Problem while deploying Report on server

Question

Deploying to http://localhost/ReportServer

Deploying data source '/Report Project1/cnt_SDS_REQUEST'.

The Report Server Web Service is unable to access secure information in the report server. Please verify that the WebServiceAccount is specified correctly in the report server config file.

Answer 1

Are you reusing an existing report server database?

You get this error when the report server does not have access to the symmetric key that we use to protect sensitive data in the report server.

After a default installation, you should have access.  If you chose to "install but not configure", then sometimes you need to manually restart the report server windows service for the initialization to occur.

If you are reusing an existing report server database, or are deploying in a scale-out configuration, you want to do use the report server configuration tool to initialize the report server.   To do this, connect to a report server that is already initialized, go to the Initialization pane of the reporting services configuration tool, select the non-initialized instance, and press Initialize.

If you are reusing an exisitng report server database, but do not have another report server that is already initialized (it was uninstalled, you're restoring from backup, etc.), you will need to use the backup of your symmetric key (restore on the the Encryption Keys tab in the reporting servcies configuration tool).

If you don't have backed up symmetric key you'll need to delete encrypted content.  Then you your report server should initialize itself after you restart your rpeort server windows service.

Hope that's simple enough :-).

-Lukasz

Answer 2

I have just installed the lastest version of "Microsoft SQL Server 2005 CTP" and anytime I try to reach the ReportServer website, I get the following error message:

Reporting Services Error

---

• The Report Server Web Service is unable to access secure information in the report server. Please verify that the WebServiceAccount is specified correctly in the report server config file. (rsAccessDeniedToSecureData) Get Online Help

I can connect to the database using the configuration tool and it works.  I changed the Windows Service Identifty to match the entry in the rsReportServer.config file to match the following information:

<WebServiceAccount>NT Authority\NetworkService</WebServiceAccount>

It still doesn't allow content to be displayed.  Any help is apprecited as I continue to dig through all the online documentation.

Thanks,

Matt

Answer 3

Solution to this problem is

1) Open Configure Report Server Tool
2) Update 'Web Service Identity' tab to reflect Asp .Net account on the machine.
For Eg. machineName\ASPNET
3) Click Apply Button, This will update WebServiceAccount tag in your report server configuration file 'rsreportserver.config'.

Hope this helps.

Thanks,

Answer 4

how do you delete it by command line? Do you type it at the "run" line?

Answer 5

There is no command line for this functionality.  We provide a WMI interface you can call directly to perform the same actions as are undertaken by the configuraiton tool.   You can find the reference to the WMI methods here:

http://msdn2.microsoft.com/en-us/library/ms152836(en-US,SQL.90).aspx

-Lukasz

---
This posting is provided "AS IS" with no warranties, and confers no rights.

Answer 6

 

When I try to update the Web Service Identity field, it is greyed out and does not allow updates. Currently set to "NT Authority\Network Service"

Answer 7

I am in the same situation as well.  I'm not allowed to change the WebServiceAccount through the interface, it's disabled.  Also when I change it manually through the rsreportserver.config file to something other than it's current setting, the "Web Service Identity" won't initialize until I change it back to 'NT Authority\NetworkService'.  I've removed the Encryption Keys even though there shouldn't be any yet as it's a fresh install of Reporting Services.

When I attempt to deploy a Report to the Report Server, I get the following error:

"The Report Server Web Service is unable to access information in the report server.  Please verify that the WebServiceAccount is specified correctly in the report server config file."

What are the next several items we should check?

Answer 8

Hi,

What OS are you on?

If you're using RS on windows XP the identity that the Report server web service runs as is the identity of ASP.Net as set in ProcessModel element in the machine.config file.  If you change it there, you should be able to click the apply button in the configuration tool. (This also applies to Windows 2000 Server)

If you're on Windows Windows Server 2003, you can create a new application pool with the new identity you want.  Use the "New..." button on the web service identity tab to create it.

The WebServiceAccount property in the rsreportserver.config file does not actually set the web service to run as that account.  Rather it needs to contain the name of the account the web service is configured to run as, if this identity is different from ASP.Net machine account on XP, W2K, or Network Service on W2K3.

Hope that helps,

-Lukasz

 

Answer 9

I found the issue(s)  First off, there were 2 application pools created by our Network Admin that were both configured for the same virtual Directory.  This was causing me issues with the deploying issue.  Second, They were both configured for either LocalSystem or NetworkService which would always tell me that I didn't have access to execute them.  Once I stopped one of the 2 application pools and ensured that the Web service Identity matched the application pools security that was still running, then I could both deploy and execute.  Thanks for the direction.

Answer 10

Hi - I am still having issues deploying.

WinXP

SQL2005

IIS5

The Report Server Web Service is unable to access secure information in the report server. Please verify that the WebServiceAccount is specified correctly in the report server config file. (rsAccessDeniedToSecureData) Get Online Help

Issues with both reportserver and reportmanager.

Any ideas?

thanks.

vani

 

Answer 11

This is a different issue:

The Report Server Web Service is unable to access secure information in the report server. Please verify that the WebServiceAccount is specified correctly in the report server config file. (rsAccessDeniedToSecureData

This error means the web service account as specified in the (for Windows XP or Windows 2000) Machine.config file in the <ProcessModel> element is not the same as the account specified in the <WebServiceAccount> element in the rsreportserver.config file.  If the account specified by the <ProcessModel> is the ASP.NET account, then the value of <WebServiceAccount> can be blank.  If it is something else, then you can either use the reporting services configuration tool to set the web service identity, or you can manually edit the <WebServiceAccount> element in the rsreportserver.config file. The account name must be in domain\alias format.

Just for completeness, on Windows Server 2003 and Vista, the web service identity depends on the application pool identity that is configured for the report server virtual directory.  The default application pool identity is Network Service.  In this case the <WebServiceAccount> element can be blank.  If the application pool identity is another account, you'll need to ensure the WebServiceAccount element is set to that identity.

Hope that helps,

-Lukasz

Answer 12

I have changed this in reportserver's rsreportserver file to reflect

<WebServiceAccount><machine_name>\ASPNET</WebServiceAccount>

another confusing part - looks like we cannot use localhost but rather need to use the computer_name to run reports?

Also - being new to 2.0 framework - for some reason it seems to be adding the port number to run file like -http://localhost:2794/ReportServer/Pages/ReportViewer.aspx

Thanks.

Vani

Answer 13

The port number is determined by the website you chose in IIS.  If you're not using the default web site, or have customized it to run on a different port, you need to specify the port explicitly.

-Lukasz

 

Answer 14

Dear Lukasz,

your post was very helpfull, but I've a very strange bug. If I try to open a report all work fine. But if I click on a record (that should open a new sub-report) I've this: Not sufficient rights for the NT Authority\NetworkService account to complete this operation

If I try to do the same thing using then Report Builder all work fine.

What about?

Thanks in advance

Answer 15

Hmm - this sounds unrelated to this thread.

The report that you're drilling thourgh to - is it an auto generated click through report, or a custom click through report?

Are you using the same user account when accessing the report in report builder and in the other case?   What tool are you using to make the second access?

-Lukasz

Answer 16

yes, it's an auto generated click through report.

And, no, I'm not using  the same account. In report builder I use an administrator account. When I browse the report through the IE I use ASPNET account.

When I've published my Web page, I can see my report without problems . Only by clicking on a element I receive that protection error.

??

 

Answer 17

I am experiencing "The Report Server Web Service is unable to access secure information in the report server.  Please verify that the WebServiceAccount is specified correctly in the report server config file." I've tried various suggestions in this thread without success so far.

There are various references in this thread to applications pools. I run IIS6 in IIS5 isolation mode which is a requirement for an ISAPI plug-in I run. Therefore, if I understand correctly, I am not using application pools. It is possible to use SQL Server 2005 Report Server with IIS 6 in IIS5 isolation mode?

 

Answer 18

Did you try the suggestion from the post earlier on this thread regarding the ASP.Net account under the ASP.Net processmodel element?  Does that solve your problem?

Yes - we do support running RS on IIS6 in IIS5 compatibility mode.

-Lukasz 

Answer 19

Much as I appreciate your answer it doesn't help.  I am still getting the error.  I have created a domain account (SQLService).  It is a member of the local administrators group.  I created a login and a user in the report databases.  It is a member of the rsexecrole in both databases.  I created a pool in the Web Service Identity page for both Report Server and Report manager that uses this account.  I have verified that in the rsreportserver.config file that the webserviceaccount tag points to this account (domain\sqlservice).  The following services are running under this account:  SQL Server, SQL Server Agent, and SQL Server Reporting Service.  IIS services are all running under the Local System account.  ASP.NET State Service is set as manual and is not running(will use Network Service if started).  I have verified that the pool is listed in the IIS manager for the two virtual directories.

 

Now, as far as I can this thing should work.  All services have been restarted.  What am I missing?

 

Dave

Answer 20

Mordock wrote:

Much as I appreciate your answer it doesn't help.  I am still getting the error.  I have created a domain account (SQLService).  It is a member of the local administrators group.  I created a login and a user in the report databases.  It is a member of the rsexecrole in both databases.  I created a pool in the Web Service Identity page for both Report Server and Report manager that uses this account.  I have verified that in the rsreportserver.config file that the webserviceaccount tag points to this account (domain\sqlservice).  The following services are running under this account:  SQL Server, SQL Server Agent, and SQL Server Reporting Service.  IIS services are all running under the Local System account.  ASP.NET State Service is set as manual and is not running(will use Network Service if started).  I have verified that the pool is listed in the IIS manager for the two virtual directories.   Now, as far as I can this thing should work.  All services have been restarted.  What am I missing?   Dave

 

Were you ever able to resolve this.. sounds like you did the same as me.. with the sqlservice account name to a tee.

 

I either get that error or an rsreportserver config error depending on what combo of settings i use.

 

I finally was able to get it to at least let me click on reporting services server defaults link in central management.. but i'm getting the error from this thread now (i also specified the sqlservice account in that one spot in the config file)..

 

I think putting it in the config file is what led to being able to actually see the page for server defaults, except that i have that error at the top:

The Report Server Web Service is unable to access secure information in the report server. Please verify that the WebServiceAccount is specified correctly in the report server config file. ---> The Report Server Web Service is unable to access secure information in the report server. Please verify that the WebServiceAccount is specified correctly in the report server config file.

 

Thanks

 

Answer 21

 

I think things are finally working... though if i browse to http://server/reportserver$portal.. all i get is a directory listing.. is this normal?

 

I can now access the server defaults in central management.

 

I started over.. deleted the existing report server database.. hit the apply default settings on the report services management console..

 

 

I also changed the default value in the config file below from network service to this:

"C:\Program Files\Microsoft SQL Server\MSSQL.14\Reporting Services\ReportServer\rsreportserver.config"

<WebServiceAccount>domain\sqlservice</WebServiceAccount>

In the reporting services config manager.. windows service identity, I set this to the sqlservice account (domain admin account)

 

In the database connection area.. I set it to service credentials:

 

 

 

Any thoughts as to whether i should just be seeing a directory listing when i browse to the report page or not?

 

Shouldnt this add some sort of reporting listing ability in sharepoint?

 

Thanks

Answer 22

Looks like you got it right.  The report server virtual directory works like you mention - it simply shows you a list of reports you can navigate and view. 

 

If you're looking to deploy in SharePoint Integrated mode, check out the whitepaper here:

http://technet.microsoft.com/en-us/library/cc288006.aspx

 

Thanks,

-Lukasz

 

Answer 23

Ah, finally. thanks for your post. reporting services now working for me.

Answer 24

After reading this thread and looking at others the solution was simple but did not see it clearly stated.

1.  Check the appPool(s) identity that the reports application and the reportserver application run under.
2.  Open rsreportserver.config
3.  change <WebServiceAccount></WebServiceAccount> to the id discovered in #1
4.  Go to  http://<server>/reportserver (if that is where your reports server is installed) and the directory listing should now appear

Now you can proceed.  I needed this for the Microsoft Dynamics CRM Server install.

Hope this helps.