Thursday, June 10, 2010

Built-in SSRS 2008 Roles

I couldn't find a satisfactory permission matrix for the built-in SSRS 2008 roles, so I'm publishing one here. This is a pretty comprehensive list; you may have to maximize your browser window for this!

For completeness, I'll mention that you can manage these roles by connecting to a Reporting Services instance and browsing the Security folder.

If you connect to the database engine, you can find the permissions encapsulated in the TaskMask column of the Roles table, in the ReportServer database. I would avoid editing the permissions there.


Built-in RoleSystem AdministratorSystem User
DescriptionView and modify system role assignments, system role definitions, system properties, and shared schedules.View system properties and shared schedules.
Manage rolesCreate, view, modify and delete role definitions.X
Manage report server securityView and modify system-wide role assignments.X
View report server propertiesView properties that apply to the report server.X
Manage report server propertiesView and modify properties that apply to the report server and to items managed by the report server.X
View shared schedulesView a predefined schedule that has been made available for general use.X
Manage shared schedulesCreate, view, modify and delete shared schedules used to run reports or refresh a report.X
Generate eventsProvides an application with the ability to generate events within the report server namespace.
Manage jobsView and cancel running jobs.X
Execute Report DefinitionsStart execution from report definition without publishing it to Report Server.XX

Built-in RoleBrowserContent ManagerMy ReportsPublisherReport Builder
DescriptionMay view folders, reports and subscribe to reports.May manage content in the Report Server. This includes folders, reports and resources.May publish reports and linked reports; manage folders, reports and resources in a users My Reports folder.May publish reports and linked reports to the Report Server.May view report definitions.
Set security for individual itemsView and modify security settings for reports, folders, resources, and shared data sources.X
Create linked reportsCreate linked reports and publish them to a report server folder.XXX
View reportsView reports and linked reports in the folder hierarchy; view report history snapshots and report properties.XXXX
Manage reportsCreate, and delete reports; and modify report properties.XXX
View resourcesView resources in the folder hierarchy; and view resource properties.XXXX
Manage resourcesCreate, modify and delete resources, and modify resource properties.XXX
View foldersView folder items in the folder hierarchy; and view folder properties.XXXX
Manage foldersCreate, view and delete folders; and view and modify folder properties.XXX
Manage report historyCreate, view, and delete report history snapshots; and modify report history properties.XX
Manage individual subscriptionsEach user can create, view, modify and delete subscriptions that he or she owns.XXXX
Manage all subscriptionsView, modify, and delete any subscription regardless of who owns the subscription.X
View data sourcesView shared data source items in the folder hierarchy; and view data source properties.XX
Manage data sourcesCreate and delete shared data source items; and modify data source properties.XXX
View modelsView models in the folder hierarchy, use models as data sources for a report, and run queries against the model to retrieve data.XXX
Manage modelsCreate, view, and delete models; and view and modify model properties.XX
Consume reportsReads report definitionsXX

Tuesday, June 8, 2010

SQL Server 2008 Reporting Services RS.EXE Supporting Forms Authentication

I've decided to expand the scope of my blog to more than just Identity Management. Recently, I've been submerged in the BI space, and since I'm not sure when I'll resurface, I'd like to contribute some of the cool stuff I've been doing back to the community.

I'm currently working on a scale-out deployment of SSRS that uses Forms authentication. Everything is working well with the security extension, and now we're focusing on moving everything into Stage. Good time for the scripting utility, rs.exe, right? Well, if you didn't already know, rs.exe isn't supported with Forms authentication. Wow, what a bummer.

What's more, I can't use the RSScripter, which is a very cool and useful app for generating scripts for rs.exe.

So, what do I do? I could write my own utility. We already have a web service client to integrate SSRS with an in-house app. I would just need to add a bunch of management features to it... and add commands to extract and load... and make it generic enough to reuse... and then maintain it. Nah, that sounds like a lot of work. Let's just use .NET Reflector on the original rs.exe app!

I've reassembled rs.exe with the ability to preserve the RS authentication cookie, which is required with Forms authentication. Hopefully someone out there finds this useful!

BTW, the RSScripter also doesn't support Forms authentication, because rs.exe doesn't, and RSScripter is dependent on rs.exe. Leave me a comment if you need a version of RSScripter that works with Forms auth.

Good luck!