Investigating Custom Security

Hi everyone,
At the moment, my company is looking at ways to offer data hosting to our
customers. As far as Reporting Services goes, the current idea is that they
would contact a Report Server hosted by us externally. As a result, we are
looking at which security options are best and would appreciate some insight
if anyone has any suggestions.
At the moment, the idea is to have a single report server with different
folders for each customer. We would like to implement security so that each
customer can see their own folder, but no-one else can, and no-one can see
the directory of folders. It does not appear to be feasible to do this with
windows role-based security, so we are looking at writing our own custom
security extension. The problem here is that there does not seem to be a
way, when dealing with AceStructs, for example, to monitor which folder the
user is in.
Anyway, my questions are:
1. Is this whole approach wrong-headed, i.e. do we really need to have a
different ReportServer for each customer? We would like to avoid this if
possible.
2. If we do use the same server with different folders, what is the best
way to check what folder the user is in and whether that is their correct
folder (in, for example, the IAuthorizationExtension.CheckAccess implemented
method)?
As ever, any help very much appreciated.
Ed AllisonWe implemented something incredibly similar. You don't need to know what
folder the user is in CheckAccess because thats part of the ACL associated
with it. You assign users (or groups) particular access to different
folders. Check Access will do the rest of the work
so if you had 2 folders in the root for
/ClientA
/ClientB
and neither wants to see the other... (well you don't want them too)
you would assign permissions for the group to clienta for clienta folder,
and clientb for clientb folder.
Now they may be able to see the folder, but if they try to access it, it
gets access denied.
Otherwise, it sounds like your trying to re-write CheckAccess in almost the
same way it is now... just think about it a bit differently.
"Ed Allison" <ed@.optix.co.uk> wrote in message
news:OP6TJBCSGHA.5908@.TK2MSFTNGP14.phx.gbl...
> Hi everyone,
> At the moment, my company is looking at ways to offer data hosting to our
> customers. As far as Reporting Services goes, the current idea is that
> they
> would contact a Report Server hosted by us externally. As a result, we
> are
> looking at which security options are best and would appreciate some
> insight
> if anyone has any suggestions.
> At the moment, the idea is to have a single report server with different
> folders for each customer. We would like to implement security so that
> each
> customer can see their own folder, but no-one else can, and no-one can see
> the directory of folders. It does not appear to be feasible to do this
> with
> windows role-based security, so we are looking at writing our own custom
> security extension. The problem here is that there does not seem to be a
> way, when dealing with AceStructs, for example, to monitor which folder
> the
> user is in.
> Anyway, my questions are:
> 1. Is this whole approach wrong-headed, i.e. do we really need to have a
> different ReportServer for each customer? We would like to avoid this if
> possible.
> 2. If we do use the same server with different folders, what is the best
> way to check what folder the user is in and whether that is their correct
> folder (in, for example, the IAuthorizationExtension.CheckAccess
> implemented
> method)?
> As ever, any help very much appreciated.
> Ed Allison
>
>|||You have to enable "My Reports" feature in the Reporting services and refer
your customers to "My Reports" folder upon login.
Everyone will have its own and you don't have to know, what is the real name
of the folder is - just use "My Reports" path.
But you are going to face a challenge of accessing shared reports in a fixed
folder - use parameter encryption in that case.
--
Oleg Yevteyev,
San Diego, CA
It is OK to contact me with a contracting opportunity.
"myfirstname"001atgmaildotcom.
Replace "myfirstname" with Oleg.
--
"Ed Allison" <ed@.optix.co.uk> wrote in message
news:OP6TJBCSGHA.5908@.TK2MSFTNGP14.phx.gbl...
> Hi everyone,
> At the moment, my company is looking at ways to offer data hosting to our
> customers. As far as Reporting Services goes, the current idea is that
> they
> would contact a Report Server hosted by us externally. As a result, we
> are
> looking at which security options are best and would appreciate some
> insight
> if anyone has any suggestions.
> At the moment, the idea is to have a single report server with different
> folders for each customer. We would like to implement security so that
> each
> customer can see their own folder, but no-one else can, and no-one can see
> the directory of folders. It does not appear to be feasible to do this
> with
> windows role-based security, so we are looking at writing our own custom
> security extension. The problem here is that there does not seem to be a
> way, when dealing with AceStructs, for example, to monitor which folder
> the
> user is in.
> Anyway, my questions are:
> 1. Is this whole approach wrong-headed, i.e. do we really need to have a
> different ReportServer for each customer? We would like to avoid this if
> possible.
> 2. If we do use the same server with different folders, what is the best
> way to check what folder the user is in and whether that is their correct
> folder (in, for example, the IAuthorizationExtension.CheckAccess
> implemented
> method)?
> As ever, any help very much appreciated.
> Ed Allison
>
>|||I'll look into that. Thanks for your help.
"Oleg Yevteyev" <myfirstname001atgmaildotcom> wrote in message
news:%23xh9mOJSGHA.5728@.tk2msftngp13.phx.gbl...
> You have to enable "My Reports" feature in the Reporting services and
> refer your customers to "My Reports" folder upon login.
> Everyone will have its own and you don't have to know, what is the real
> name of the folder is - just use "My Reports" path.
> But you are going to face a challenge of accessing shared reports in a
> fixed folder - use parameter encryption in that case.
> --
> Oleg Yevteyev,
> San Diego, CA
> It is OK to contact me with a contracting opportunity.
> "myfirstname"001atgmaildotcom.
> Replace "myfirstname" with Oleg.
> --
> "Ed Allison" <ed@.optix.co.uk> wrote in message
> news:OP6TJBCSGHA.5908@.TK2MSFTNGP14.phx.gbl...
>> Hi everyone,
>> At the moment, my company is looking at ways to offer data hosting to our
>> customers. As far as Reporting Services goes, the current idea is that
>> they
>> would contact a Report Server hosted by us externally. As a result, we
>> are
>> looking at which security options are best and would appreciate some
>> insight
>> if anyone has any suggestions.
>> At the moment, the idea is to have a single report server with different
>> folders for each customer. We would like to implement security so that
>> each
>> customer can see their own folder, but no-one else can, and no-one can
>> see
>> the directory of folders. It does not appear to be feasible to do this
>> with
>> windows role-based security, so we are looking at writing our own custom
>> security extension. The problem here is that there does not seem to be a
>> way, when dealing with AceStructs, for example, to monitor which folder
>> the
>> user is in.
>> Anyway, my questions are:
>> 1. Is this whole approach wrong-headed, i.e. do we really need to have a
>> different ReportServer for each customer? We would like to avoid this if
>> possible.
>> 2. If we do use the same server with different folders, what is the best
>> way to check what folder the user is in and whether that is their correct
>> folder (in, for example, the IAuthorizationExtension.CheckAccess
>> implemented
>> method)?
>> As ever, any help very much appreciated.
>> Ed Allison
>>
>|||Thanks for your answer Chris. You are correct. I was working on the false
assumption that it would be necessary to completely re-write CheckAccess. I
see that this is not necessary, and that will save me a lot of time.
"Chris Taylor" <ctaylor7480@.newsgroups.nospam> wrote in message
news:ejiAGRFSGHA.4384@.tk2msftngp13.phx.gbl...
> We implemented something incredibly similar. You don't need to know what
> folder the user is in CheckAccess because thats part of the ACL associated
> with it. You assign users (or groups) particular access to different
> folders. Check Access will do the rest of the work
> so if you had 2 folders in the root for
> /ClientA
> /ClientB
> and neither wants to see the other... (well you don't want them too)
> you would assign permissions for the group to clienta for clienta folder,
> and clientb for clientb folder.
> Now they may be able to see the folder, but if they try to access it, it
> gets access denied.
> Otherwise, it sounds like your trying to re-write CheckAccess in almost
> the same way it is now... just think about it a bit differently.
>
>
> "Ed Allison" <ed@.optix.co.uk> wrote in message
> news:OP6TJBCSGHA.5908@.TK2MSFTNGP14.phx.gbl...
>> Hi everyone,
>> At the moment, my company is looking at ways to offer data hosting to our
>> customers. As far as Reporting Services goes, the current idea is that
>> they
>> would contact a Report Server hosted by us externally. As a result, we
>> are
>> looking at which security options are best and would appreciate some
>> insight
>> if anyone has any suggestions.
>> At the moment, the idea is to have a single report server with different
>> folders for each customer. We would like to implement security so that
>> each
>> customer can see their own folder, but no-one else can, and no-one can
>> see
>> the directory of folders. It does not appear to be feasible to do this
>> with
>> windows role-based security, so we are looking at writing our own custom
>> security extension. The problem here is that there does not seem to be a
>> way, when dealing with AceStructs, for example, to monitor which folder
>> the
>> user is in.
>> Anyway, my questions are:
>> 1. Is this whole approach wrong-headed, i.e. do we really need to have a
>> different ReportServer for each customer? We would like to avoid this if
>> possible.
>> 2. If we do use the same server with different folders, what is the best
>> way to check what folder the user is in and whether that is their correct
>> folder (in, for example, the IAuthorizationExtension.CheckAccess
>> implemented
>> method)?
>> As ever, any help very much appreciated.
>> Ed Allison
>>
>

InvalidOperationException in ReportItem.set_RenderingInfo

I have an exception being thrown during the set_RenderingInfo call as show
in the following stack trace:
Operation is not valid due to the current state of the object.
at
Microsoft.ReportingServices.ReportRendering.ReportItem.set_RenderingInfo(Object
value)
at
Exony.ReportingServices.Rendering.RenderingProviders.HtmlRenderingFactory.PreRender(RenderContext
context, ReportItem item) in
c:\dev\source\reporting\main\app\exony.reportingservices.rendering\renderingproviders\htmlrenderingfactory.cs:line
75
I really need to understand why this is happening and how I can avoid it so
looking at the code I expect the bit in question (inside the
ReportItem.set_RenderingInfo function) is:
if (!this.m_renderingContext.InPageSection)
{
if (this.m_intUniqueName == 0)
{
throw new InvalidOperationException();
}
}
What is m_intUniqueName for and what is causing it to be '0'?
Many thanks,
James SnapeHi James,
Thanks for your email.
I have noticed you are developing your won rendering extension.
UniqueName is A string that uniquely identifies this report item
ReportItem
UniqueName=0 means it is not initilized correctly due to some issues when
contrsucting.
Constructors for all subtypes of ReportItem require two arguments: Name
(String) and UniqueName (String). These properties cannot be set after the
report item is created.
Since customized rendering extension is not officially support at present,
I would like to introduce you to the CSS Advisory Services team.
Advisory Services is a remotely delivered, hourly fee-based, consultative
support option that provides a comprehensive result beyond your break-fix
product maintenance needs. It is an hourly fee-based, consultative
support option that provides proactive support beyond your break-fix
product maintenance needs. This support option includes working with the
same technician for assistance with issues like product migration, code
review, or new program development.
For more info in the US and Canada:
http://support.microsoft.com/default.aspx?pr=AdvisoryService
Outside of the US/Canada:
http://support.microsoft.com/default.aspx?scid=%2finternational.aspx
Sincerely yours,
Michael Cheng
Microsoft Online Partner Support
When responding to posts, please "Reply to Group" via your newsreader so
that others may learn and benefit from your issue.
=====================================================Business-Critical Phone Support (BCPS) provides you with technical phone
support at no charge during critical LAN outages or "business down"
situations. This benefit is available 24 hours a day, 7 days a week to all
Microsoft technology partners in the United States and Canada.
This and other support options are available here:
BCPS:
https://partner.microsoft.com/US/technicalsupport/supportoverview/40010469
Others: https://partner.microsoft.com/US/technicalsupport/supportoverview/
If you are outside the United States, please visit our International
Support page: http://support.microsoft.com/common/international.aspx
=====================================================This posting is provided "AS IS" with no warranties, and confers no rights.|||Hi Michael,
I am writing a rendering extension because our customers have decided they
don't like the default HTML rendering that comes with Reporting Services.
Regarding rendering extensions being unsupported, can you point me to the
EULA or other document that states this because reporting services books
online seems to suggest it is a standard part of the product
(ms-help://MS.RSBOL80.1033/RSPROG/htm/rsp_prog_extend_security_87oi.htm). It
does mention that the documentation is not yet available but not that it is
unsupported.
The advisory services seems a little expensive to ask a question of plus I
can't see that it's available outside the US.
Thanks in advance,
James Snape|||Hi James,
Thanks for your email.
Since we do not have much documents / references on hand about rendering
extension either, we do not support custom rendering extension in SQL
Server 2005.
If you want the the support for this, I recommend that you open a support
incident with Microsoft Customer Service and Support (CSS) so that a
dedicated Support Professional can work with you in a more timely and
efficient manner and contact development team much closer. If you need any
help in this regard, please let me know.
For a complete list of Microsoft Customer Service and Support phone
numbers, please go to the following address on the World Wide Web:
<http://support.microsoft.com/directory/overview.asp>
If you are outside the US please see http://support.microsoft.com for
regional support phone numbers.
Thank you for your patience and cooperation. If you have any questions or
concerns, don't hesitate to let me know. We are always here to be of
assistance!
Sincerely yours,
Michael Cheng
Microsoft Online Partner Support
When responding to posts, please "Reply to Group" via your newsreader so
that others may learn and benefit from your issue.
=====================================================This posting is provided "AS IS" with no warranties, and confers no rights.

Invalid operation for the current cursor position

Our developers are getting the following error posted from several Java
applications.
[Microsoft][SQLServer 2000 Driver for JDBC] Invalid operation for the
current cursor position
Is anyone familiar with this error?
Khris wrote:

> Our developers are getting the following error posted from several Java
> applications.
> [Microsoft][SQLServer 2000 Driver for JDBC] Invalid operation for the
> current cursor position
> Is anyone familiar with this error?
It can occur when you try to access result set data without ever
having called next(). If you can show us the whole original stack trace
of the exception and the code that caused it, we can probably see the problem.
Joe Weinstein at BEA Systems
|||Joe - you are correct. The developer was not validating that there was an
actual row. Thanks a bunch
"Joe Weinstein" wrote:

>
> Khris wrote:
>
> It can occur when you try to access result set data without ever
> having called next(). If you can show us the whole original stack trace
> of the exception and the code that caused it, we can probably see the problem.
> Joe Weinstein at BEA Systems
>

into clause

hi, how to define the temp table to local, only the current use can see it:
select * from into temp?A single # implies local temp table for the current connection/context. No
other user (on another connection) can access this #temp.
e.g.
select *
into #temp
from tb
-oj
"js" <js@.someone@.hotmail.com> wrote in message
news:OUFrxpBTFHA.1384@.TK2MSFTNGP09.phx.gbl...
> hi, how to define the temp table to local, only the current use can see
> it:
> select * from into temp?
>|||Do:
SELECT * INTO #temp FROM tbl ;
Anith|||select c1, ..., cn
into #local_temp_table
from t1
If you use one # then it is local. Use ## for global temporary.
AMB
"js" wrote:

> hi, how to define the temp table to local, only the current use can see it
:
> select * from into temp?
>
>|||how about if I don't use, global? Thks.
"Alejandro Mesa" <AlejandroMesa@.discussions.microsoft.com> wrote in message
news:EC46D1A7-AF6B-4A95-ADA4-D58372CEF649@.microsoft.com...
> select c1, ..., cn
> into #local_temp_table
> from t1
> If you use one # then it is local. Use ## for global temporary.
>
> AMB
> "js" wrote:
>|||> how about if I don't use, global? Thks.
Can you re-phrase that question?
Tibor Karaszi, SQL Server MVP
http://www.karaszi.com/sqlserver/default.asp
http://www.solidqualitylearning.com/
"js" <js@.someone@.hotmail.com> wrote in message news:urny42BTFHA.2128@.TK2MSFTNGP14.phx.gbl..
.
> how about if I don't use, global? Thks.
> "Alejandro Mesa" <AlejandroMesa@.discussions.microsoft.com> wrote in messag
e
> news:EC46D1A7-AF6B-4A95-ADA4-D58372CEF649@.microsoft.com...
>|||Sorry,
If you use one # then it is local. Use ## for global temporary. how about if
I don't use # or ##(select * into temp from tb1), is it global?
"Tibor Karaszi" <tibor_please.no.email_karaszi@.hotmail.nomail.com> wrote in
message news:%23HSKB8BTFHA.3040@.TK2MSFTNGP10.phx.gbl...
> Can you re-phrase that question?
> --
> Tibor Karaszi, SQL Server MVP
> http://www.karaszi.com/sqlserver/default.asp
> http://www.solidqualitylearning.com/
>
> "js" <js@.someone@.hotmail.com> wrote in message
> news:urny42BTFHA.2128@.TK2MSFTNGP14.phx.gbl...
>|||Then it is a permanent table (normal one).
AMB
"js" wrote:

> Sorry,
> If you use one # then it is local. Use ## for global temporary. how about
if
> I don't use # or ##(select * into temp from tb1), is it global?
>
> "Tibor Karaszi" <tibor_please.no.email_karaszi@.hotmail.nomail.com> wrote i
n
> message news:%23HSKB8BTFHA.3040@.TK2MSFTNGP10.phx.gbl...
>
>|||In SQL Query Analyzer, if i open a new query window, is it a new
connection/context?
"oj" <nospam_ojngo@.home.com> wrote in message
news:eVQ58sBTFHA.3140@.TK2MSFTNGP14.phx.gbl...
>A single # implies local temp table for the current connection/context. No
>other user (on another connection) can access this #temp.
> e.g.
> select *
> into #temp
> from tb
>
> --
> -oj
>
> "js" <js@.someone@.hotmail.com> wrote in message
> news:OUFrxpBTFHA.1384@.TK2MSFTNGP09.phx.gbl...
>|||Thanks for the help...
how to check is #temp is already in database?
"oj" <nospam_ojngo@.home.com> wrote in message
news:eVQ58sBTFHA.3140@.TK2MSFTNGP14.phx.gbl...
>A single # implies local temp table for the current connection/context. No
>other user (on another connection) can access this #temp.
> e.g.
> select *
> into #temp
> from tb
>
> --
> -oj
>
> "js" <js@.someone@.hotmail.com> wrote in message
> news:OUFrxpBTFHA.1384@.TK2MSFTNGP09.phx.gbl...
>