security - Significance of SSRS roles? Reports depending on permission of Stored procs -
i have set of ssrs reports using stored procedures , want give view-only access of reports someone. believed done assigning users/groups "browser" ssrs role. not working.
the grant/deny of reports access done grant/deny of execute permission on underlying stored procs.
am missing here? if above true, significance of ssrs roles.
data source permissions different report access permissions.
ssrs roles control whether user can access report. report data source set pass user credentials database , hence stored procedures; why you're needing set permissions @ level, too.
if user had no access reports not able run them , no database access occur.
to @ different way, consider report credentials stored @ data source , not passed through using windows authentication. means user running report connect database stored credentials, not themselves. need worry database permissions data source credentials. still need able grant/deny access report, , report access permissions make difference.
edit after comment:
you've mentioned 2 scenarios, 1 data source set store database user credentials, , other data source database access set use credentials of whomever running report.
in both scenarios control access report @ report server level.
so, if grant domain\user1 browser role directly @ report level or higher, can access report. no access set up, domain\user2 cannot run report.
now report permission set need consider how data source set up.
when credentials stored @ data source, need consider database permissions user. have set data source connect database domain\reportuser - user need access underlying stored procedures. domain\user1 not access database not need execute
on these objects; domain\reportuser does.
when credentials not stored, data source database access performed user running report, in case when domain\user1 runs report, running underlying stored procedures need execute
privilege on objects.
in both data source scenarios, domain\user2 cannot access report because of report permissions database permissions don't matter.
Comments
Post a Comment