locked
Accessing SSRS web services on remote computer RRS feed

  • Question

  • I am trying to use Management APIs of SQL Server 2014 reporting services installed on the remote computer on the same domain. Here is some code:

            ReportingService2010 rs = new ReportingService2010();
            rs.Credentials = System.Net.CredentialCache.DefaultCredentials;
    
            CatalogItem[] items = null;
    
            // Retrieve a list of all items from the report server database. 
            try
            {
                items = rs.ListChildren(ItemPath, true);
            }
    
            catch (SoapException e)
            {
                Console.WriteLine(e.Detail.OuterXml);
            }
    

    I am getting the following error: The permissions granted to user 'domainname\machinename$' are insufficient for performing this operation

    I have granted domainname\machinename$ account with Administrator role in SSRS. Did not help.

    Does machinename$ need to be configured in AD somewhat specially to make it work?

    Thanks

    Saturday, September 24, 2016 9:39 AM

Answers

  • Your account does not need read permissions to the database. When you make an API call the API service will make the call to the database and call the stored procs or views or whatever to make the API call work. I do this all the time without these permissions using PowerShell.

    My question would be, how is your environment configured? That is to say, is the computer you are trying to connect to the SSRS server with on the same domain?...

    What really matters in this case is the how the code being executed is authenticating to the server. It looks like you are writing some C# code. How are you executing the code? When you execute the code whatever account that is running the code will do the authentication. So if you you are trying to build a website and you're trying to execute the code by clicking a link through IIS, the service account running IIS will authenticate. I bet you have the network service account or local service account setup to run your app pool for this website and thus the error message.

    If you truly want to use the machine account, then you two options... option 1 is to go to the root/home folder (the landing page when you login to SSRS "/reports") and add this account as a "content manager" (even though it might be overkill if all you are doing is viewing). when you do this you have to ensure they if/when you break inheritance on any subfolder/report you ensure this account remains as having permissions. Option 2 would be to make it an administrator of the server (admin group in windows os). technically this gives you permissions to everything and no amount of removing inheritance will stop you from viewing anything.  I'm not a big fan of option 2.

    Ideally you setup a domain service account that runs your web application pool and go with option 1 above.

    Monday, September 26, 2016 1:46 PM

All replies

  • Hi markgoldin,

    According to your description, you would like to use Management APIs of SQL Server 2014 Reporting Services to read the contents of the ItemPath of the report server directory tree by ListChildren method, right?

    Generally, if you want to use the method to return child items, you should has permission to view the items firstly. But from your error, it seems you don’t have permission to view the Item on the Report Server.

    So, you’d better make sure you have permission to view the items by checking permissions on System-Level Permission and Item-Level Permission.

    If you still have any questions, please feel free to ask.

    Best Regards,
    Pirlo Zhang

    Monday, September 26, 2016 3:10 AM
  • <I have granted domainname\machinename$ account with Administrator role in SSRS. 

    Is that not enough?

    Monday, September 26, 2016 9:11 AM
  • Try reviewing permissions on "reportserver" database.
    Monday, September 26, 2016 9:17 AM
  • Can you explain?

    Are you saying I need to add domainname\machinename$ to the report database?

    Thanks

    Monday, September 26, 2016 9:24 AM
  • I have reports that show the catalog items and folder, user permissions, etc. retrieved via SQL and embedded in RDL. The query needs to execute on "reportserver" database. Hence, we have to create another datasource pointing to this database and give read permissions to excute select statement. I'm "guessing" you might be running into similar issue. 

    Try connecting to "reportserver" database in sql management studio and see if you can access it. 

    Monday, September 26, 2016 9:49 AM
  • Your account does not need read permissions to the database. When you make an API call the API service will make the call to the database and call the stored procs or views or whatever to make the API call work. I do this all the time without these permissions using PowerShell.

    My question would be, how is your environment configured? That is to say, is the computer you are trying to connect to the SSRS server with on the same domain?...

    What really matters in this case is the how the code being executed is authenticating to the server. It looks like you are writing some C# code. How are you executing the code? When you execute the code whatever account that is running the code will do the authentication. So if you you are trying to build a website and you're trying to execute the code by clicking a link through IIS, the service account running IIS will authenticate. I bet you have the network service account or local service account setup to run your app pool for this website and thus the error message.

    If you truly want to use the machine account, then you two options... option 1 is to go to the root/home folder (the landing page when you login to SSRS "/reports") and add this account as a "content manager" (even though it might be overkill if all you are doing is viewing). when you do this you have to ensure they if/when you break inheritance on any subfolder/report you ensure this account remains as having permissions. Option 2 would be to make it an administrator of the server (admin group in windows os). technically this gives you permissions to everything and no amount of removing inheritance will stop you from viewing anything.  I'm not a big fan of option 2.

    Ideally you setup a domain service account that runs your web application pool and go with option 1 above.

    Monday, September 26, 2016 1:46 PM