Solved

MS ReportServer and Insufficient Permissions error

Posted on 2010-11-19
19
1,214 Views
Last Modified: 2013-12-17
I'm working on an existing C# web application that utilizes the Microsoft Report Server (2.0) add-on to SQL Server 2008, and I've encountered an error that is incredibly frustrating.  I'll admit that my primary experience is in Linux with PHP and Apache, so I don't have a lot of experience troubleshooting M$ products.

The error:
Sys.WebForms.PageRequestManagerServerErrorException: The permissions granted to user 'IIS APPPOOL\application' are insufficient for performing this operation. 
(rsAccessDenied)
ScriptResource.axd Line: 4723

Open in new window


The application works just fine for the most part, until the point that I attempt to load a page that uses reports from Report Server.  I immediately get errors referring to a missing "ClientController" object/id, and the previous error appears once I've clicked the final item that would normally cause some AJAX call (presumably) that leads to the report being displayed.

When I run Visual Studios (2008) on the server itself and start debugging, it can access the reports just fine, so the Report Server is functional.
0
Comment
Question by:crazedsanity
  • 7
  • 7
  • 5
19 Comments
 
LVL 10

Expert Comment

by:GDG_DBA
Comment Utility
Have you verified that the Datasource for this report is configured properly on the Report Server?

-G
0
 
LVL 9

Author Comment

by:crazedsanity
Comment Utility
I'm not certain that it is configured properly.  The server I'm working on is a new one that is mostly a duplicate of the current production server, but this one is running MSSQL 2008 whereas the old one is running MSSQL 2005; I've tried to copy all settings as much as possible, but obviously I've missed something.  

Please let me know if there's any information I can provide to help figure this problem out.
0
 
LVL 10

Accepted Solution

by:
GDG_DBA earned 500 total points
Comment Utility
First try this:

1. Connect to the report server through its web interface.  
2. Find the datasource for the report.
3. Look at the properties, and verify that it is using the correct configuration.
4. While you are there, find the report and make sure it runs properly.

Let me know if you have any questions about the above.

-G
0
 
LVL 2

Expert Comment

by:manukapoor
Comment Utility
Hi,

Which version of IIS are you using ?

-Manu
0
 
LVL 2

Expert Comment

by:manukapoor
Comment Utility
Hi,

You may right click on the ReportServer Application Pool and in the properties-->advance settings look for Identity for Application pool and here select Local System. After this reset the IIS using iisreset command and try your operation again.

Post the outcome

- Manu
0
 
LVL 9

Author Comment

by:crazedsanity
Comment Utility
GDG_DBA:
I've gone through all those steps before, but I did so again.  The connection string was set to the server's name (BLH02), so I switched to localhost.  Testing the connection worked just fine, but that didn't change the problem.

manukapoor:
The server is running IIS7.  I created a new application pool, set that to be "Local System," and the switched the virtual directory for ReportServer (which I had to create manually a while back) to use that identity.  No change.
0
 
LVL 10

Expert Comment

by:GDG_DBA
Comment Utility
Crazed,

Are you using BIDS (i.e. Visual Studio) or SSRS (web based management interface) to verify the datasource?

-G

0
 
LVL 9

Author Comment

by:crazedsanity
Comment Utility
I've used both BIDS/VS and the web interface (SSRS).
0
 
LVL 9

Author Comment

by:crazedsanity
Comment Utility
I've managed to at least change the error: now it says that "NT AUTHORITY\NETWORK SERVICE" has insufficient permissions.

I have two sites setup on this new server, the "Default Web Site" and "application", which was done in an attempt to mirror the original site.  The Default site has nothing in it and is in fact unused; I found out after setting up the new server that their main/static website is being hosted somewhere else.

The "application" site is running on port 8080, just like the old server.  I had originally had the virtual directory for "ReportServer" setup under the default site, though I moved it to the application site with no change.

I found this site [ http://www.gotknowhow.com/articles/how-to-fix-ssrs-iis7-permissions-granted-to-user-nt-authority-network-service-are-insufficient-error ], which led me to the point that the error was altered (now it has the "NT AUTHORITY" user listed in the error).  I feel like I'm close, but there's just something missing...
0
How your wiki can always stay up-to-date

Quip doubles as a “living” wiki and a project management tool that evolves with your organization. As you finish projects in Quip, the work remains, easily accessible to all team members, new and old.
- Increase transparency
- Onboard new hires faster
- Access from mobile/offline

 
LVL 2

Expert Comment

by:manukapoor
Comment Utility
Hi,

For the error:   "NT AUTHORITY\NETWORK SERVICE" has insufficient permissions.
Just goto SQL Server Management Studio and Add this login with SYSADMIN server role. This should resolve your problem.

Steps:
1. Open SSMS -> Security --> right click on Login -->Add Login --> locate NT AUTHORITY\NETWORK SERVICE and select OK.
2. After this, In the same window, on the left side you will see Server Roles, select SYSADMIN and Click OK
3. Test and post your results.

Hope this helps

-Manu
0
 
LVL 10

Expert Comment

by:GDG_DBA
Comment Utility
Manu,

That's the last thing I would do.  

I don't think I would advise someone to make thier database server wide open like that without saying that this is only a test.  If it is successful, it might point to security configuration as the problem.  However, it should immediately be removed when testing is finished.  And then security can be configured properly.

-G

0
 
LVL 2

Expert Comment

by:manukapoor
Comment Utility
Yes, I second you on this point.

This account will require db_owner permissions in ReportServer and ReportServerTempDB databases, this should be adequate.

-Manu
0
 
LVL 10

Expert Comment

by:GDG_DBA
Comment Utility
I wouldn't do that either.  The only account that needs permissions in the RS and RS-Temp databases is the account that runs the RS service.  Since RS is already working, I'd bet that is already fine.

You'r problem seems to be that the account that is trying to execute the report does not have permissions to do that.

Q: In SSRS does 'IIS APPPOOL\application' have atleast BROWSER permissions on the folder in which the report resides?  Since you changed the pool, you may need to add 'NT AUTHORITY\NETWORK SERVICE' instead.  (I'd check both at this point).

Best Regards,
-G

0
 
LVL 9

Author Comment

by:crazedsanity
Comment Utility
In an interesting turn of events, the error has changed again.  Now I'm getting an error page in the little frame where the report is supposed to show:

Unable to cast object of type 'Microsoft.Reporting.WebForms.ReportHierarchy' to type 'Microsoft.Reporting.WebForms.ReportHierarchy'.

Open in new window


I searched for a bit to figure this one out, which eventually lead me to this url [ http://social.msdn.microsoft.com/Forums/en-US/sqlreportingservices/thread/7b4b53ed-8034-4691-8ea4-cdd93132f3de ], where I eventually installed the SP1 for VS.

I rebooted the server, and encountered the same error.  I went & did a rebuild + deploy on the reports, at which point I got a generic error ("rsProcessAborted" or close to it).  I checked the web-based report, where I found that doing a deploy changed the connection string to point at the old server.. I fixed that, and now I'm stuck with the afore-mentioned cast error.
0
 
LVL 9

Assisted Solution

by:crazedsanity
crazedsanity earned 0 total points
Comment Utility
It seems that the problem is resolved.  Unfortunately, I can't really determine exactly which part fixed it, and I unfortunately didn't document each individual change.  I did make sure that the website was running under the same identity as the Report Server, which I tend to believe was the part that got me past the permission problem.

I found the obscure fix to my casting issue here: [ https://support.discountasp.net/KB/a784/why-is-the-reportviewer-control-not-working-on-iis-7.aspx ].  I checked the handler mappings and found that, deep in the "Handler" column, it specified version 8.0.0.0; when I had originally deployed/published the project to this server, I'd had similar problems with the "8.0.0.0" version of a couple of items, which were fixed by changing to 9.0.0.0 (and eventually just removing them)... so I changed that bit to 9.0.0.0 in the Handler, and it worked!
0
 
LVL 10

Expert Comment

by:GDG_DBA
Comment Utility
Doesn't look like I am going to be of much help here.  It looks like you have a lot running on one server.  The servers I run all serve a single role (e.g.  SQL/SSRS or IIS web apps; but not both).  So I don't think I can help any more.  

Best Regards,
-G
0
 
LVL 10

Expert Comment

by:GDG_DBA
Comment Utility
Great!
I am happy to hear you got it working!

Best Regards!
-G
0
 
LVL 2

Expert Comment

by:manukapoor
Comment Utility
Congratulations in getting this to work !!!!

-Manu
0
 
LVL 9

Author Closing Comment

by:crazedsanity
Comment Utility
The permissions problem had something to do with the application pool (and possibly some file system permissions).  Thanks to everyone for your time!
0

Featured Post

Highfive Gives IT Their Time Back

Highfive is so simple that setting up every meeting room takes just minutes and every employee will be able to start or join a call from any room with ease. Never be called into a meeting just to get it started again. This is how video conferencing should work!

Join & Write a Comment

Suggested Solutions

It is helpful to note: This is a cosmetic update and is not required, but should help your reports look better for your boss.  This issue has manifested itself in SSRS version 3.0 is where I have seen this behavior in.  And this behavior is only see…
This article explains how to reset the password of the sa account on a Microsoft SQL Server.  The steps in this article work in SQL 2005, 2008, 2008 R2, 2012, 2014 and 2016.
In this seventh video of the Xpdf series, we discuss and demonstrate the PDFfonts utility, which lists all the fonts used in a PDF file. It does this via a command line interface, making it suitable for use in programs, scripts, batch files — any pl…
Polish reports in Access so they look terrific. Take yourself to another level. Equations, Back Color, Alternate Back Color. Write easy VBA Code. Tighten space to use less pages. Launch report from a menu, considering criteria only when it is filled…

743 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

15 Experts available now in Live!

Get 1:1 Help Now