent to hotmail addresses.

-Lukasz

See below for the Email Delivery extension element.

<RSEmailDPConfiguration>
<SMTPServer></SMTPServer>
<SMTPServerPort></SMTPServerPort>
<SMTPAccountName></SMTPAccountName>
<SMTPConnectionTimeout></SMTPConnectionTimeout>
<SMTPServerPickupDirectory></SMTPServerPickupDirectory>
<SMTPUseSSL></SMTPUseSSL>
<SendUsing>2</SendUsing>
<SMTPAuthenticate></SMTPAuthenticate>
<From></From>
<EmbeddedRenderFormats>
<RenderingExtension>MHTML</RenderingExtension>
</EmbeddedRenderFormats>
<PrivilegedUserRenderFormats></PrivilegedUserRenderFormats>
<ExcludedRenderFormats>
<RenderingExtension>HTMLOWC</RenderingExtension>
<RenderingExtension>NULL</RenderingExtension>
<RenderingExtension>RGDI</RenderingExtension>
</ExcludedRenderFormats>
<SendEmailToUserAlias>True</SendEmailToUserAlias>
<DefaultHostName></DefaultHostName>
<PermittedHosts></PermittedHosts>
</RSEmailDPConfiguration>

This posting is provided "AS IS" with no warranties, and confers no rights.

|||

I followed the directions above in a current release of SSRS and it does NOT work. The only way I could get the user permission to set their own email address was to grant the Manage All Subscriptions task to the user.

I'm still testing the other two settings mentioned above.

Definitely kind of screwy when you grant the Manage Individual Subscriptions task to the user that they are unable to change the email address. And our AD situation does not allow creating email addresses corresponding to the user ID. I wonder if MS expects it to work based on Exchange integrated with AD.

Manage Individual Subscriptions task problem, cannot edit email address

Hi,

The Browser role has the task Manage Individual Subscriptions. Fine, the user can create a subscription. The problem is that the reportserver populate the email address text box with the Windows User ID and does not let the user change this to put his email address instead. The text box is greyed out.

I found that to enable the text box I have to add the task Manage all subscriptions to the role "Browser".

This is a major security problem because with this setting any user can edit any subscription.

I suspect that I could work at the Active Directory level to populate a field that would in turn populate the email address with the correct data., however this is not an option for me. I have absolutely no way to do it or get it done. Does anybody has an idea on how I could allow a user to edit his email address in his subscriptions and not let him tamper with other users subscriptions?

Thanks

Philippe

Actually, you don't need to grant the Manage All Subscriptions task to the user. There is a setting called SendEmailToUserAlias in the rsreportserver.config file that you can modify to allow users to type in an email address/list of addresses. Defaul it set to True, you can set it to False to enable this field for your users.

Also, there are a couple of other settings you might want to set at that time. The DefaultHostName element determines what host is appended if only an alias is supplied. If none is specified, the mail server determines that setting (if it's an Exchange server it resolves to known mail boxes). The other one that's useful is PermittedHosts. It limits to which hosts users can send e-mails. For example, at Microsoft, we might only include microsoft.com in the list. That way reports are not sent to hotmail addresses.

-Lukasz

See below for the Email Delivery extension element.

<RSEmailDPConfiguration>
<SMTPServer></SMTPServer>
<SMTPServerPort></SMTPServerPort>
<SMTPAccountName></SMTPAccountName>
<SMTPConnectionTimeout></SMTPConnectionTimeout>
<SMTPServerPickupDirectory></SMTPServerPickupDirectory>
<SMTPUseSSL></SMTPUseSSL>
<SendUsing>2</SendUsing>
<SMTPAuthenticate></SMTPAuthenticate>
<From></From>
<EmbeddedRenderFormats>
<RenderingExtension>MHTML</RenderingExtension>
</EmbeddedRenderFormats>
<PrivilegedUserRenderFormats></PrivilegedUserRenderFormats>
<ExcludedRenderFormats>
<RenderingExtension>HTMLOWC</RenderingExtension>
<RenderingExtension>NULL</RenderingExtension>
<RenderingExtension>RGDI</RenderingExtension>
</ExcludedRenderFormats>
<SendEmailToUserAlias>True</SendEmailToUserAlias>
<DefaultHostName></DefaultHostName>
<PermittedHosts></PermittedHosts>
</RSEmailDPConfiguration>

This posting is provided "AS IS" with no warranties, and confers no rights.

|||

I followed the directions above in a current release of SSRS and it does NOT work. The only way I could get the user permission to set their own email address was to grant the Manage All Subscriptions task to the user.

I'm still testing the other two settings mentioned above.

Definitely kind of screwy when you grant the Manage Individual Subscriptions task to the user that they are unable to change the email address. And our AD situation does not allow creating email addresses corresponding to the user ID. I wonder if MS expects it to work based on Exchange integrated with AD.

Making changes to the reportserver database

Is it ok to make changes directly to the ReportServer database - adding
tables and stored procedures? Will admendments I make affect upgrades in the
future?My feeling is that you do this at your own risk. Going directly at the
reportserver database is not supported. You should use the web services. If
you want some of you own tables and stored procedures I would suggest
creating another database, even if you are going against reportserver
database.
I would guess that you could do it as long as your naming convention is such
that MS wouldn't be likely to name something similar. But if you put them in
your own database then your are guaranteed to be safe.
--
Bruce Loehle-Conger
MVP SQL Server Reporting Services
"Si Downes" <SiDownes@.discussions.microsoft.com> wrote in message
news:093F8E5E-948B-40BE-A4BE-14AB46A080EF@.microsoft.com...
> Is it ok to make changes directly to the ReportServer database - adding
> tables and stored procedures? Will admendments I make affect upgrades in
the
> future?

Make the Login box go away!

I'm trying to incorporate the /ReportServer virtual into our application web
site so we can point the Report Viewer control to /ReportServer rather than
<default web site's IP>/ReportServer. I'm trying to remove authentication
from <app>/ReportServer, but I've been unable to keep it from popping up
that blasted login dialog box. I've briefly tried using the FormsAuth
sample and even rewrote it to always return True from all the authentication
functions, but neither solved my problem.
The application is under Forms Auth. I just want the ReportServer virtual
to run in that context. At this point, I don't even care if it's really
keeping authentication or just letting anyone who happens to type in
http://<our_app>/ReportServer go uncontested. It's extremely frustrating,
and it doesn't work for any users as it is now.
This is SQL Server Standard, so I don't know if custom security extensions
(assuming I really had any clue as to how they worked or how to set them up)
would even work (I came across a page that says only Enterprise supports
them).To my knowledge, for IE to give your windows authentication credentials
automatically to IIS, you have to adresse the website using a machine name.
Use something like http://computername/ReportServer
Suppose your server is named BigBox.leetdomain.com
Address it using http://BigBox/ReportServer
I never had to mess around with the report server security as we want
windows authentication and the report server will not be used externally. It
seems to be configured fine by default.
"DJM" wrote:
> I'm trying to incorporate the /ReportServer virtual into our application web
> site so we can point the Report Viewer control to /ReportServer rather than
> <default web site's IP>/ReportServer. I'm trying to remove authentication
> from <app>/ReportServer, but I've been unable to keep it from popping up
> that blasted login dialog box. I've briefly tried using the FormsAuth
> sample and even rewrote it to always return True from all the authentication
> functions, but neither solved my problem.
> The application is under Forms Auth. I just want the ReportServer virtual
> to run in that context. At this point, I don't even care if it's really
> keeping authentication or just letting anyone who happens to type in
> http://<our_app>/ReportServer go uncontested. It's extremely frustrating,
> and it doesn't work for any users as it is now.
> This is SQL Server Standard, so I don't know if custom security extensions
> (assuming I really had any clue as to how they worked or how to set them up)
> would even work (I came across a page that says only Enterprise supports
> them).
>
>|||The Forms Authentication sample from MSDN gives you instructions on how to
restore to default non-forms-authentication settings.
Basically, it's not recommended since you'll have to re-do your report
permissions. And if you don't have the original .config files backed up,
you'll have a VERY difficult time.
--
'(' Jeff A. Stucker
\
Business Intelligence
www.criadvantage.com
---
"DJM" <msnews@.puddlestheshark.com> wrote in message
news:e6Cz03NzEHA.2600@.TK2MSFTNGP09.phx.gbl...
> I'm trying to incorporate the /ReportServer virtual into our application
> web
> site so we can point the Report Viewer control to /ReportServer rather
> than
> <default web site's IP>/ReportServer. I'm trying to remove authentication
> from <app>/ReportServer, but I've been unable to keep it from popping up
> that blasted login dialog box. I've briefly tried using the FormsAuth
> sample and even rewrote it to always return True from all the
> authentication
> functions, but neither solved my problem.
> The application is under Forms Auth. I just want the ReportServer virtual
> to run in that context. At this point, I don't even care if it's really
> keeping authentication or just letting anyone who happens to type in
> http://<our_app>/ReportServer go uncontested. It's extremely frustrating,
> and it doesn't work for any users as it is now.
> This is SQL Server Standard, so I don't know if custom security extensions
> (assuming I really had any clue as to how they worked or how to set them
> up)
> would even work (I came across a page that says only Enterprise supports
> them).
>
>|||But the standard is Windows Authentication. I still get the
username/password dialog when trying to access a report via report viewer
control from my website.
"Jeff A. Stucker" <jeff@.mobilize.net> wrote in message
news:O$FUn9OzEHA.3708@.TK2MSFTNGP14.phx.gbl...
> The Forms Authentication sample from MSDN gives you instructions on how to
> restore to default non-forms-authentication settings.
> Basically, it's not recommended since you'll have to re-do your report
> permissions. And if you don't have the original .config files backed up,
> you'll have a VERY difficult time.
> --
> '(' Jeff A. Stucker
> \
> Business Intelligence
> www.criadvantage.com
> ---
> "DJM" <msnews@.puddlestheshark.com> wrote in message
> news:e6Cz03NzEHA.2600@.TK2MSFTNGP09.phx.gbl...
>> I'm trying to incorporate the /ReportServer virtual into our application
>> web
>> site so we can point the Report Viewer control to /ReportServer rather
>> than
>> <default web site's IP>/ReportServer. I'm trying to remove
>> authentication
>> from <app>/ReportServer, but I've been unable to keep it from popping up
>> that blasted login dialog box. I've briefly tried using the FormsAuth
>> sample and even rewrote it to always return True from all the
>> authentication
>> functions, but neither solved my problem.
>> The application is under Forms Auth. I just want the ReportServer
>> virtual
>> to run in that context. At this point, I don't even care if it's really
>> keeping authentication or just letting anyone who happens to type in
>> http://<our_app>/ReportServer go uncontested. It's extremely
>> frustrating,
>> and it doesn't work for any users as it is now.
>> This is SQL Server Standard, so I don't know if custom security
>> extensions
>> (assuming I really had any clue as to how they worked or how to set them
>> up)
>> would even work (I came across a page that says only Enterprise supports
>> them).
>>
>|||And since the report server *is* being accessed externally, it's quite
definitely not fine for our needs.
"/dev/null" <devnull@.discussions.microsoft.com> wrote in message
news:2BD4677A-BEF2-4048-92B9-316F38813E85@.microsoft.com...
> To my knowledge, for IE to give your windows authentication credentials
> automatically to IIS, you have to adresse the website using a machine
> name.
> Use something like http://computername/ReportServer
> Suppose your server is named BigBox.leetdomain.com
> Address it using http://BigBox/ReportServer
> I never had to mess around with the report server security as we want
> windows authentication and the report server will not be used externally.
> It
> seems to be configured fine by default.
>
> "DJM" wrote:
>> I'm trying to incorporate the /ReportServer virtual into our application
>> web
>> site so we can point the Report Viewer control to /ReportServer rather
>> than
>> <default web site's IP>/ReportServer. I'm trying to remove
>> authentication
>> from <app>/ReportServer, but I've been unable to keep it from popping up
>> that blasted login dialog box. I've briefly tried using the FormsAuth
>> sample and even rewrote it to always return True from all the
>> authentication
>> functions, but neither solved my problem.
>> The application is under Forms Auth. I just want the ReportServer
>> virtual
>> to run in that context. At this point, I don't even care if it's really
>> keeping authentication or just letting anyone who happens to type in
>> http://<our_app>/ReportServer go uncontested. It's extremely
>> frustrating,
>> and it doesn't work for any users as it is now.
>> This is SQL Server Standard, so I don't know if custom security
>> extensions
>> (assuming I really had any clue as to how they worked or how to set them
>> up)
>> would even work (I came across a page that says only Enterprise supports
>> them).
>>
>>|||Ok, I've set Authentication mode="None", I've set the /ReportServer virtual
to allow Anonymous access as IUSR, I've granted IUSR_GROUP (local group
containing the IUSR, IWAM, and ASP.NET users) access to the \MSSQL\Reporting
Services\ReportServer folder (and files and subfolders), and I've granted
the IUSR_GROUP the Browser role to all reports.
So why, when using the Report Viewer web control, do I see a login box?!?|||Does anyone have any advice or suggestions here? I still haven't resolved
this.
"DJM" <msnews@.puddlestheshark.com> wrote in message
news:uLeyyLnzEHA.352@.TK2MSFTNGP14.phx.gbl...
> Ok, I've set Authentication mode="None", I've set the /ReportServer
> virtual to allow Anonymous access as IUSR, I've granted IUSR_GROUP (local
> group containing the IUSR, IWAM, and ASP.NET users) access to the
> \MSSQL\Reporting Services\ReportServer folder (and files and subfolders),
> and I've granted the IUSR_GROUP the Browser role to all reports.
> So why, when using the Report Viewer web control, do I see a login box?!?
>|||You have two options:
1. Generating the report on the server side of the application by using the
Render SOAP API. The advantage of this approach is that it is more secure
since the user doesn't see the report URL (everything takes place on the
server). The tradeoff is that the interactive features (drilldown,
drillthrough, etc.) will not work with SOAP since their require direct
access to the Report Server by URL. If you decide to take this approach, you
can pass the web app identity to the Report Server and grant a minimum set
of permissions in RS to this account.
2. Replace the RS Windows security with Forms Authentication by writing a
custom security extension. This will allow you to incorporate interactive
features in your reports. In this scenario, the reports will be requested on
the client side of the application (e.g. by using the Report Viewer sample
control). If you decide to take this approach check out the sample security
extension from MS at
(http://msdn.microsoft.com/library/?url=/library/en-us/dnsql2k/html/ufairs.a
sp?frame=true#ufairs_topic3).
So, you have to carefully weight out your requirements for security,
reporting features and your application architecture to determine the best
integration scenario.
--
Hope this helps.
Rags Iyer
"DJM" wrote:
> I'm trying to incorporate the /ReportServer virtual into our application web
> site so we can point the Report Viewer control to /ReportServer rather than
> <default web site's IP>/ReportServer. I'm trying to remove authentication
> from <app>/ReportServer, but I've been unable to keep it from popping up
> that blasted login dialog box. I've briefly tried using the FormsAuth
> sample and even rewrote it to always return True from all the authentication
> functions, but neither solved my problem.
> The application is under Forms Auth. I just want the ReportServer virtual
> to run in that context. At this point, I don't even care if it's really
> keeping authentication or just letting anyone who happens to type in
> http://<our_app>/ReportServer go uncontested. It's extremely frustrating,
> and it doesn't work for any users as it is now.
> This is SQL Server Standard, so I don't know if custom security extensions
> (assuming I really had any clue as to how they worked or how to set them up)
> would even work (I came across a page that says only Enterprise supports
> them).
>
>|||The second option would be ideal, but if you'll notice, I tried that and was
unable to get it to make a shred of difference. Maybe I'm just not smart
enough to figure it out, but it's not working for me.
"Rags Iyer" <RagsIyer@.discussions.microsoft.com> wrote in message
news:A2AD6EB1-4CE8-4305-8063-8EE6AC9E1828@.microsoft.com...
> You have two options:
> 1. Generating the report on the server side of the application by using
> the
> Render SOAP API. The advantage of this approach is that it is more secure
> since the user doesn't see the report URL (everything takes place on the
> server). The tradeoff is that the interactive features (drilldown,
> drillthrough, etc.) will not work with SOAP since their require direct
> access to the Report Server by URL. If you decide to take this approach,
> you
> can pass the web app identity to the Report Server and grant a minimum set
> of permissions in RS to this account.
> 2. Replace the RS Windows security with Forms Authentication by writing a
> custom security extension. This will allow you to incorporate interactive
> features in your reports. In this scenario, the reports will be requested
> on
> the client side of the application (e.g. by using the Report Viewer sample
> control). If you decide to take this approach check out the sample
> security
> extension from MS at
> (http://msdn.microsoft.com/library/?url=/library/en-us/dnsql2k/html/ufairs.a
> sp?frame=true#ufairs_topic3).
> So, you have to carefully weight out your requirements for security,
> reporting features and your application architecture to determine the best
> integration scenario.
> --
> Hope this helps.
> Rags Iyer
> "DJM" wrote:
>> I'm trying to incorporate the /ReportServer virtual into our application
>> web
>> site so we can point the Report Viewer control to /ReportServer rather
>> than
>> <default web site's IP>/ReportServer. I'm trying to remove
>> authentication
>> from <app>/ReportServer, but I've been unable to keep it from popping up
>> that blasted login dialog box. I've briefly tried using the FormsAuth
>> sample and even rewrote it to always return True from all the
>> authentication
>> functions, but neither solved my problem.
>> The application is under Forms Auth. I just want the ReportServer
>> virtual
>> to run in that context. At this point, I don't even care if it's really
>> keeping authentication or just letting anyone who happens to type in
>> http://<our_app>/ReportServer go uncontested. It's extremely
>> frustrating,
>> and it doesn't work for any users as it is now.
>> This is SQL Server Standard, so I don't know if custom security
>> extensions
>> (assuming I really had any clue as to how they worked or how to set them
>> up)
>> would even work (I came across a page that says only Enterprise supports
>> them).
>>
>>|||Is the Login Box still popping up when Forms Authetication is Implemented.?
"DJM" wrote:
> The second option would be ideal, but if you'll notice, I tried that and was
> unable to get it to make a shred of difference. Maybe I'm just not smart
> enough to figure it out, but it's not working for me.
> "Rags Iyer" <RagsIyer@.discussions.microsoft.com> wrote in message
> news:A2AD6EB1-4CE8-4305-8063-8EE6AC9E1828@.microsoft.com...
> > You have two options:
> >
> > 1. Generating the report on the server side of the application by using
> > the
> > Render SOAP API. The advantage of this approach is that it is more secure
> > since the user doesn't see the report URL (everything takes place on the
> > server). The tradeoff is that the interactive features (drilldown,
> > drillthrough, etc.) will not work with SOAP since their require direct
> > access to the Report Server by URL. If you decide to take this approach,
> > you
> > can pass the web app identity to the Report Server and grant a minimum set
> > of permissions in RS to this account.
> >
> > 2. Replace the RS Windows security with Forms Authentication by writing a
> > custom security extension. This will allow you to incorporate interactive
> > features in your reports. In this scenario, the reports will be requested
> > on
> > the client side of the application (e.g. by using the Report Viewer sample
> > control). If you decide to take this approach check out the sample
> > security
> > extension from MS at
> > (http://msdn.microsoft.com/library/?url=/library/en-us/dnsql2k/html/ufairs.a
> > sp?frame=true#ufairs_topic3).
> >
> > So, you have to carefully weight out your requirements for security,
> > reporting features and your application architecture to determine the best
> > integration scenario.
> > --
> > Hope this helps.
> >
> > Rags Iyer
> >
> > "DJM" wrote:
> >
> >> I'm trying to incorporate the /ReportServer virtual into our application
> >> web
> >> site so we can point the Report Viewer control to /ReportServer rather
> >> than
> >> <default web site's IP>/ReportServer. I'm trying to remove
> >> authentication
> >> from <app>/ReportServer, but I've been unable to keep it from popping up
> >> that blasted login dialog box. I've briefly tried using the FormsAuth
> >> sample and even rewrote it to always return True from all the
> >> authentication
> >> functions, but neither solved my problem.
> >>
> >> The application is under Forms Auth. I just want the ReportServer
> >> virtual
> >> to run in that context. At this point, I don't even care if it's really
> >> keeping authentication or just letting anyone who happens to type in
> >> http://<our_app>/ReportServer go uncontested. It's extremely
> >> frustrating,
> >> and it doesn't work for any users as it is now.
> >>
> >> This is SQL Server Standard, so I don't know if custom security
> >> extensions
> >> (assuming I really had any clue as to how they worked or how to set them
> >> up)
> >> would even work (I came across a page that says only Enterprise supports
> >> them).
> >>
> >>
> >>
> >>
>
>|||Yes.
"Rags Iyer" <RagsIyer@.discussions.microsoft.com> wrote in message
news:C574F74E-C580-47A4-86AD-BCD62253C700@.microsoft.com...
> Is the Login Box still popping up when Forms Authetication is
> Implemented.?|||Please check wherther the Security implemenation for Forms Authetication was
properly implemented.The authetication in the Rs Config File needs to be
changed to Forms Authentication and all the required policy is set.
Regards,
Rags Iyer
"DJM" wrote:
> Yes.
> "Rags Iyer" <RagsIyer@.discussions.microsoft.com> wrote in message
> news:C574F74E-C580-47A4-86AD-BCD62253C700@.microsoft.com...
> >
> > Is the Login Box still popping up when Forms Authetication is
> > Implemented.?
>
>|||Please check wherther the Security implemenation for Forms Authetication was
properly implemented.The authetication in the Rs Config File needs to be
changed to Forms Authentication and all the required policy is set.
Regards,
Rags Iyer
"DJM" wrote:
> Yes.
> "Rags Iyer" <RagsIyer@.discussions.microsoft.com> wrote in message
> news:C574F74E-C580-47A4-86AD-BCD62253C700@.microsoft.com...
> >
> > Is the Login Box still popping up when Forms Authetication is
> > Implemented.?
>
>|||I did that according to the documentation (adding Forms to the
authentication types or wherever that is, and changing authentication mode
to Forms in the web.config), and I was still getting the login box.
What gets me is that box is still appearing even when I set the
authentication mode to None.
"Rags Iyer" <RagsIyer@.discussions.microsoft.com> wrote in message
news:E5169863-A011-43A4-BAB3-A0627C0A0272@.microsoft.com...
> Please check wherther the Security implemenation for Forms Authetication
> was
> properly implemented.The authetication in the Rs Config File needs to be
> changed to Forms Authentication and all the required policy is set.
> Regards,
> Rags Iyer
> "DJM" wrote:
>> Yes.
>> "Rags Iyer" <RagsIyer@.discussions.microsoft.com> wrote in message
>> news:C574F74E-C580-47A4-86AD-BCD62253C700@.microsoft.com...
>> >
>> > Is the Login Box still popping up when Forms Authetication is
>> > Implemented.?
>>