IUSR_Machine account permissions in Report Builder

We have an ASP.NET application using Forms authentication which
launches the Report Builder via an HTML link with the href set to:
ReportServer/ReportBuilder/ReportBuilder.application
This will launch Report Builder and allow users to create, modify, and
save reports. But when the user tries to run the report, the above
error message comes up. Just for testing purposes, I tried adding the
IUSR account to the Administrators group but still with the same
result. It seems that everything we try still leads us to the
following error message:
The permissions granted to user '<domain>\IUSR_<machine>' are
insufficient for performing this operation. (rsAccessDenied)
After days of searching for a resolution to this I'm still unsure
about how to fix it. If anyone could give some advice or maybe provide
a link that explains how to resolve the situation we would be sincerely
grateful.
Thanks in advance!I'm encountering the same problem. Launching Report Builder from the
URL and authenticating the forms user, I can create a report and
save/deploy to the server but can't view it through Report Builder.
Also, Report Builder icon doesn't display in Report Manager when using
forms authentication for any user other than the default admin user.
I'll be writing an ASP.NET app to launch and deploy Report Builder but
it would be nice to have the icon in Report Manager
Chris wrote:
> We have an ASP.NET application using Forms authentication which
> launches the Report Builder via an HTML link with the href set to:
> ReportServer/ReportBuilder/ReportBuilder.application
> This will launch Report Builder and allow users to create, modify, and
> save reports. But when the user tries to run the report, the above
> error message comes up. Just for testing purposes, I tried adding the
> IUSR account to the Administrators group but still with the same
> result. It seems that everything we try still leads us to the
> following error message:
> The permissions granted to user '<domain>\IUSR_<machine>' are
> insufficient for performing this operation. (rsAccessDenied)
> After days of searching for a resolution to this I'm still unsure
> about how to fix it. If anyone could give some advice or maybe provide
> a link that explains how to resolve the situation we would be sincerely
> grateful.
> Thanks in advance!|||So have you had any luck with any kind of work-around? It's driving me
crazy and I have a client very anxious to start using it.
Chris
si.downes@.gmail.com wrote:
> I'm encountering the same problem. Launching Report Builder from the
> URL and authenticating the forms user, I can create a report and
> save/deploy to the server but can't view it through Report Builder.
> Also, Report Builder icon doesn't display in Report Manager when using
> forms authentication for any user other than the default admin user.
> I'll be writing an ASP.NET app to launch and deploy Report Builder but
> it would be nice to have the icon in Report Manager
> Chris wrote:
> > We have an ASP.NET application using Forms authentication which
> > launches the Report Builder via an HTML link with the href set to:
> >
> > ReportServer/ReportBuilder/ReportBuilder.application
> >
> > This will launch Report Builder and allow users to create, modify, and
> > save reports. But when the user tries to run the report, the above
> > error message comes up. Just for testing purposes, I tried adding the
> > IUSR account to the Administrators group but still with the same
> > result. It seems that everything we try still leads us to the
> > following error message:
> >
> > The permissions granted to user '<domain>\IUSR_<machine>' are
> > insufficient for performing this operation. (rsAccessDenied)
> >
> > After days of searching for a resolution to this I'm still unsure
> > about how to fix it. If anyone could give some advice or maybe provide
> > a link that explains how to resolve the situation we would be sincerely
> > grateful.
> >
> > Thanks in advance!|||Still no solution!!
Noticed in your error message the failure is for a domain user
<domain>\IUSR_.. mine is for the name of the forms user I have
created in the UserAccounts database. Under IIS I have reportBuilder
running with Anonymous Authentication as user IUSR_
It's starting to drive me mad too, this needs to be integrated into a
product for the end of the month.
Si
Chris wrote:
> So have you had any luck with any kind of work-around? It's driving me
> crazy and I have a client very anxious to start using it.
> Chris
>
> si.downes@.gmail.com wrote:
> > I'm encountering the same problem. Launching Report Builder from the
> > URL and authenticating the forms user, I can create a report and
> > save/deploy to the server but can't view it through Report Builder.
> >
> > Also, Report Builder icon doesn't display in Report Manager when using
> > forms authentication for any user other than the default admin user.
> > I'll be writing an ASP.NET app to launch and deploy Report Builder but
> > it would be nice to have the icon in Report Manager
> >
> > Chris wrote:
> > > We have an ASP.NET application using Forms authentication which
> > > launches the Report Builder via an HTML link with the href set to:
> > >
> > > ReportServer/ReportBuilder/ReportBuilder.application
> > >
> > > This will launch Report Builder and allow users to create, modify, and
> > > save reports. But when the user tries to run the report, the above
> > > error message comes up. Just for testing purposes, I tried adding the
> > > IUSR account to the Administrators group but still with the same
> > > result. It seems that everything we try still leads us to the
> > > following error message:
> > >
> > > The permissions granted to user '<domain>\IUSR_<machine>' are
> > > insufficient for performing this operation. (rsAccessDenied)
> > >
> > > After days of searching for a resolution to this I'm still unsure
> > > about how to fix it. If anyone could give some advice or maybe provide
> > > a link that explains how to resolve the situation we would be sincerely
> > > grateful.
> > >
> > > Thanks in advance!|||To create a user/group that can log into Report Manager and do
everything, create the user/group, then do the following:
1. Log into Report Manager as the admin user (or whatever name you gave
to the admin user).
2. Click "Site Settings" in the top-right corner
3. Under Security, click "Configure Item-level role definitions"
4. Name the Role and assign it to all of the tasks (click OK when done)
5. Click on "Site Settings" again
6. Under Security, click "Configure system-level role definitions"
7. Click "New Role"
8. Name the Role and assign it to all of the tasks (click OK when done)
9. Click "Site Settings"
10. Click "Configure Site-wide security"
11. If your user/group is already listed, click "Edit" next to it,
otherwise click "New Role Assignment" then type in your user/group name
on the next screen
12. Select the checkbox next to the system role you created in steps
6-8 (click Apply when done)
13. Click "Home" in the top-right corner
14. Click on the blue "Properties" tab
15. If your user/group is listed, click "Edit" next to it, otherwise
click "New Role Assignment" and type in your user/group name on the
next screen
16. Select the checkbox next to the role you created in steps 3-4
(click Apply when done).
17. Click Home. The end.
There are two different types of roles: item-level roles and
system-level roles. My guess would be that something was missing from
your list of 'tasks' in the item-level roles assigned to the
group/user. If you follow these instructions, you should end up with a
user/group that can do everything. This should help you determine if
it's a matter of permissions settings or something wonky with your
server setup. FYI, I would recommend against giving your users full
control over everything as described here.
I hope this helps.
Tim Larson

Issue with launching Report Builder from client PC's

Hi,

I got a working installation of reporting services 2005 up and running, Im able to create models and launch the Report Builder on the machine on which the server is installed, however if I try and run it from another machine on the network I get an error and Im able to view the following exception.

Following errors were detected during this operation.
* [04 Jul 2005 10:39:34 +01:00] System.Deployment.Application.DeploymentDownloadException (Unknown subtype)
- Failed while downloading http://testserver/ReportServer/ReportBuilder/ReportBuilder.application
- Source: System.Deployment
- Stack trace:
at System.Deployment.Application.SystemNetDownloader.DownloadSingleFile(DownloadQueueItem next)
at System.Deployment.Application.SystemNetDownloader.DownloadAllFiles()
at System.Deployment.Application.FileDownloader.Download(SubscriptionState subState)
at System.Deployment.Application.DownloadManager.DownloadManifest(Uri& sourceUri, String targetPath, IDownloadNotification notification, DownloadOptions options, ManifestType manifestType, ServerInformation& serverInformation)
at System.Deployment.Application.DownloadManager.DownloadDeploymentManifestDirect(SubscriptionStore subStore, Uri& sourceUri, TempFile& tempFile, IDownloadNotification notification, DownloadOptions options, ServerInformation& serverInformation)
at System.Deployment.Application.DownloadManager.DownloadDeploymentManifest(SubscriptionStore subStore, Uri& sourceUri, TempFile& tempFile, IDownloadNotification notification, DownloadOptions options)
at System.Deployment.Application.ApplicationActivator.PerformDeploymentActivation(Uri activationUri, Boolean isShortcut)
at System.Deployment.Application.ApplicationActivator.ActivateDeploymentWorker(Object state)
Inner Exception
System.Net.WebException
- The remote server returned an error: (401) Unauthorized.
- Source: System
- Stack trace:
at System.Net.HttpWebRequest.GetResponse()
at System.Deployment.Application.SystemNetDownloader.DownloadSingleFile(DownloadQueueItem next)

Anyone able to help ?The error means that the client does not have the Whidbey CLR installed. You will need to install the Whidbey CLR on each client machine where you want to use report builder.

-Lukasz|||Hi,
I was facing similar problem while accessing Report Manager installed on different system on the network, I was able to get Report Manager menu but can not see contents on Report Server. It was displayed Blank without any exception.

Report Server is installed on http://testsrv/Reports$sql2005.

I changed configuration of Reporting Service on Server , Report Server Configuration Manager > Windows Service Identity> Service account from "Local System" to "Local Services".

I can access Report Manager with contents.

Meanwhile I noticed that Report Builder is not launching on the system which is a different system from the Report Server. As per my understanding, Report Builder is a "End user tool" and will be launched without any upgradation of the system (Different system from server). I am getting prompt for "Open/Save document".
Where as Report Builder is working fine on Server itself.

While opening document, I can see XML contents to access Report Builder.
I am pasting part of that XML file in orange colour,

<?xml version="1.0" encoding="utf-8" ?>

- <asmv1:assembly xsi:schemaLocation="urn:schemas-microsoft-com:asm.v1 assembly.adaptive.xsd" manifestVersion="1.0" xmlns:dsig="http://www.w3.org/2000/09/xmldsig#" xmlns="urn:schemas-microsoft-com:asm.v2" xmlns:asmv1="urn:schemas-microsoft-com:asm.v1" xmlns:asmv2="urn:schemas-microsoft-com:asm.v2" xmlns:xrml="urn:mpeg:mpeg21:2003:01-REL-R-NS" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">

<assemblyIdentity name="ReportBuilder.app" version="9.0.1116.8" publicKeyToken="49ef3e7f44a9c98c" language="neutral" processorArchitecture="msil" xmlns="urn:schemas-microsoft-com:asm.v1" />

<description asmv2:publisher="Microsoft" asmv2:product="Report Builder" xmlns="urn:schemas-microsoft-com:asm.v1" />

<deployment install="false" trustURLParameters="true" />

- <dependency>

- <dependentAssembly dependencyType="install" allowDelayedBinding="true" codebase="ReportBuilder.exe.manifest" size="7148">

<assemblyIdentity name="ReportBuilder.exe" version="9.0.1116.8" publicKeyToken="49ef3e7f44a9c98c" language="neutral" processorArchitecture="msil" type="win32" />

- <hash>

- <dsig:Transforms>

<dsig:Transform Algorithm="urn:schemas-microsoft-com:HashTransforms.Identity" />

</dsig:Transforms>

<dsig:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" />

<dsig:DigestValue>aAi7VtRySyyvYXiAs4FuFXSiqLA=</dsig:DigestValue>

</hash>

</dependentAssembly>

Anyone knows how to fix this, It is required to upgrade my system, what are the upgrades require on the system to access Report Builder?

|||Your two issues are unrelated. Specifically for the Report Builder issue - the client machine (the one on which you want to run Report Builder) needs to have The .Net Framework 2.0 (CLR 2.0) installed on it.

The reason is that the Report Builder leverages the ClickOnce technology that is new in the .Net Framework 2.0.

Regarding your other issue - the Report Manager shows the top menu with a blank contents when your login does not have permissions on the root of the report server. You will need a role that has Read Properties (Browser roles has this) assigned to your login on the root of the report server namespace. Changing the account from Local System to Local Service should not affect this.

-Lukasz|||Thanks Lukasz, I have installed .NET Framework 2.0 on Client machine and able to launch Report Builder successfully.

I created a new user with sufficient permission and access to HOME directory on Report Server and able to access Reports/Data Sources/Models using Client Machine.

Thanks again!|||

I have what may be a similar problem. I try to click on the "Report Builder" button from a client machine and nothing happens, however I have tried things mentioned in the suggestions above and it did not seem to help. From a client PC, I logged in as myself and am not able to run "Report Builder", but when I login as a local admin I am able to run "Report Builder".

Our server has SQL Server 2005 Enterprise Edition and Visual Studio 2005 installed. I am able to run "Report Builder" from my PC where I had Visual Studio 2005 installed, but not SQL Server 2005 installed. I have local admin priviledges to my PC.

From a client PC, I logged in as myself and am not able to run "Report Builder". When I click on it nothing happens. I gave my Windows login "Content Manger" permissions under the SSRS Home -> Properties tab, and I also added my login and gave myself "System Administrator" and "System User" Roles under the SSRS ->Site Settings->Configure site-wide security option. This seems to be configured correctly, as "Report Builder" launches when I am on my PC. However, it does not launch on the client PC when logged in under my login.

Further, when I login as a local admin on the client PC, I am able to run "Report Builder", so I think the .net framework 2.0 is correctly installed and working properly. However, it is our policy not to give the user of the client PC local admin rights. My windows login does not have local admin rights to this particular PC.

Q1. Is local admin rights required on the client PC where "Report Builder" is ran? If so, is it only required for the first time it is loaded? It seems like it should not be required, however this would explain the symptoms detailed above.

Q2. Is there an error log that may help debug what this problem is? It is strange to me, that nothing happens, but no error is displayed on the http://.../reportserver/Pages page

Q3. When logged in as local admin, report builder installed to something like:

C:\Documents and Settings\Administrator.8ZR5551\Local Settings\Apps\2.0\VVJ0004J.B0N\H3KE16BP.Y07\repo..lder_89845dcd8080cc91_0009.0000_none_7ecce75e919dcccd

I am not sure if I can copy this install to another directory which the client has permission to run from. Is this a valid thing to do? I am guessing probably not since I tried this and it did not seem to work.I tried this and it did not seem to work..

Q4. I saw this posting talking about the need to run under PartialTrust mode, instead of FullTrust mode. So I reconfigured the RSWebApplication.config file to do that, and it still does not work.:

http://forums.microsoft.com/MSDN/ShowPost.aspx?PostID=280387&SiteID=1 which refers to the following link.

http://msdn2.microsoft.com/en-us/library/ms345245.aspx

I changed the C:\Program Files\MSSQL2005\MSSQL.3\Reporting Services\ReportManager\ RSWebApplication.config

From

<Configuration><UI> …

<ReportBuilderTrustLevel> FullTrust </ReportBuilderTrustLevel>

</UI>…</Configuration>

To

<Configuration><UI> …

<ReportBuilderTrustLevel>PartialTrust</ReportBuilderTrustLevel>

</UI>…</Configuration>

Stopped and restarted report server through reporting services configuration (not sure if I needed to do this) The problem still occurred, however.

|||

Well scratch that idea on local admin rights. Our IT department gave login admin to my windows login (My computer->Manage->System Tools: Local Users and Groups->Administrators) and it still did not work. When I click on "Report Builder" it still does not do anything. I also tried to use it directly at the following URL's and it still did not work, same result of not displaying anything:

http://.../reportserver/ReportBuilder/ReportBuilder.application

http://.../reportserver/ReportBuilder/ReportBuilderLocalIntranet.application

Q5. Is there any Internet Explorer settings that would cause this behavior? I tried disabling popup blocker, but this did not seem to help.

Q6. In the above posting, giving permission on the server HOME directory was required. What directory does this refer to? Does this mean each user of Report Builder needs Windows Directory level security to some directories like C:\Program Files\MSSQL2005\MSSQL.3\Reporting Services\ReportManager\ or others? This does not seem to make sense, but I was unsure which HOME directory was mentioned in the previous posting by Nilesh Trivedi.
.

|||Well this is almost a year old but I am facing the exact same problem as Chad Buher. Clicking on the Report Builder button does nothing, no error, nothing. Can this be caused by some network policy setting?

Issue on Models displayed in Report Builder

I am launching the Report Builder from my web application. The launching works fine. The Report Builder displays all the models published on the Report Server, whereas the user launching the report builder doesnt have permission on most of the folders containing the models. The permission set on the folders individually (not inherit from parent) using Management Studio.

The Report Server and the Report Builder folder under that both are running with Integrated Windows Authentication.

Is there anything am missing to check ? I want the user should be able to see only those models, which he/she has been given permission to access.

For info, the web application from where the Report Builder is launched is using Forms Authentication. So, Anonymous Access is enabled. If this is the problem, can I create a separate web page and inside a folder (under website) and apply Integrated Windows Authentication to the folder and launch Report Builder from the web page. Will it work ?

Thanks in advance.

Please see the answer to this duplicate post:

http://forums.microsoft.com/MSDN/ShowPost.aspx?PostID=326587&SiteID=1

|||

Thanks Bob,

My problem was the exe. Killing the exe solved the problem.