Planning for Extranet or Internet Deployment

Extranet or Internet Architecture Diagram

The following illustration provides an example of a best-practice deployment configuration for extranet or Internet deployment.

Key points to notice about the diagram include the following:

• Three firewalls provide defense in depth across the entire deployment. Recommendations for configuring the firewalls are provided in this topic.

• The point of entry is a custom Internet application that contains the ReportViewer control. The control hosts a report that runs on a report server behind the second firewall.

• Reports use data from read-only data sources that are created specifically for reporting purposes. The data sources contain data that is copied from other sources, but without sensitive data values that you would never use in a report.

• Corporate data servers contain sensitive data that you protect through strict permissions and restrictive firewall settings. You should also consider putting the report server database in this security zone so that all database servers that require read-write access can use the protection provided by the third firewall.

General Guidelines

The following list provides broad guidelines for deploying Reporting Services in the topology depicted in this topic. This list is offered as a starting point for planning your own deployment plan. The specific configuration of your network topology will probably require that you perform additional steps that are not described in this list.

It is important that you deploy the configuration in a test environment to confirm that you understand all the requirements, settings, steps, and the best order for those steps:

1. Install firewalls and identify servers, accounts, and permissions.

2. Create or obtain server certificates for SSL connections. Install certificates on all computers that host server components. If you installed the certificates with wildcard settings, you can use the same certificate for multiple URLs.

3. Design and implement an approach for copying corporate data to separate reporting data sources. You can use technologies such as Replication, SQL Server Integration Services, or a third-party product.

4. Install Reporting Services in files-only installation mode so that you can configure it with settings that are valid for external access. In SQL Server Installation Wizard, this is the Install but do not configure option.

5. Run the Reporting Services Configuration tool after Setup is complete to configure the report server:

   1. Verify the service runs under a least-privileged account. Avoid using Local System. If you selected Local System, change the account to use NetworkService or a domain user account.

   2. Define a report server URL and optionally a Report Manager URL:

      You should create multiple URLs to support access through a fully qualified domain name (FQDN) that will be used by external users, and a different URL that uses the network name. Using two different URLs will allow you to connect to the report server if your Internet connection is disabled or offline.

      You should select SSL certificates for the FQDN URLs that you define.

   3. Create the report server database. If the SQL Server instance is in a different domain and Kerberos 5.0 is not enabled, use SQL Server authentication for the report server database connection. Secure the connection between the report server computer and the SQL Server Database Engine instance using SSL or IPSec.

6. Create and deploy a custom authentication extension. If you are using a Single Sign-on technology that is implemented as an ISAPI filter, you must use ISA Server to support the ISAPI filter. The HTTP listener in Reporting Services does not support ISAPI filters.

7. Configure role assignments that use the security principles of the custom authentication extension and map them to roles that convey permissions to report server operations.

8. Create and deploy an Internet front-end application that uses the ReportViewer Web server control.

9. Publish reports and other content types to the report server.

10. Configure the firewall settings. Verify firewall settings allow minimum access to downstream computers and applications.

Firewall Configurations

The default URLs for report server applications assume that port 80 is enabled and available to the report server. If you are using Windows Firewall, you must open port 80 or another port that is available for report server HTTP requests. If you use a different port, be sure to specify it in the report server URLs. For more information, see How to: Configure a Firewall for Report Server Access. For more information about the default Windows firewall settings, and a description of the TCP ports that affect the Database Engine, Analysis Services, Reporting Services, and Integration Services, see Configuring the Windows Firewall to Allow SQL Server Access.

ReportViewer Web Server Control in an Internet Application

To deploy reports in an Internet application, you can embed the ReportViewer Web server control in a custom Internet-ready application that you create and deploy. The ReportViewer Web server control is included in Visual Studio 2005 and later, and can be distributed freely with your application. You can configure the control to display reports that run on a report server. The connection between your application and the report server is handled by the control, through the Web service programming interface. All authentication and authorization is handled by your application, which connects to the report server through a single, user-trusted connection.

For more information, see Reporting Services and ReportViewer Controls in Visual Studio.

Report Manager as an Internet or Extranet Web Front-end

Configuring Proxy Settings in Web.config Files

<configuration>
...
<system.net>
  <defaultProxy enabled="false" />
</system.net>
</configuration>

Authentication Considerations for Extranet and Internet Deployment

To deploy a report server in an extranet scenario that supports connections from predefined Microsoft Active Directory accounts, you can use the default Windows Authentication security extension. Plan on configuring the server for Secure Sockets Layer (SSL) connections and Basic authentication. You can use the Reporting Services Configuration tool to map an existing certificate to a report server URL. You can modify configuration files to specify the authentication type.

To deploy a report server in an extranet scenario that supports connections from a single sign-on technology or a forms-based authentication model that stores user identity information in a database, you must create a custom authentication extension to replace the default Windows Authentication security extension. Forms-based authentication is typically used when you are opening up a report server to the public but only want authenticated users to view content. By default, SQL Server Reporting Services does not provide a forms-based authentication module. For more information about how to create one, see Implementing a Security Extension in SQL Server Books Online.

Verifying Internet Deployment

To verify that your report server connection is accessible, you should be able to view the report server folder namespace over an Internet connection by typing http: (or https:)//<your-web-server-fully-qualified-domain-name>/reportserver, where /reportserver is the default name of the report server virtual directory.

See Also

Concepts