Security Extension Sample

Next, you will need to increase the permissions for the "My Computer" code group in the Report Manager policy file.

To modify the RSMgrPolicy.config file

1. Open the Report Manager policy file, rsmgrpolicy.config, located in the <install>\ReportManager directory.

2. Locate the following code group in rsmgrpolicy.config and change the PermissionSetName attribute from Execution to FullTrust as follows:

   <CodeGroup 
           class="FirstMatchCodeGroup" 
           version="1" 
           PermissionSetName="FullTrust"
           Description="This code group grants MyComputer code Execution 
   permission. ">
       <IMembershipCondition 
               class="ZoneMembershipCondition"
               version="1"
               Zone="MyComputer" />
   

To use Forms Authentication, you need to modify the Web.config files for Report Manager and Report Server to change the authentication mode and disable impersonation.

To modify the Web.config file for Report Server

1. Open the Web.config file in a text editor. By default, the file is located in the <install>\ReportServer directory.

2. Locate the <identity> element and set the Impersonate attribute to false.

   <identity impersonate="false" />
   

3. Locate the <authentication> element and change the Mode attribute to Forms.

4. Add the following <forms> element as a child of the <authentication> element and set the loginUrl, name, timeout, and path attributes as follows:

   <authentication mode="Forms">
      <forms loginUrl="logon.aspx" name="sqlAuthCookie" timeout="60" 
                  path="/"></forms>
      </authentication>
   

5. Add the following <authorization> element directly after the <authentication> element.

   <authorization> 
      <deny users="?" />
   </authorization>
   

   This will deny unauthenticated users the right to access the report server. The previously established loginUrl attribute of the <authentication> element will redirect unauthenticated requests to the Logon.aspx page.

To modify the Web.config file for Report Manager

1. Open the Web.config for Report Manager. It is located in the <install>\ReportManager directory.

2. Disable impersonation by locating the section <identity impersonate= "true" /> and changing it to the following: <identity impersonate="false" />.

Configuring Anonymous Authentication

By default, the Windows user group Guests includes the IUSR_computername account. This account is used to initially log on locally and view the Logon.aspx page. To support Forms Authentication, you must enable anonymous access for the ReportServer virtual directory. By default, anonymous access is disabled.

To enable anonymous authentication

1. In Internet Information Services, select the ReportServer virtual directory, which is usually a member of the Default Web site, and open its Property tabs.

2. Click the Directory Security tab.

3. In the Anonymous access and authentication control section, click Edit.

   The Authentication Methods dialog box appears.

4. Select the Anonymous access check box.

5. Click OK.

   Repeat the above steps for the Reports virtual directory.

Creating the UserAccounts Database

The sample includes a database script, createuserstore.sql, that enables you to set up a user store for the Forms sample in a SQL Server database.

To create the UserAccounts database

1. Open SQL Server Management Studio, and then connect to your local instance of SQL Server.

2. Locate the createuserstore.sql SQL script file. The script file is contained within the sample project files.

3. Locate "LocalMachine" towards the end of the script and replace it with your own computer name. For Windows 2003 users, replace LocalMachine\ASPNET with NT AUTHORITY\NETWORK SERVICE (except when in IIS 5 compatibility mode).

4. Run the query to create the UserAccounts database.

5. Exit SQL Server Management Studio.

Testing the Sample

The following procedure tests the sample extension. You will register an administrator user, which adds the user name, password hash, and salt value to the users table in the UserAccounts database. It also will require you to enter that user name in the Report Server configuration file. You will then log on the same user to ensure the correct operation of the password verification routines as well as the proper loading of the extension assembly by the report server.

To create the report project

1. Restart IIS by running Iisreset.exe at the command prompt.

2. Open Report Manager. You can do this from the Reporting Services program menu or by accessing the Reports virtual directory from your browser.

3. Enter a user name and password and click Register User to add the user to the accounts database.

4. Open the RSReportServer.config file. Locate the <Security> element and add the previously registered user name as follows:

   <Security>
      <Extension Name="Forms" 
   Type="Microsoft.Samples.ReportingServices.CustomSecurity.Authorization, 
   Microsoft.Samples.ReportingServices.CustomSecurity" >
         <Configuration>
            <AdminConfiguration>
               <UserName>username</UserName>
            </AdminConfiguration>
         </Configuration>
      </Extension>
   </Security>
   

5. Return to the UILogon.aspx page, re-enter the user name and password, and then click Logon.

You should have access to Report Manager and the report server with no restrictions. The administrator user that you create has equivalent permissions on the report server to those of a built-in administrator account on the local computer. For the purpose of this sample, you can only have one user designated as an administrator. Once you have a built-in administrator account, you can register additional users and assign them roles on the report server.

Using the Web Service with Custom Security

You can use the Web service API with Forms Authentication just as you would with Windows Authentication. However, you must call LogonUser in your Web service code and pass the credentials of the current user. In addition, your Web service client will not have the benefit of automatic cookie management, which is provided by Internet Explorer or other Web browsers. You will have to extend the Microsoft.ReportingServices proxy class to include cookie management. This can be done by overriding the GetWebRequest and GetWebResponse methods of the Web service class.

Debugging the Sample Extension

Running the sample extension in the debugger is not only a great way to troubleshoot difficulties you may have, but it is also an effective way to step through the code and see the report server authentication and authorization process as it is happening.

The Microsoft .NET Framework provides several debugging tools that can help you analyze the sample code. The following procedure uses Visual Studio 2005 to debug the previous sample.

To debug the Forms Authentication sample code

1. Start Visual Studio and open CustomSecurity.sln on your test report server.

2. Open Internet Explorer and navigate to Report Manager while leaving the sample code open in Visual Studio.

3. Switch to Visual Studio and set some break points in the custom security extension project code.

4. With the extension project still the active window, from the Debug menu, click Process.

   The Processes dialog opens.

5. From the list of processes, select the Aspnet_wp.exe process (or W3wp.exe, if your application is deployed on IIS 6.0), and click Attach.

6. In the Attach to Process dialog, select the Common Language Runtime program type, and then click OK. For improved debugging performance, make sure that Native is not a selected program type.

7. When the sample runs, a logon form appears. Type the user credentials into the logon form and click the Logon button.

   Whenever your break points are encountered during processing, the debugger should stop execution at that point.

8. Step through your code using the F11 key. For more information about using Visual Studio for debugging, see your Visual Studio 2005 documentation.

Removing the Sample Extension

While not generally recommended, it is possible to revert back to Windows Authentication after you have tried out the sample.

To revert to Windows security

1. Restore the following files from your backup copies: Web.config, RSReportServer.config, and RSWebApplication.config. This should set the authentication and authorization methods for the report server to the default Windows security. This should also remove any entries you made for your extension in the Report Server or Report Manager configuration files.

2. Disable anonymous access in Internet Information Services (IIS) for the report server virtual directory.

After the configuration information is removed, your security extension is no longer available to the report server. You should not have to remove any security descriptors that were created while you were running the report server under the sample security extension. The report server automatically assigns the System Administrator role to the BUILTIN\Administrators group on the computer hosting the report server when Windows Authentication is enabled. However, you will have to manually re-apply any role-based security for your Windows users.

Note that reverting back to Windows Authentication after migrating to a different security extension is generally not recommended. If you do, you may experience errors when you attempt to access items in the report server database that have custom security descriptors, but no Windows Authentication security descriptors.

See Also

Tasks

SQL Server Reporting Services Samples

Other Resources

Extension Samples (Reporting Services)
Implementing a Security Extension

Help and Information

Getting SQL Server 2005 Assistance

Change History