16

I am trying to implement custom forms authentication with SSRS 2016.

Within this article, a reference is made to the SQL Server Reporting Service Product Samples.

It appears that the latest supported version on the samples page (with regards to security extensions) is SSRS 2012. I have successfully applied the information gathered on the samples page to a SSRS 2014 instance. However, it looks as though the file system structure has changed a bit for SSRS 2016 (read, there is no longer a ReportManager folder) which seems to invalidate the instructions provided by the samples page.

Does anyone know where I can find updated procedures for establishing custom authentication?

RoadieRich
  • 6,330
  • 3
  • 35
  • 52
Jason Richmeier
  • 1,595
  • 3
  • 19
  • 38

3 Answers3

7

We stumbled upon a thread on the MSDN forums located here. This thread has had quite a bit of activity including responses from the product team.

For anyone having issues with getting a custom security extension to work with SSRS 2016 in the next couple of weeks, please have a look. After that, it is my understanding that all of this information will be included in the documentation when the product is in a RTM state.

Jason Richmeier
  • 1,595
  • 3
  • 19
  • 38
  • Yes. I used all of the information located in the forum post I referenced in my answer. I have not confirmed if any of this information has made it into the official documentation as we have decided (or will decide very soon) to go a different route. – Jason Richmeier Sep 22 '16 at 20:14
  • 1
    I'm attempting to do oAuth authentication via IdentityServer. Any chance you could post a sample of how you guys pulled it off? The docs are still not updated. – Elan Hasson Sep 22 '16 at 21:36
5

I recently did this work.

I searched in many sites. This example works for me: https://github.com/Microsoft/Reporting-Services/tree/master/CustomSecuritySample. Below, under the example of the project, there is a deployment manual.

Note, in my case, the web portal did not work without assigning machineKey in the files:

  • ...\Reporting Services\ReportServer\web.config
  • ...\Reporting Services\RSWebApp\Microsoft.Reporting­Services.Portal.WebHost.exe.config

In general, everything as described in the manual. Not missing a single step.

The site I used to generate the key: http://www.developerfusion.com/tools/generatemachinekey/

I hope this info helps someone.

Yahoo Serious
  • 3,728
  • 1
  • 33
  • 37
Konstantin
  • 51
  • 1
  • 2
  • This method is not working for me; did you use the sample code verbatim? I refactored a little bit (namespacing and such). I also changed how the user accounts were stored and changed the hashing algorithm to bcrypt. Nothing that *should* have affected how this functions overall. I am stuck with a login page loop now; any thoughts? – bdwakefield Jun 02 '17 at 17:22
  • I recommend first doing everything in steps as is in manual. This should work. Then gradually change the configuration to catch a place where something will go wrong. – Konstantin Jun 07 '17 at 07:58
  • I actually was able to get this working; however I am having an issue when I try to create anything but a folder. I haven't yet tried uploading any reports. I *think* I am getting a null Identity object -- which doesn't make sense as it has already logged in. I assume you did not run into this? – bdwakefield Jun 07 '17 at 11:51
  • Following the steps made it to me. This is a perfect 2016 version of the guide provided in OP link. – Renan Vasconcelos Dec 19 '17 at 11:55
  • I'm glad I helped someone. – Konstantin Oct 26 '18 at 13:21
2

I think you dont have a problem with get username and password or generating user token, some changes about Security Extentions in SQL Server 2016 refers CheckAccess function in IAuthorizationExtension interface.

In the following links you can find changes and sample codes especially for implementing a Security Extension for SQL Server 2016.

Implementing a Security Extension

Configure Custom or Forms Authentication on the Report Server

Authorization in Reporting Services

IAuthorizationExtension.CheckAccess Method (String, IntPtr, Byte[], CatalogOperation)

Mehdi
  • 1,731
  • 1
  • 18
  • 33
  • 3
    With the exception of the last link (of which is not really much use in the context of the question), I have read the articles pointed to by these links *many* times. It appears that there is still some information missing from these articles. Even worse, as I have indicated in the question, some of the information appears outdated. That said, this information is not much help. I have even opened up an advisory support case with Microsoft and they cannot address this issue. – Jason Richmeier Apr 21 '16 at 12:55
  • We have report the issue to https://connect.microsoft.com/SQLServer/feedback/details/2664276 Upvote it so that it gets MSFT attention – Ojas Maru May 03 '16 at 22:08