Improve company productivity with a Business Account.Sign Up

x
  • Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 1284
  • Last Modified:

MS ReportServer and Insufficient Permissions error

I'm working on an existing C# web application that utilizes the Microsoft Report Server (2.0) add-on to SQL Server 2008, and I've encountered an error that is incredibly frustrating.  I'll admit that my primary experience is in Linux with PHP and Apache, so I don't have a lot of experience troubleshooting M$ products.

The error:
Sys.WebForms.PageRequestManagerServerErrorException: The permissions granted to user 'IIS APPPOOL\application' are insufficient for performing this operation. 
(rsAccessDenied)
ScriptResource.axd Line: 4723

Open in new window


The application works just fine for the most part, until the point that I attempt to load a page that uses reports from Report Server.  I immediately get errors referring to a missing "ClientController" object/id, and the previous error appears once I've clicked the final item that would normally cause some AJAX call (presumably) that leads to the report being displayed.

When I run Visual Studios (2008) on the server itself and start debugging, it can access the reports just fine, so the Report Server is functional.
0
crazedsanity
Asked:
crazedsanity
  • 7
  • 7
  • 5
2 Solutions
 
GDG_DBACommented:
Have you verified that the Datasource for this report is configured properly on the Report Server?

-G
0
 
crazedsanityAuthor Commented:
I'm not certain that it is configured properly.  The server I'm working on is a new one that is mostly a duplicate of the current production server, but this one is running MSSQL 2008 whereas the old one is running MSSQL 2005; I've tried to copy all settings as much as possible, but obviously I've missed something.  

Please let me know if there's any information I can provide to help figure this problem out.
0
 
GDG_DBACommented:
First try this:

1. Connect to the report server through its web interface.  
2. Find the datasource for the report.
3. Look at the properties, and verify that it is using the correct configuration.
4. While you are there, find the report and make sure it runs properly.

Let me know if you have any questions about the above.

-G
0
Free Tool: Subnet Calculator

The subnet calculator helps you design networks by taking an IP address and network mask and returning information such as network, broadcast address, and host range.

One of a set of tools we're offering as a way of saying thank you for being a part of the community.

 
manukapoorCommented:
Hi,

Which version of IIS are you using ?

-Manu
0
 
manukapoorCommented:
Hi,

You may right click on the ReportServer Application Pool and in the properties-->advance settings look for Identity for Application pool and here select Local System. After this reset the IIS using iisreset command and try your operation again.

Post the outcome

- Manu
0
 
crazedsanityAuthor Commented:
GDG_DBA:
I've gone through all those steps before, but I did so again.  The connection string was set to the server's name (BLH02), so I switched to localhost.  Testing the connection worked just fine, but that didn't change the problem.

manukapoor:
The server is running IIS7.  I created a new application pool, set that to be "Local System," and the switched the virtual directory for ReportServer (which I had to create manually a while back) to use that identity.  No change.
0
 
GDG_DBACommented:
Crazed,

Are you using BIDS (i.e. Visual Studio) or SSRS (web based management interface) to verify the datasource?

-G

0
 
crazedsanityAuthor Commented:
I've used both BIDS/VS and the web interface (SSRS).
0
 
crazedsanityAuthor Commented:
I've managed to at least change the error: now it says that "NT AUTHORITY\NETWORK SERVICE" has insufficient permissions.

I have two sites setup on this new server, the "Default Web Site" and "application", which was done in an attempt to mirror the original site.  The Default site has nothing in it and is in fact unused; I found out after setting up the new server that their main/static website is being hosted somewhere else.

The "application" site is running on port 8080, just like the old server.  I had originally had the virtual directory for "ReportServer" setup under the default site, though I moved it to the application site with no change.

I found this site [ http://www.gotknowhow.com/articles/how-to-fix-ssrs-iis7-permissions-granted-to-user-nt-authority-network-service-are-insufficient-error ], which led me to the point that the error was altered (now it has the "NT AUTHORITY" user listed in the error).  I feel like I'm close, but there's just something missing...
0
 
manukapoorCommented:
Hi,

For the error:   "NT AUTHORITY\NETWORK SERVICE" has insufficient permissions.
Just goto SQL Server Management Studio and Add this login with SYSADMIN server role. This should resolve your problem.

Steps:
1. Open SSMS -> Security --> right click on Login -->Add Login --> locate NT AUTHORITY\NETWORK SERVICE and select OK.
2. After this, In the same window, on the left side you will see Server Roles, select SYSADMIN and Click OK
3. Test and post your results.

Hope this helps

-Manu
0
 
GDG_DBACommented:
Manu,

That's the last thing I would do.  

I don't think I would advise someone to make thier database server wide open like that without saying that this is only a test.  If it is successful, it might point to security configuration as the problem.  However, it should immediately be removed when testing is finished.  And then security can be configured properly.

-G

0
 
manukapoorCommented:
Yes, I second you on this point.

This account will require db_owner permissions in ReportServer and ReportServerTempDB databases, this should be adequate.

-Manu
0
 
GDG_DBACommented:
I wouldn't do that either.  The only account that needs permissions in the RS and RS-Temp databases is the account that runs the RS service.  Since RS is already working, I'd bet that is already fine.

You'r problem seems to be that the account that is trying to execute the report does not have permissions to do that.

Q: In SSRS does 'IIS APPPOOL\application' have atleast BROWSER permissions on the folder in which the report resides?  Since you changed the pool, you may need to add 'NT AUTHORITY\NETWORK SERVICE' instead.  (I'd check both at this point).

Best Regards,
-G

0
 
crazedsanityAuthor Commented:
In an interesting turn of events, the error has changed again.  Now I'm getting an error page in the little frame where the report is supposed to show:

Unable to cast object of type 'Microsoft.Reporting.WebForms.ReportHierarchy' to type 'Microsoft.Reporting.WebForms.ReportHierarchy'.

Open in new window


I searched for a bit to figure this one out, which eventually lead me to this url [ http://social.msdn.microsoft.com/Forums/en-US/sqlreportingservices/thread/7b4b53ed-8034-4691-8ea4-cdd93132f3de ], where I eventually installed the SP1 for VS.

I rebooted the server, and encountered the same error.  I went & did a rebuild + deploy on the reports, at which point I got a generic error ("rsProcessAborted" or close to it).  I checked the web-based report, where I found that doing a deploy changed the connection string to point at the old server.. I fixed that, and now I'm stuck with the afore-mentioned cast error.
0
 
crazedsanityAuthor Commented:
It seems that the problem is resolved.  Unfortunately, I can't really determine exactly which part fixed it, and I unfortunately didn't document each individual change.  I did make sure that the website was running under the same identity as the Report Server, which I tend to believe was the part that got me past the permission problem.

I found the obscure fix to my casting issue here: [ https://support.discountasp.net/KB/a784/why-is-the-reportviewer-control-not-working-on-iis-7.aspx ].  I checked the handler mappings and found that, deep in the "Handler" column, it specified version 8.0.0.0; when I had originally deployed/published the project to this server, I'd had similar problems with the "8.0.0.0" version of a couple of items, which were fixed by changing to 9.0.0.0 (and eventually just removing them)... so I changed that bit to 9.0.0.0 in the Handler, and it worked!
0
 
GDG_DBACommented:
Doesn't look like I am going to be of much help here.  It looks like you have a lot running on one server.  The servers I run all serve a single role (e.g.  SQL/SSRS or IIS web apps; but not both).  So I don't think I can help any more.  

Best Regards,
-G
0
 
GDG_DBACommented:
Great!
I am happy to hear you got it working!

Best Regards!
-G
0
 
manukapoorCommented:
Congratulations in getting this to work !!!!

-Manu
0
 
crazedsanityAuthor Commented:
The permissions problem had something to do with the application pool (and possibly some file system permissions).  Thanks to everyone for your time!
0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

Join & Write a Comment

Featured Post

Get your problem seen by more experts

Be seen. Boost your question’s priority for more expert views and faster solutions

  • 7
  • 7
  • 5
Tackle projects and never again get stuck behind a technical roadblock.
Join Now