16

I have a SQL Server 2008 R2 Report Server running on a Windows 7 machine as well as an ASP.NET application. The ASP.NET application makes requests to the Report Server to display a list of reports, render reports, etc. My ASP.NET application successfully gets the list of reports but when it tries to render a report I get the following error:

The permissions granted to user 'IIS APPPOOL\DefaultAppPool' are insufficient for performing this operation. (rsAccessDenied)

Description: An unhandled exception occurred during the execution of the current web request. Please review the stack trace for more information about the error and where it originated in the code. 

Exception Details: Microsoft.Reporting.WebForms.ReportServerException: The permissions granted to user 'IIS APPPOOL\DefaultAppPool' are insufficient for performing this operation. (rsAccessDenied)

Source Error: 

An unhandled exception was generated during the execution of the current web request. Information regarding the origin and location of the exception can be identified using the exception stack trace below.

Stack Trace: 

[ReportServerException: The permissions granted to user 'IIS APPPOOL\DefaultAppPool' are insufficient for performing this operation. (rsAccessDenied)]
Microsoft.Reporting.WebForms.ServerReportSoapProxy.OnSoapException(SoapException e) +89
Microsoft.Reporting.WebForms.Internal.Soap.ReportingServices2005.Execution.ProxyMethodInvocation.Execute(RSExecutionConnection connection, ProxyMethod`1 initialMethod, ProxyMethod`1 retryMethod) +404
Microsoft.Reporting.WebForms.Internal.Soap.ReportingServices2005.Execution.RSExecutionConnection.LoadReport(String Report, String HistoryID) +180
Microsoft.Reporting.WebForms.ServerReport.EnsureExecutionSession() +79
Microsoft.Reporting.WebForms.ServerReport.GetParameters() +54

Note: This same code base has worked fine on multiple machines running Windows 7 and Windows Server 2008. Iv'e been trying many different things based on web searches but haven't found a solution. Any insight into this would be greatly appreciated.

  • 2
    have you made sure that the APPPool Identity, 'IIS APPPOOL\DefaultAppPool' has access to the report server. It should have at least browser access – mreyeros Jun 11 '12 at 19:53
  • That helped me. If you don't mind I'll put that up as an answer so that it's visible. – Michał Drozdowicz Sep 27 '12 at 07:12
  • For a quick temporary change I was able to do this. I saw this error when debugging in Visual Studio. I noticed my project properties > web > servers, had the selection 'Use Local IIS Wev server'. I normally do this to replicate the production environment. Switching to 'Use Visual Studio Development Server' allowed me to debug the report. – JabberwockyDecompiler Oct 31 '13 at 15:08

6 Answers6

33

Finally figure it out. My Reporting Services were configured to a local account while my Application Pool for IIS was configured to ApplicationPoolIdentity. I changed my Application Pool to LocalSystem and it fixed it. Hopefully this information will be useful to others as I wasted several hours figuring this out.

  • Thanks for taking the time and sharing your answer! Don't forget to mark it as the accepted answer! – Jeroen Jun 15 '12 at 20:44
  • 5
    For clarification for others who need this information: Application Pools > [YourApp] > Set Application Pool Defaults > Under Process Model, change Identity to 'LocalSystem' – Tom Aug 17 '12 at 13:54
  • 3
    isn't it dangerous to run Application Pool under a system account? – Axarydax Mar 11 '14 at 10:50
  • 2
    I was using it on a secure network, not exposing it to the outside world. So in my case security wasn't a huge concern. –  Mar 12 '14 at 07:38
  • I found that the permissions on the report server were granting the entire box {hostname}$ and the permissions had been set back to app pool identity. Thanks! – ConstantineK Oct 13 '14 at 21:24
20

Another solution as mreyeros put it in the comment is to give the Browser permission to the IIS APPPOOL\DefaultAppPool user in Report Manager.

To do that you should open the Report Manager website (http:///Reports) in Home folder click Folder Settings -> Security, click New Role Assignment and input the IIS APPPOOL\DefaultAppPool as name, select permissions from the list.

Michał Drozdowicz
  • 1,232
  • 11
  • 30
  • 1
    This was the answer I was looking for because I did not want to put an AD account on the app pool, but I was not able to get this to work. Did you try anything else that was related to allowing the apppool, ex I tried restarting the report server. – JabberwockyDecompiler Oct 31 '13 at 15:01
  • I agree that this is a much better solution because it works with the current configuration of IIS rather than changing the security of the site. ApplicationPoolIdentity allows more granular control (i.e. each site can access just the databases it requires). Thanks Michal. – jon bosker Mar 28 '18 at 07:04
4

Almost the same situation here except IIS and Report Server running on Windows Server 2008 R2. I used to have the asp.net application running with it's own application pool and everything worked. When I changed the application to the DefaultAppPool (due to a different problem), I got the permissions problem. I changed the Identity of the DefaultAppPool from ApplicationPoolIdentity to LocalSystem (in IIS, Advanced Settings) and it worked again.

KeithB
  • 69
  • 3
4

As Michal Drozdowicz said, create the AppPool user as a browser role. The part that is missing is

  1. The name of the user (at least on Windows 2012 is 'IIS APPPOOL\pool name' This is the exact name that will appear on the error page. Do not put the quotes around the user name when entered in the permission dialog.
  2. The browser role must be created at the main folder. Of course, if you need the permission at a sub-folder, ensure that the sub-folder is still inheriting permissions or set it manually
SOHO Developer
  • 583
  • 4
  • 16
2

I don't want to set my application pool to LocalSystem as I believe this is bad practice.

For Microsoft recommendations (don't use LocalSystem, use ApplicationPoolIdentity), see here: https://technet.microsoft.com/en-us/library/jj635855.aspx#AppPools.

For justification, see here: https://stackoverflow.com/a/510225/44169

I was experiencing the error described. I had added my app pool identity to my Report Server folder permissions, but this was being overridden by the security settings of a subfolder. I fixed this by selecting the subfolder and clicking "Revert to Parent Security Settings".

Community
  • 1
  • 1
Ronnie
  • 1,059
  • 14
  • 27
-1

In IIS Application Pool Change ApplicationPoolIdentity TO LocalSystem and it will be fixed.

By default ApplicationPoolIdentity DO NOT have access to Report Service i.e. SSRS reports

If you haven’t change the Identity account for your application, then when running the report in the application, it will use the default Identity account “ApplicationPoolIdentity” to access to report server. By default, the default do not have the permission to access report server. So in your scenario, this error due to the default Identity account “ApplicationPoolIdentity” in the Application Pool doesn’t have the permission to access the Report Server.

For more information Link:

https://social.msdn.microsoft.com/Forums/sqlserver/en-US/9593f5a8-09e7-4299-9cf1-5251dd375c38/the-permissions-granted-to-user-iis-apppoolaspnet-v40-are-insufficient-for-performing-this?forum=sqlreportingservices

test app
  • 1
  • 2