locked
Report Builder 3.0: Can you clear saved user credentials? RRS feed

  • Question

  • If a user checks Remember my Password in the Connect to Report Server dialog box when logging into Report Builder, is there a way to clear out those credentials?

    We are launching Report Builder 3.0 from SSRS using ClickOnce, and we have a security concern. Since RB credentials are stored per windows user, if someone saves credentials, another person could log into SSRS in the browser, launch Report Builder, and be logged in using the saved credentials as the other user. 

    I'd like to know how to clear the credentials if they are saved.  I've tried deleting the local app cache (C:\Users\<UserName>\AppData\Local\Apps\2.0), but that doesn't work.  It causes ClickOnce to reinstall Report Builder, but the credentials are still saved.

    Thanks for any help.
    Bob

    Wednesday, February 23, 2011 1:25 PM

Answers

  • I know this is an old post, but for the benefits of others looking up the search engine and reached here. (this is the first search result returned...)

    The above solution for clearing Recent Documents did not work for me.

     

    The solution I figured on my own...The configurations are stored in the local user application folder.

    Navigate to this file: C:\Users\<your user name>\AppData\Local\Microsoft\Report Builder\10.50.0.0\user.config

    The version may vary. If you are not able to find the folder, just go to: "C:\Users\<your user name>\AppData\Local" and hit search "Report Builder"

     

    Navigate to the node: <setting name="RecentServers" serializeAs="Xml">

    locate the <RecentItem> node and remove the credential attributes from the server you want to remove the credentials for.

     

    Hope this helps

    • Marked as answer by Challen Fu Tuesday, January 31, 2012 4:28 AM
    Tuesday, January 31, 2012 3:40 AM
  • I finally found the solution here http://social.msdn.microsoft.com/Forums/en-US/sqlreportingservices/thread/b54b767d-70fd-42c5-995b-87a94c7e796d

    It works for Report Builder 3 as well as v2. You just have to click the 'Clear all recent item lists' button on the options page in Report Builder.

    You may have to close/restart Report Builder to get the effects to kick in.

    • Proposed as answer by Dean_OC Tuesday, April 19, 2011 8:51 PM
    • Edited by Dean_OC Wednesday, April 20, 2011 10:53 PM formatting
    • Marked as answer by Challen Fu Monday, May 2, 2011 5:32 AM
    Tuesday, April 19, 2011 8:51 PM

All replies

  • Hi Bob,

    Actually, you could give some users special permission role except opening the report via report builder, then these users could not open the report via report builder. For more information about How to: Create, Delete, or Modify a Role (Management Studio), please see: http://msdn.microsoft.com/en-us/library/ms156293.aspx 

    Thanks,
    Challen Fu


    Challen Fu [MSFT]
    MSDN Community Support | Feedback to us
    Get or Request Code Sample from Microsoft
    Please remember to mark the replies as answers if they help and unmark them if they provide no help.

    Tuesday, March 1, 2011 11:45 AM
  • I am not sure I understand your suggestion. Are you suggesting that we do not grant the "Report Builder" role in Reporting Services to hide the Report Builder button, to prevent users from being able to launch Report Builder? That doesn't solve the problem, but it would limit the number of people who might encounter the issue.

    As I've dug into the issue, I am less worried about the risk, but it is still a risk.

    For example, say user "Joe" saves his credentials in Report Builder on his computer, then user "Jane" accesses Joe's computer on his Windows login. If she logs into Reporting Services using her own credentials and launches Report Builder, she will not be promtped to enter her credentials and she will automatically be logged into Report Builder as Joe. That means Jane will be able to run and manage reports as Joe, with his data access.

    Your suggestion to limit the use of the "Report Builder" role in Reporting Services doesn't solve this issue. Granted, if our users have the situation where they are sharing Windows logins, or Joe's computer is left logged in and unattended, then they have bigger  security issues.

    Right now I am most interested in finding out how to clear the cached credentials.  I am trying to find out now how to clear the user cache, so that when this happens, we can delete the saved credentials. 

    Thanks,
    Bob 

    Tuesday, March 1, 2011 1:29 PM
  • Hi, I have the same issue but for a different reason. We have a security model in place so that different logins only get to see "their" data even though they use the same datasource. We use basic authentication and users are prompted to enter username and password. As an administrator, I need to be able to test that multiple logins are working. Unfortunately, I selected the "remember password" and now I no longer get the login prompt and cannot change logins. Does someone know how to clear this information? I tried uninstalling/reinstalling Report Builder but it still remembers.(proving that it has an elephantine memory!) Thanks, Dean.
    Tuesday, April 19, 2011 4:20 AM
  • I finally found the solution here http://social.msdn.microsoft.com/Forums/en-US/sqlreportingservices/thread/b54b767d-70fd-42c5-995b-87a94c7e796d

    It works for Report Builder 3 as well as v2. You just have to click the 'Clear all recent item lists' button on the options page in Report Builder.

    You may have to close/restart Report Builder to get the effects to kick in.

    • Proposed as answer by Dean_OC Tuesday, April 19, 2011 8:51 PM
    • Edited by Dean_OC Wednesday, April 20, 2011 10:53 PM formatting
    • Marked as answer by Challen Fu Monday, May 2, 2011 5:32 AM
    Tuesday, April 19, 2011 8:51 PM
  • I know this is an old post, but for the benefits of others looking up the search engine and reached here. (this is the first search result returned...)

    The above solution for clearing Recent Documents did not work for me.

     

    The solution I figured on my own...The configurations are stored in the local user application folder.

    Navigate to this file: C:\Users\<your user name>\AppData\Local\Microsoft\Report Builder\10.50.0.0\user.config

    The version may vary. If you are not able to find the folder, just go to: "C:\Users\<your user name>\AppData\Local" and hit search "Report Builder"

     

    Navigate to the node: <setting name="RecentServers" serializeAs="Xml">

    locate the <RecentItem> node and remove the credential attributes from the server you want to remove the credentials for.

     

    Hope this helps

    • Marked as answer by Challen Fu Tuesday, January 31, 2012 4:28 AM
    Tuesday, January 31, 2012 3:40 AM
  • This was a great help.

    The only thing I would add is that removing the credential attributes or simply removing the Username and Password elements did not work for me.

    I had to replace the Username and Password elements with the correct values, I.E my actual Username and Password. When I then reopened report builder/ran a report, I was prompted for my credentials.

    This in turn created a new, corrected, node with an encrypted Username and Password 

    Thanks for you help.

    Thursday, January 28, 2016 1:33 PM
  • This does not work.
    Friday, April 22, 2016 9:18 AM
  • Neither does this.
    Friday, April 22, 2016 9:18 AM