Solved

SQL Reporting Services login prompt on remote access to ReportManager

Posted on 2008-06-17
20
7,044 Views
Last Modified: 2011-10-19
I have SQL 2005 Reporing Services installed with IIS on a machine running Windows Server 2003. The Reporting Services db is on another machine. If I browse to http://srsserver/reports from the srsserver itself it displays the report manager. If I browse to the same url from any other machine on the domain I am prompted for login credentials. And I am ultimatedly denied access regardless of the user I try to login as. Is there some setting for remote access that I have configured improperly? Can someone help me figure out what's going on here? Thanks.
0
Comment
Question by:Paracom_Inc
  • 7
  • 5
  • 3
  • +3
20 Comments
 
LVL 4

Accepted Solution

by:
zx10r earned 125 total points
Comment Utility
Is your IIS Security setup to use Integrated Windows Authentication.

Also, have you assigned permissions to domain logins on the report server?
0
 
LVL 13

Assisted Solution

by:rickchild
rickchild earned 125 total points
Comment Utility
Ensure that the comain account you are using has been given Content Manager permissions to the root folder in ReportManager.  You could do this manually, or by making the user a member of local admins on the target machine.

Also your reporting services installation should be running as a Domain Service account if it is set up with the default of Local System Account or "NTAuthority\NetworkService".

You can change this in the Reporting Services Configuration in "Windows Service Identity" (Not in Admin Tools -> Services as the key encryption won't like that.)  Be sure to back up your key before making any changes.
0
 
LVL 13

Expert Comment

by:rickchild
Comment Utility
Any chance of a screen shot of the login, just so I can see if it looks like a SSRS prompt or something else?
0
 
LVL 12

Expert Comment

by:jgv
Comment Utility
Just came across these links provided by dbaSQL in another thread. Both deal with configuring security for reporting services and may help with your situation.

Configuring Authentication for Reporting Services
http://msdn.microsoft.com/en-us/library/bb283249.aspx

Configuring Report Server Virtual Directories
http://technet.microsoft.com/en-us/library/ms159261.aspx
0
 

Author Comment

by:Paracom_Inc
Comment Utility
I am using Integrated Windows Authentication. I am logged on to my workstation using my domain user account. I am a member of the BUILTIN\Administrators group for the report server. Just to be sure, I made my domain user account a member of the Content Manager role using the Report Manager (from the report server itself). The Reports and ReportServer applications in IIS on the report server are configured to use an application pool that uses a domain administrator as its identity. The SQL Server Reporting Services service uses this same domain administrator account.

The attached file shows the login prompt I am receiving and also the 401 error page I get after the login fails.
login.doc
0
 

Author Comment

by:Paracom_Inc
Comment Utility
I reviewed the links in jgv's post, but found nothing that resolved the problem. Incidentally, If I try to deploy reports to the report server from another machine I am also prompted to login, though this time it is a Reporting Services Login dialog. I am unable to successfully login under these circumstances either. Any ideas?
0
 
LVL 13

Expert Comment

by:rickchild
Comment Utility
Might be worth a cross post to another Zone, as from the screenshot it looks more of an IIS authentication issue?
0
 
LVL 12

Expert Comment

by:jgv
Comment Utility
In IIS, make sure that you have Anonymous access enabled on the web site hosting reporting services. Below the web site, both ReportServer and Reports should have Anonymous access unchecked and Integrated Windows authentication checked.

By any chance, have you renamed the IIS server since installing SSRS?
0
 
LVL 4

Expert Comment

by:zx10r
Comment Utility
What options are checked in  IIS Authentication Method window under Directory security?

And is realm and domain box filled out?
0
 

Author Comment

by:Paracom_Inc
Comment Utility
The web site hosting reporting services has Anonymous access enabled. The ReportServer and Reports virtual directories have Anonymous access unchecked and Integrated Windows authentication checked. Only Integrated Windows authentication is checked for the host web site and the virtual directories. The Default domain and realm textboxes are grayed out and empty. I have not renamed the server since installing SRSS.
0
What Security Threats Are You Missing?

Enhance your security with threat intelligence from the web. Get trending threat insights on hackers, exploits, and suspicious IP addresses delivered to your inbox with our free Cyber Daily.

 
LVL 4

Expert Comment

by:zx10r
Comment Utility
Anonymous access should NOT be checked! Integrated authentication and digest authentication should be checked. Also since you are in the domain, realm box should be equal to that of your domain.
0
 
LVL 12

Assisted Solution

by:jgv
jgv earned 125 total points
Comment Utility
This is a forum thread with a number of suggestions on dealing with a login prompt during report deployment. It's a long shot but you may find something useful....not sure what else to suggest.
http://forums.microsoft.com/technet/showpost.aspx?pageindex=1&siteid=17&postid=1675815&sb=0&d=1&at=7&ft=11&tf=0&pageid=0
0
 

Author Comment

by:Paracom_Inc
Comment Utility
zx10r,
Do I really need digest authentication? The report server and the machine I'm trying to reach it from are not only in the same domain, they are on the same lan with no firewall between them. I'd prefer not to have to have passwords passed in clear text?
0
 

Author Comment

by:Paracom_Inc
Comment Utility
I have noticed that if I leave the app pool identity set to Network Service it works properly and I don't get prompted for credentials. Perhaps the domain user that I am using as the app pool identity needs different permissions. Is there someplace that lists the permissions required for the identity of an app pool in which reporting services is running?
0
 
LVL 4

Expert Comment

by:zx10r
Comment Utility
You can get rid of digest authentication if you want. See if that eliminated the login prompt.
0
 

Author Comment

by:Paracom_Inc
Comment Utility
I was never using digest authentication. I was just asking if you thought it was necessary. Thanks.
0
 
LVL 4

Expert Comment

by:zx10r
Comment Utility
You can get rid of it. Are you still having problems?
0
 

Author Comment

by:Paracom_Inc
Comment Utility
Yes. I am not using digest authentication and I'm still having the same problem.
0
 
LVL 1

Assisted Solution

by:dcoluzzi
dcoluzzi earned 125 total points
Comment Utility
I had the same problems you did and I found this on the M$ site:

http://technet.microsoft.com/en-us/library/ms180127.aspx

This basically explains that you either have to set the identity to the Network Service account or you have to manually set the correct SPN on the domain account.  Instructions for manually setting the SPN are here:

http://technet.microsoft.com/en-us/library/ms180127.aspx

"Note that if you use a domain service account and your domain is configured for Kerberos authentication, you might encounter HTTP 401 access denied errors if you did not create a Service Principal Name (SPN) that registers the domain account for the Web site. Be sure that the domain account that you register is the same one used for the application pool. For more information, see Configuring Constrained Delegation for Kerberos (IIS 6.0) on the Microsoft TechNet Web site."

Hope this helps.

0
 

Expert Comment

by:furqan_trakker
Comment Utility
Stand on Installation Server where you have access reporting services 2005 then come to properties
and add role

domain\accountname

click on required check boxes

when you will use again from remote then give same domain user id and password

0

Featured Post

What is SQL Server and how does it work?

The purpose of this paper is to provide you background on SQL Server. It’s your self-study guide for learning fundamentals. It includes both the history of SQL and its technical basics. Concepts and definitions will form the solid foundation of your future DBA expertise.

Join & Write a Comment

Suggested Solutions

Slowly Changing Dimension Transformation component in data task flow is very useful for us to manage and control how data changes in SSIS.
Ever wondered why sometimes your SQL Server is slow or unresponsive with connections spiking up but by the time you go in, all is well? The following article will show you how to install and configure a SQL job that will send you email alerts includ…
Via a live example, show how to shrink a transaction log file down to a reasonable size.
Viewers will learn how the fundamental information of how to create a table.

762 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

9 Experts available now in Live!

Get 1:1 Help Now