Solved

MS ReportServer and Insufficient Permissions error

Posted on 2010-11-19
19
1,221 Views
Last Modified: 2013-12-17
I'm working on an existing C# web application that utilizes the Microsoft Report Server (2.0) add-on to SQL Server 2008, and I've encountered an error that is incredibly frustrating.  I'll admit that my primary experience is in Linux with PHP and Apache, so I don't have a lot of experience troubleshooting M$ products.

The error:
Sys.WebForms.PageRequestManagerServerErrorException: The permissions granted to user 'IIS APPPOOL\application' are insufficient for performing this operation. 
(rsAccessDenied)
ScriptResource.axd Line: 4723

Open in new window


The application works just fine for the most part, until the point that I attempt to load a page that uses reports from Report Server.  I immediately get errors referring to a missing "ClientController" object/id, and the previous error appears once I've clicked the final item that would normally cause some AJAX call (presumably) that leads to the report being displayed.

When I run Visual Studios (2008) on the server itself and start debugging, it can access the reports just fine, so the Report Server is functional.
0
Comment
Question by:crazedsanity
  • 7
  • 7
  • 5
19 Comments
 
LVL 10

Expert Comment

by:GDG_DBA
ID: 34181629
Have you verified that the Datasource for this report is configured properly on the Report Server?

-G
0
 
LVL 9

Author Comment

by:crazedsanity
ID: 34185106
I'm not certain that it is configured properly.  The server I'm working on is a new one that is mostly a duplicate of the current production server, but this one is running MSSQL 2008 whereas the old one is running MSSQL 2005; I've tried to copy all settings as much as possible, but obviously I've missed something.  

Please let me know if there's any information I can provide to help figure this problem out.
0
 
LVL 10

Accepted Solution

by:
GDG_DBA earned 500 total points
ID: 34185339
First try this:

1. Connect to the report server through its web interface.  
2. Find the datasource for the report.
3. Look at the properties, and verify that it is using the correct configuration.
4. While you are there, find the report and make sure it runs properly.

Let me know if you have any questions about the above.

-G
0
3 Use Cases for Connected Systems

Our Dev teams are like yours. They’re continually cranking out code for new features/bugs fixes, testing, deploying, testing some more, responding to production monitoring events and more. It’s complex. So, we thought you’d like to see what’s working for us.

 
LVL 2

Expert Comment

by:manukapoor
ID: 34185440
Hi,

Which version of IIS are you using ?

-Manu
0
 
LVL 2

Expert Comment

by:manukapoor
ID: 34187585
Hi,

You may right click on the ReportServer Application Pool and in the properties-->advance settings look for Identity for Application pool and here select Local System. After this reset the IIS using iisreset command and try your operation again.

Post the outcome

- Manu
0
 
LVL 9

Author Comment

by:crazedsanity
ID: 34188263
GDG_DBA:
I've gone through all those steps before, but I did so again.  The connection string was set to the server's name (BLH02), so I switched to localhost.  Testing the connection worked just fine, but that didn't change the problem.

manukapoor:
The server is running IIS7.  I created a new application pool, set that to be "Local System," and the switched the virtual directory for ReportServer (which I had to create manually a while back) to use that identity.  No change.
0
 
LVL 10

Expert Comment

by:GDG_DBA
ID: 34188315
Crazed,

Are you using BIDS (i.e. Visual Studio) or SSRS (web based management interface) to verify the datasource?

-G

0
 
LVL 9

Author Comment

by:crazedsanity
ID: 34188406
I've used both BIDS/VS and the web interface (SSRS).
0
 
LVL 9

Author Comment

by:crazedsanity
ID: 34189672
I've managed to at least change the error: now it says that "NT AUTHORITY\NETWORK SERVICE" has insufficient permissions.

I have two sites setup on this new server, the "Default Web Site" and "application", which was done in an attempt to mirror the original site.  The Default site has nothing in it and is in fact unused; I found out after setting up the new server that their main/static website is being hosted somewhere else.

The "application" site is running on port 8080, just like the old server.  I had originally had the virtual directory for "ReportServer" setup under the default site, though I moved it to the application site with no change.

I found this site [ http://www.gotknowhow.com/articles/how-to-fix-ssrs-iis7-permissions-granted-to-user-nt-authority-network-service-are-insufficient-error ], which led me to the point that the error was altered (now it has the "NT AUTHORITY" user listed in the error).  I feel like I'm close, but there's just something missing...
0
 
LVL 2

Expert Comment

by:manukapoor
ID: 34190144
Hi,

For the error:   "NT AUTHORITY\NETWORK SERVICE" has insufficient permissions.
Just goto SQL Server Management Studio and Add this login with SYSADMIN server role. This should resolve your problem.

Steps:
1. Open SSMS -> Security --> right click on Login -->Add Login --> locate NT AUTHORITY\NETWORK SERVICE and select OK.
2. After this, In the same window, on the left side you will see Server Roles, select SYSADMIN and Click OK
3. Test and post your results.

Hope this helps

-Manu
0
 
LVL 10

Expert Comment

by:GDG_DBA
ID: 34190289
Manu,

That's the last thing I would do.  

I don't think I would advise someone to make thier database server wide open like that without saying that this is only a test.  If it is successful, it might point to security configuration as the problem.  However, it should immediately be removed when testing is finished.  And then security can be configured properly.

-G

0
 
LVL 2

Expert Comment

by:manukapoor
ID: 34190346
Yes, I second you on this point.

This account will require db_owner permissions in ReportServer and ReportServerTempDB databases, this should be adequate.

-Manu
0
 
LVL 10

Expert Comment

by:GDG_DBA
ID: 34190428
I wouldn't do that either.  The only account that needs permissions in the RS and RS-Temp databases is the account that runs the RS service.  Since RS is already working, I'd bet that is already fine.

You'r problem seems to be that the account that is trying to execute the report does not have permissions to do that.

Q: In SSRS does 'IIS APPPOOL\application' have atleast BROWSER permissions on the folder in which the report resides?  Since you changed the pool, you may need to add 'NT AUTHORITY\NETWORK SERVICE' instead.  (I'd check both at this point).

Best Regards,
-G

0
 
LVL 9

Author Comment

by:crazedsanity
ID: 34190493
In an interesting turn of events, the error has changed again.  Now I'm getting an error page in the little frame where the report is supposed to show:

Unable to cast object of type 'Microsoft.Reporting.WebForms.ReportHierarchy' to type 'Microsoft.Reporting.WebForms.ReportHierarchy'.

Open in new window


I searched for a bit to figure this one out, which eventually lead me to this url [ http://social.msdn.microsoft.com/Forums/en-US/sqlreportingservices/thread/7b4b53ed-8034-4691-8ea4-cdd93132f3de ], where I eventually installed the SP1 for VS.

I rebooted the server, and encountered the same error.  I went & did a rebuild + deploy on the reports, at which point I got a generic error ("rsProcessAborted" or close to it).  I checked the web-based report, where I found that doing a deploy changed the connection string to point at the old server.. I fixed that, and now I'm stuck with the afore-mentioned cast error.
0
 
LVL 9

Assisted Solution

by:crazedsanity
crazedsanity earned 0 total points
ID: 34190699
It seems that the problem is resolved.  Unfortunately, I can't really determine exactly which part fixed it, and I unfortunately didn't document each individual change.  I did make sure that the website was running under the same identity as the Report Server, which I tend to believe was the part that got me past the permission problem.

I found the obscure fix to my casting issue here: [ https://support.discountasp.net/KB/a784/why-is-the-reportviewer-control-not-working-on-iis-7.aspx ].  I checked the handler mappings and found that, deep in the "Handler" column, it specified version 8.0.0.0; when I had originally deployed/published the project to this server, I'd had similar problems with the "8.0.0.0" version of a couple of items, which were fixed by changing to 9.0.0.0 (and eventually just removing them)... so I changed that bit to 9.0.0.0 in the Handler, and it worked!
0
 
LVL 10

Expert Comment

by:GDG_DBA
ID: 34190725
Doesn't look like I am going to be of much help here.  It looks like you have a lot running on one server.  The servers I run all serve a single role (e.g.  SQL/SSRS or IIS web apps; but not both).  So I don't think I can help any more.  

Best Regards,
-G
0
 
LVL 10

Expert Comment

by:GDG_DBA
ID: 34190752
Great!
I am happy to hear you got it working!

Best Regards!
-G
0
 
LVL 2

Expert Comment

by:manukapoor
ID: 34194079
Congratulations in getting this to work !!!!

-Manu
0
 
LVL 9

Author Closing Comment

by:crazedsanity
ID: 34221268
The permissions problem had something to do with the application pool (and possibly some file system permissions).  Thanks to everyone for your time!
0

Featured Post

Microsoft Certification Exam 74-409

Veeam® is happy to provide the Microsoft community with a study guide prepared by MVP and MCT, Orin Thomas. This guide will take you through each of the exam objectives, helping you to prepare for and pass the examination.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Real-time is more about the business, not the technology. In day-to-day life, to make real-time decisions like buying or investing, business needs the latest information(e.g. Gold Rate/Stock Rate). Unlike traditional days, you need not wait for a fe…
This article shows how to deploy dynamic backgrounds to computers depending on the aspect ratio of display
Along with being a a promotional video for my three-day Annielytics Dashboard Seminor, this Micro Tutorial is an intro to Google Analytics API data.
A short tutorial showing how to set up an email signature in Outlook on the Web (previously known as OWA). For free email signatures designs, visit https://www.mail-signatures.com/articles/signature-templates/?sts=6651 If you want to manage em…

809 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question