Article on RS Forms Authentication - Part II

Here comes the second part. Learn how to implement role-membership and
troubleshoot custom security.
http://www.devx.com/dotnet/Article/27133/0/page/1
--
Hope this helps.
---
Teo Lachev, MVP [SQL Server], MCSD, MCT
Author: "Microsoft Reporting Services in Action"
Publisher website: http://www.manning.com/lachev
Buy it from Amazon.com: http://shrinkster.com/eq
Home page and blog: http://www.prologika.com/
---Hi Teo
I have succesfully implemented the FAuth in my reporting services , but my
problem is I cannot use the rs.exe publishreports.rss script to deploy
reports as it gives the follwoing error: could not connect to
http://ws034/reportserver/reportservice.asmx My understanding is because it
is not passing the sqlauth cokie and hence could not connect this is how I am
calling the script:
rs -i C:\PublishReports.rss -s http://ws034/ReportServer/reportservice.asmx
-u admin -p admin -v filePath="C:\unzipped\11946\Reports" -v
sqlServerName="ws034" -v parentFolder="ScriptUpload"
any assistance would be most appreciated.
thanks in advance
"Teo Lachev [MVP]" wrote:
> Here comes the second part. Learn how to implement role-membership and
> troubleshoot custom security.
> http://www.devx.com/dotnet/Article/27133/0/page/1
> --
> Hope this helps.
> ---
> Teo Lachev, MVP [SQL Server], MCSD, MCT
> Author: "Microsoft Reporting Services in Action"
> Publisher website: http://www.manning.com/lachev
> Buy it from Amazon.com: http://shrinkster.com/eq
> Home page and blog: http://www.prologika.com/
> ---
>
>|||Yes, this stems from the fact that the cookie is not supplied. Remember, you
have to call LogonUser first to get the cookie. You may find my WinForm
sample useful to find out how to maintain and send the cookie from a non-web
client.
http://prologika.com/blog/archive/2004/08/27/169.aspx
--
Hope this helps.
---
Teo Lachev, MVP [SQL Server], MCSD, MCT
Author: "Microsoft Reporting Services in Action"
Publisher website: http://www.manning.com/lachev
Buy it from Amazon.com: http://shrinkster.com/eq
Home page and blog: http://www.prologika.com/
---
"shahab" <shahab@.discussions.microsoft.com> wrote in message
news:88A44FCD-5BD2-494F-BBB5-0E86C95AA36F@.microsoft.com...
> Hi Teo
> I have succesfully implemented the FAuth in my reporting services , but my
> problem is I cannot use the rs.exe publishreports.rss script to deploy
> reports as it gives the follwoing error: could not connect to
> http://ws034/reportserver/reportservice.asmx My understanding is because
> it
> is not passing the sqlauth cokie and hence could not connect this is how I
> am
> calling the script:
> rs -i C:\PublishReports.rss -s
> http://ws034/ReportServer/reportservice.asmx
> -u admin -p admin -v filePath="C:\unzipped\11946\Reports" -v
> sqlServerName="ws034" -v parentFolder="ScriptUpload"
> any assistance would be most appreciated.
> thanks in advance
> "Teo Lachev [MVP]" wrote:
>> Here comes the second part. Learn how to implement role-membership and
>> troubleshoot custom security.
>> http://www.devx.com/dotnet/Article/27133/0/page/1
>> --
>> Hope this helps.
>> ---
>> Teo Lachev, MVP [SQL Server], MCSD, MCT
>> Author: "Microsoft Reporting Services in Action"
>> Publisher website: http://www.manning.com/lachev
>> Buy it from Amazon.com: http://shrinkster.com/eq
>> Home page and blog: http://www.prologika.com/
>> ---
>>|||"Teo Lachev [MVP]" <teo.lachev@.nospam.prologika.com> wrote in
news:eHxxOG7EFHA.2600@.TK2MSFTNGP09.phx.gbl:
> Yes, this stems from the fact that the cookie is not supplied.
> Remember, you have to call LogonUser first to get the cookie. You may
> find my WinForm sample useful to find out how to maintain and send the
> cookie from a non-web client.
> http://prologika.com/blog/archive/2004/08/27/169.aspx
>
I am trying to implement the role-based piece of the security extension in
a web farm environment. I think that I am having my issues because of the
use of "HttpContext.Current.Cache" -- would this be an issue in a web farm?
If so, do you have any alternatives other than to not cache the roles?
Thanks!|||I don't think caching will cause any issues. Basically, if the load balanced
server doesn't find the roles in its cache, it will load them from the data
store. So, you will end up with as many cached instances of the user roles
as the number of servers but this is just a performance optimization
technique and shouldn't be a problem.
That's said though, as the article mentiones, you should be aware of memory
constraints that caching may cause. For example, if you have thousands of
users, you may consider expiring the cache on a regular basis.
--
Hope this helps.
---
Teo Lachev, MVP [SQL Server], MCSD, MCT
Author: "Microsoft Reporting Services in Action"
Publisher website: http://www.manning.com/lachev
Buy it from Amazon.com: http://shrinkster.com/eq
Home page and blog: http://www.prologika.com/
---
"Jason A. Bentley" <jason_a_bentley@.hotmail.com> wrote in message
news:Xns95FF6B0C984EDjasonabentleyhotmail@.207.46.248.16...
> "Teo Lachev [MVP]" <teo.lachev@.nospam.prologika.com> wrote in
> news:eHxxOG7EFHA.2600@.TK2MSFTNGP09.phx.gbl:
>> Yes, this stems from the fact that the cookie is not supplied.
>> Remember, you have to call LogonUser first to get the cookie. You may
>> find my WinForm sample useful to find out how to maintain and send the
>> cookie from a non-web client.
>> http://prologika.com/blog/archive/2004/08/27/169.aspx
> I am trying to implement the role-based piece of the security extension in
> a web farm environment. I think that I am having my issues because of the
> use of "HttpContext.Current.Cache" -- would this be an issue in a web
> farm?
> If so, do you have any alternatives other than to not cache the roles?
> Thanks!|||I should've given more thought on this, Jason.
I forgot the fact that article code implements role caching in LogonUser.
This WILL present an issue with load balancing since LogonUser is called
once during the cookie lifetime and the custom extension will not find the
roles on the second server during user authorization (assuming that
authentication takes place on server one and the user is re-directed and
authorized on server two). So, one workaround is to move role caching to the
CheckOperations helper function in the Authorization extension. Another
workaround of course is to use sticky sessions.
Thanks for bringing this up.
---
Teo Lachev, MVP [SQL Server], MCSD, MCT
Author: "Microsoft Reporting Services in Action"
Publisher website: http://www.manning.com/lachev
Buy it from Amazon.com: http://shrinkster.com/eq
Home page and blog: http://www.prologika.com/
---
"Teo Lachev [MVP]" <teo.lachev@.nospam.prologika.com> wrote in message
news:u1aseJKFFHA.2572@.tk2msftngp13.phx.gbl...
>I don't think caching will cause any issues. Basically, if the load
>balanced server doesn't find the roles in its cache, it will load them from
>the data store. So, you will end up with as many cached instances of the
>user roles as the number of servers but this is just a performance
>optimization technique and shouldn't be a problem.
> That's said though, as the article mentiones, you should be aware of
> memory constraints that caching may cause. For example, if you have
> thousands of users, you may consider expiring the cache on a regular
> basis.
> --
> Hope this helps.
> ---
> Teo Lachev, MVP [SQL Server], MCSD, MCT
> Author: "Microsoft Reporting Services in Action"
> Publisher website: http://www.manning.com/lachev
> Buy it from Amazon.com: http://shrinkster.com/eq
> Home page and blog: http://www.prologika.com/
> ---
> "Jason A. Bentley" <jason_a_bentley@.hotmail.com> wrote in message
> news:Xns95FF6B0C984EDjasonabentleyhotmail@.207.46.248.16...
>> "Teo Lachev [MVP]" <teo.lachev@.nospam.prologika.com> wrote in
>> news:eHxxOG7EFHA.2600@.TK2MSFTNGP09.phx.gbl:
>> Yes, this stems from the fact that the cookie is not supplied.
>> Remember, you have to call LogonUser first to get the cookie. You may
>> find my WinForm sample useful to find out how to maintain and send the
>> cookie from a non-web client.
>> http://prologika.com/blog/archive/2004/08/27/169.aspx
>>
>> I am trying to implement the role-based piece of the security extension
>> in
>> a web farm environment. I think that I am having my issues because of
>> the
>> use of "HttpContext.Current.Cache" -- would this be an issue in a web
>> farm?
>> If so, do you have any alternatives other than to not cache the roles?
>> Thanks!
>|||Teo thanks for your article I have successfully implemented the Forms based
authentication. My biggest problem now is I cannot run any reports that have
ORACLE datasource. It comes with an error that logon failed!
Do you know some workaround. Please any assistance would be most appreciated.
Thanks
============================================"Teo Lachev [MVP]" wrote:
> I should've given more thought on this, Jason.
> I forgot the fact that article code implements role caching in LogonUser.
> This WILL present an issue with load balancing since LogonUser is called
> once during the cookie lifetime and the custom extension will not find the
> roles on the second server during user authorization (assuming that
> authentication takes place on server one and the user is re-directed and
> authorized on server two). So, one workaround is to move role caching to the
> CheckOperations helper function in the Authorization extension. Another
> workaround of course is to use sticky sessions.
> Thanks for bringing this up.
> ---
> Teo Lachev, MVP [SQL Server], MCSD, MCT
> Author: "Microsoft Reporting Services in Action"
> Publisher website: http://www.manning.com/lachev
> Buy it from Amazon.com: http://shrinkster.com/eq
> Home page and blog: http://www.prologika.com/
> ---
> "Teo Lachev [MVP]" <teo.lachev@.nospam.prologika.com> wrote in message
> news:u1aseJKFFHA.2572@.tk2msftngp13.phx.gbl...
> >I don't think caching will cause any issues. Basically, if the load
> >balanced server doesn't find the roles in its cache, it will load them from
> >the data store. So, you will end up with as many cached instances of the
> >user roles as the number of servers but this is just a performance
> >optimization technique and shouldn't be a problem.
> >
> > That's said though, as the article mentiones, you should be aware of
> > memory constraints that caching may cause. For example, if you have
> > thousands of users, you may consider expiring the cache on a regular
> > basis.
> >
> > --
> > Hope this helps.
> >
> > ---
> > Teo Lachev, MVP [SQL Server], MCSD, MCT
> > Author: "Microsoft Reporting Services in Action"
> > Publisher website: http://www.manning.com/lachev
> > Buy it from Amazon.com: http://shrinkster.com/eq
> > Home page and blog: http://www.prologika.com/
> > ---
> >
> > "Jason A. Bentley" <jason_a_bentley@.hotmail.com> wrote in message
> > news:Xns95FF6B0C984EDjasonabentleyhotmail@.207.46.248.16...
> >> "Teo Lachev [MVP]" <teo.lachev@.nospam.prologika.com> wrote in
> >> news:eHxxOG7EFHA.2600@.TK2MSFTNGP09.phx.gbl:
> >>
> >> Yes, this stems from the fact that the cookie is not supplied.
> >> Remember, you have to call LogonUser first to get the cookie. You may
> >> find my WinForm sample useful to find out how to maintain and send the
> >> cookie from a non-web client.
> >>
> >> http://prologika.com/blog/archive/2004/08/27/169.aspx
> >>
> >>
> >> I am trying to implement the role-based piece of the security extension
> >> in
> >> a web farm environment. I think that I am having my issues because of
> >> the
> >> use of "HttpContext.Current.Cache" -- would this be an issue in a web
> >> farm?
> >> If so, do you have any alternatives other than to not cache the roles?
> >>
> >> Thanks!
> >
> >
>
>|||The report data source fails or the LogonUser fails? What kind of
authentication do you use?
--
Hope this helps.
---
Teo Lachev, MVP [SQL Server], MCSD, MCT
Author: "Microsoft Reporting Services in Action"
Publisher website: http://www.manning.com/lachev
Buy it from Amazon.com: http://shrinkster.com/eq
Home page and blog: http://www.prologika.com/
---
"shahab" <shahab@.discussions.microsoft.com> wrote in message
news:5E6A0C29-AB87-4B5E-A788-927A87003CFA@.microsoft.com...
> Teo thanks for your article I have successfully implemented the Forms
> based
> authentication. My biggest problem now is I cannot run any reports that
> have
> ORACLE datasource. It comes with an error that logon failed!
> Do you know some workaround. Please any assistance would be most
> appreciated.
> Thanks
>
> ============================================> "Teo Lachev [MVP]" wrote:
>> I should've given more thought on this, Jason.
>> I forgot the fact that article code implements role caching in LogonUser.
>> This WILL present an issue with load balancing since LogonUser is called
>> once during the cookie lifetime and the custom extension will not find
>> the
>> roles on the second server during user authorization (assuming that
>> authentication takes place on server one and the user is re-directed and
>> authorized on server two). So, one workaround is to move role caching to
>> the
>> CheckOperations helper function in the Authorization extension. Another
>> workaround of course is to use sticky sessions.
>> Thanks for bringing this up.
>> ---
>> Teo Lachev, MVP [SQL Server], MCSD, MCT
>> Author: "Microsoft Reporting Services in Action"
>> Publisher website: http://www.manning.com/lachev
>> Buy it from Amazon.com: http://shrinkster.com/eq
>> Home page and blog: http://www.prologika.com/
>> ---
>> "Teo Lachev [MVP]" <teo.lachev@.nospam.prologika.com> wrote in message
>> news:u1aseJKFFHA.2572@.tk2msftngp13.phx.gbl...
>> >I don't think caching will cause any issues. Basically, if the load
>> >balanced server doesn't find the roles in its cache, it will load them
>> >from
>> >the data store. So, you will end up with as many cached instances of the
>> >user roles as the number of servers but this is just a performance
>> >optimization technique and shouldn't be a problem.
>> >
>> > That's said though, as the article mentiones, you should be aware of
>> > memory constraints that caching may cause. For example, if you have
>> > thousands of users, you may consider expiring the cache on a regular
>> > basis.
>> >
>> > --
>> > Hope this helps.
>> >
>> > ---
>> > Teo Lachev, MVP [SQL Server], MCSD, MCT
>> > Author: "Microsoft Reporting Services in Action"
>> > Publisher website: http://www.manning.com/lachev
>> > Buy it from Amazon.com: http://shrinkster.com/eq
>> > Home page and blog: http://www.prologika.com/
>> > ---
>> >
>> > "Jason A. Bentley" <jason_a_bentley@.hotmail.com> wrote in message
>> > news:Xns95FF6B0C984EDjasonabentleyhotmail@.207.46.248.16...
>> >> "Teo Lachev [MVP]" <teo.lachev@.nospam.prologika.com> wrote in
>> >> news:eHxxOG7EFHA.2600@.TK2MSFTNGP09.phx.gbl:
>> >>
>> >> Yes, this stems from the fact that the cookie is not supplied.
>> >> Remember, you have to call LogonUser first to get the cookie. You may
>> >> find my WinForm sample useful to find out how to maintain and send
>> >> the
>> >> cookie from a non-web client.
>> >>
>> >> http://prologika.com/blog/archive/2004/08/27/169.aspx
>> >>
>> >>
>> >> I am trying to implement the role-based piece of the security
>> >> extension
>> >> in
>> >> a web farm environment. I think that I am having my issues because of
>> >> the
>> >> use of "HttpContext.Current.Cache" -- would this be an issue in a web
>> >> farm?
>> >> If so, do you have any alternatives other than to not cache the roles?
>> >>
>> >> Thanks!
>> >
>> >
>>|||thanks for your time. I managed to get it working, what I did was that I
uninstalled RS ,uninstalled the Oracle 9.1 client and then reinstalled Oracle
client and RS respectively. for some reason the RS was not identifying the
existence of Oracle on my machine maybe I installed Oracle client after the
RS was installed.
"Teo Lachev [MVP]" wrote:
> The report data source fails or the LogonUser fails? What kind of
> authentication do you use?
> --
> Hope this helps.
> ---
> Teo Lachev, MVP [SQL Server], MCSD, MCT
> Author: "Microsoft Reporting Services in Action"
> Publisher website: http://www.manning.com/lachev
> Buy it from Amazon.com: http://shrinkster.com/eq
> Home page and blog: http://www.prologika.com/
> ---
> "shahab" <shahab@.discussions.microsoft.com> wrote in message
> news:5E6A0C29-AB87-4B5E-A788-927A87003CFA@.microsoft.com...
> > Teo thanks for your article I have successfully implemented the Forms
> > based
> > authentication. My biggest problem now is I cannot run any reports that
> > have
> > ORACLE datasource. It comes with an error that logon failed!
> > Do you know some workaround. Please any assistance would be most
> > appreciated.
> > Thanks
> >
> >
> > ============================================> > "Teo Lachev [MVP]" wrote:
> >
> >> I should've given more thought on this, Jason.
> >>
> >> I forgot the fact that article code implements role caching in LogonUser.
> >> This WILL present an issue with load balancing since LogonUser is called
> >> once during the cookie lifetime and the custom extension will not find
> >> the
> >> roles on the second server during user authorization (assuming that
> >> authentication takes place on server one and the user is re-directed and
> >> authorized on server two). So, one workaround is to move role caching to
> >> the
> >> CheckOperations helper function in the Authorization extension. Another
> >> workaround of course is to use sticky sessions.
> >>
> >> Thanks for bringing this up.
> >>
> >> ---
> >> Teo Lachev, MVP [SQL Server], MCSD, MCT
> >> Author: "Microsoft Reporting Services in Action"
> >> Publisher website: http://www.manning.com/lachev
> >> Buy it from Amazon.com: http://shrinkster.com/eq
> >> Home page and blog: http://www.prologika.com/
> >> ---
> >>
> >> "Teo Lachev [MVP]" <teo.lachev@.nospam.prologika.com> wrote in message
> >> news:u1aseJKFFHA.2572@.tk2msftngp13.phx.gbl...
> >> >I don't think caching will cause any issues. Basically, if the load
> >> >balanced server doesn't find the roles in its cache, it will load them
> >> >from
> >> >the data store. So, you will end up with as many cached instances of the
> >> >user roles as the number of servers but this is just a performance
> >> >optimization technique and shouldn't be a problem.
> >> >
> >> > That's said though, as the article mentiones, you should be aware of
> >> > memory constraints that caching may cause. For example, if you have
> >> > thousands of users, you may consider expiring the cache on a regular
> >> > basis.
> >> >
> >> > --
> >> > Hope this helps.
> >> >
> >> > ---
> >> > Teo Lachev, MVP [SQL Server], MCSD, MCT
> >> > Author: "Microsoft Reporting Services in Action"
> >> > Publisher website: http://www.manning.com/lachev
> >> > Buy it from Amazon.com: http://shrinkster.com/eq
> >> > Home page and blog: http://www.prologika.com/
> >> > ---
> >> >
> >> > "Jason A. Bentley" <jason_a_bentley@.hotmail.com> wrote in message
> >> > news:Xns95FF6B0C984EDjasonabentleyhotmail@.207.46.248.16...
> >> >> "Teo Lachev [MVP]" <teo.lachev@.nospam.prologika.com> wrote in
> >> >> news:eHxxOG7EFHA.2600@.TK2MSFTNGP09.phx.gbl:
> >> >>
> >> >> Yes, this stems from the fact that the cookie is not supplied.
> >> >> Remember, you have to call LogonUser first to get the cookie. You may
> >> >> find my WinForm sample useful to find out how to maintain and send
> >> >> the
> >> >> cookie from a non-web client.
> >> >>
> >> >> http://prologika.com/blog/archive/2004/08/27/169.aspx
> >> >>
> >> >>
> >> >> I am trying to implement the role-based piece of the security
> >> >> extension
> >> >> in
> >> >> a web farm environment. I think that I am having my issues because of
> >> >> the
> >> >> use of "HttpContext.Current.Cache" -- would this be an issue in a web
> >> >> farm?
> >> >> If so, do you have any alternatives other than to not cache the roles?
> >> >>
> >> >> Thanks!
> >> >
> >> >
> >>
> >>
> >>
>
>