Investigating Custom Security

Hi everyone,
At the moment, my company is looking at ways to offer data hosting to our
customers. As far as Reporting Services goes, the current idea is that they
would contact a Report Server hosted by us externally. As a result, we are
looking at which security options are best and would appreciate some insight
if anyone has any suggestions.
At the moment, the idea is to have a single report server with different
folders for each customer. We would like to implement security so that each
customer can see their own folder, but no-one else can, and no-one can see
the directory of folders. It does not appear to be feasible to do this with
windows role-based security, so we are looking at writing our own custom
security extension. The problem here is that there does not seem to be a
way, when dealing with AceStructs, for example, to monitor which folder the
user is in.
Anyway, my questions are:
1. Is this whole approach wrong-headed, i.e. do we really need to have a
different ReportServer for each customer? We would like to avoid this if
possible.
2. If we do use the same server with different folders, what is the best
way to check what folder the user is in and whether that is their correct
folder (in, for example, the IAuthorizationExtension.CheckAccess implemented
method)?
As ever, any help very much appreciated.
Ed AllisonWe implemented something incredibly similar. You don't need to know what
folder the user is in CheckAccess because thats part of the ACL associated
with it. You assign users (or groups) particular access to different
folders. Check Access will do the rest of the work
so if you had 2 folders in the root for
/ClientA
/ClientB
and neither wants to see the other... (well you don't want them too)
you would assign permissions for the group to clienta for clienta folder,
and clientb for clientb folder.
Now they may be able to see the folder, but if they try to access it, it
gets access denied.
Otherwise, it sounds like your trying to re-write CheckAccess in almost the
same way it is now... just think about it a bit differently.
"Ed Allison" <ed@.optix.co.uk> wrote in message
news:OP6TJBCSGHA.5908@.TK2MSFTNGP14.phx.gbl...
> Hi everyone,
> At the moment, my company is looking at ways to offer data hosting to our
> customers. As far as Reporting Services goes, the current idea is that
> they
> would contact a Report Server hosted by us externally. As a result, we
> are
> looking at which security options are best and would appreciate some
> insight
> if anyone has any suggestions.
> At the moment, the idea is to have a single report server with different
> folders for each customer. We would like to implement security so that
> each
> customer can see their own folder, but no-one else can, and no-one can see
> the directory of folders. It does not appear to be feasible to do this
> with
> windows role-based security, so we are looking at writing our own custom
> security extension. The problem here is that there does not seem to be a
> way, when dealing with AceStructs, for example, to monitor which folder
> the
> user is in.
> Anyway, my questions are:
> 1. Is this whole approach wrong-headed, i.e. do we really need to have a
> different ReportServer for each customer? We would like to avoid this if
> possible.
> 2. If we do use the same server with different folders, what is the best
> way to check what folder the user is in and whether that is their correct
> folder (in, for example, the IAuthorizationExtension.CheckAccess
> implemented
> method)?
> As ever, any help very much appreciated.
> Ed Allison
>
>|||You have to enable "My Reports" feature in the Reporting services and refer
your customers to "My Reports" folder upon login.
Everyone will have its own and you don't have to know, what is the real name
of the folder is - just use "My Reports" path.
But you are going to face a challenge of accessing shared reports in a fixed
folder - use parameter encryption in that case.
--
Oleg Yevteyev,
San Diego, CA
It is OK to contact me with a contracting opportunity.
"myfirstname"001atgmaildotcom.
Replace "myfirstname" with Oleg.
--
"Ed Allison" <ed@.optix.co.uk> wrote in message
news:OP6TJBCSGHA.5908@.TK2MSFTNGP14.phx.gbl...
> Hi everyone,
> At the moment, my company is looking at ways to offer data hosting to our
> customers. As far as Reporting Services goes, the current idea is that
> they
> would contact a Report Server hosted by us externally. As a result, we
> are
> looking at which security options are best and would appreciate some
> insight
> if anyone has any suggestions.
> At the moment, the idea is to have a single report server with different
> folders for each customer. We would like to implement security so that
> each
> customer can see their own folder, but no-one else can, and no-one can see
> the directory of folders. It does not appear to be feasible to do this
> with
> windows role-based security, so we are looking at writing our own custom
> security extension. The problem here is that there does not seem to be a
> way, when dealing with AceStructs, for example, to monitor which folder
> the
> user is in.
> Anyway, my questions are:
> 1. Is this whole approach wrong-headed, i.e. do we really need to have a
> different ReportServer for each customer? We would like to avoid this if
> possible.
> 2. If we do use the same server with different folders, what is the best
> way to check what folder the user is in and whether that is their correct
> folder (in, for example, the IAuthorizationExtension.CheckAccess
> implemented
> method)?
> As ever, any help very much appreciated.
> Ed Allison
>
>|||I'll look into that. Thanks for your help.
"Oleg Yevteyev" <myfirstname001atgmaildotcom> wrote in message
news:%23xh9mOJSGHA.5728@.tk2msftngp13.phx.gbl...
> You have to enable "My Reports" feature in the Reporting services and
> refer your customers to "My Reports" folder upon login.
> Everyone will have its own and you don't have to know, what is the real
> name of the folder is - just use "My Reports" path.
> But you are going to face a challenge of accessing shared reports in a
> fixed folder - use parameter encryption in that case.
> --
> Oleg Yevteyev,
> San Diego, CA
> It is OK to contact me with a contracting opportunity.
> "myfirstname"001atgmaildotcom.
> Replace "myfirstname" with Oleg.
> --
> "Ed Allison" <ed@.optix.co.uk> wrote in message
> news:OP6TJBCSGHA.5908@.TK2MSFTNGP14.phx.gbl...
>> Hi everyone,
>> At the moment, my company is looking at ways to offer data hosting to our
>> customers. As far as Reporting Services goes, the current idea is that
>> they
>> would contact a Report Server hosted by us externally. As a result, we
>> are
>> looking at which security options are best and would appreciate some
>> insight
>> if anyone has any suggestions.
>> At the moment, the idea is to have a single report server with different
>> folders for each customer. We would like to implement security so that
>> each
>> customer can see their own folder, but no-one else can, and no-one can
>> see
>> the directory of folders. It does not appear to be feasible to do this
>> with
>> windows role-based security, so we are looking at writing our own custom
>> security extension. The problem here is that there does not seem to be a
>> way, when dealing with AceStructs, for example, to monitor which folder
>> the
>> user is in.
>> Anyway, my questions are:
>> 1. Is this whole approach wrong-headed, i.e. do we really need to have a
>> different ReportServer for each customer? We would like to avoid this if
>> possible.
>> 2. If we do use the same server with different folders, what is the best
>> way to check what folder the user is in and whether that is their correct
>> folder (in, for example, the IAuthorizationExtension.CheckAccess
>> implemented
>> method)?
>> As ever, any help very much appreciated.
>> Ed Allison
>>
>|||Thanks for your answer Chris. You are correct. I was working on the false
assumption that it would be necessary to completely re-write CheckAccess. I
see that this is not necessary, and that will save me a lot of time.
"Chris Taylor" <ctaylor7480@.newsgroups.nospam> wrote in message
news:ejiAGRFSGHA.4384@.tk2msftngp13.phx.gbl...
> We implemented something incredibly similar. You don't need to know what
> folder the user is in CheckAccess because thats part of the ACL associated
> with it. You assign users (or groups) particular access to different
> folders. Check Access will do the rest of the work
> so if you had 2 folders in the root for
> /ClientA
> /ClientB
> and neither wants to see the other... (well you don't want them too)
> you would assign permissions for the group to clienta for clienta folder,
> and clientb for clientb folder.
> Now they may be able to see the folder, but if they try to access it, it
> gets access denied.
> Otherwise, it sounds like your trying to re-write CheckAccess in almost
> the same way it is now... just think about it a bit differently.
>
>
> "Ed Allison" <ed@.optix.co.uk> wrote in message
> news:OP6TJBCSGHA.5908@.TK2MSFTNGP14.phx.gbl...
>> Hi everyone,
>> At the moment, my company is looking at ways to offer data hosting to our
>> customers. As far as Reporting Services goes, the current idea is that
>> they
>> would contact a Report Server hosted by us externally. As a result, we
>> are
>> looking at which security options are best and would appreciate some
>> insight
>> if anyone has any suggestions.
>> At the moment, the idea is to have a single report server with different
>> folders for each customer. We would like to implement security so that
>> each
>> customer can see their own folder, but no-one else can, and no-one can
>> see
>> the directory of folders. It does not appear to be feasible to do this
>> with
>> windows role-based security, so we are looking at writing our own custom
>> security extension. The problem here is that there does not seem to be a
>> way, when dealing with AceStructs, for example, to monitor which folder
>> the
>> user is in.
>> Anyway, my questions are:
>> 1. Is this whole approach wrong-headed, i.e. do we really need to have a
>> different ReportServer for each customer? We would like to avoid this if
>> possible.
>> 2. If we do use the same server with different folders, what is the best
>> way to check what folder the user is in and whether that is their correct
>> folder (in, for example, the IAuthorizationExtension.CheckAccess
>> implemented
>> method)?
>> As ever, any help very much appreciated.
>> Ed Allison
>>
>

invalid cursor state

I am unable to save modifications to changes in a database. I get the following error:
- Unable to preserve security settings for user 'RIMSUser'.
ODBC error: [Microsoft][ODBC SQL Server Driver]Invalid cursor state
Any suggestions?
Hi Dslaby,
From your description, I understand that you would like to make your
modifications successfully without error message "Invalid cursor state".
Have I fully understood you? If there is anything I misunderstood, please
feel free to let me know.
Before we go any further, I would like to collect more information from you:
1. Could you let me know what the front-end program that you ran the your
query is? Access or others?
2. Which SQL Statement you run? Did you try other SQL statements? Such as
Select, Insert into, Update, etc.. Will they get the same results?
3. Do you have the correct security authority to do modifications in SQL
Server? Could you login SQL Server as 'RIMSUser' in Query Analyzer and make
modifications for database?
4. Have you updated to the latest service pack for SQL Server and ODBC
Driver?
Moreover, you could get the latest updates from
Microsoft Data Access Components (MDAC) 2.8
http://www.microsoft.com/downloads/d...fe3-c795-4b7d-
b037-185d0506396c&DisplayLang=en
Microsoft SQL Server 2000 Service Pack 3a
http://www.microsoft.com/downloads/d...52c-0488-4e46-
afbf-acace5369fa3&DisplayLang=en
Please apply my questions and suggestions above and let me know the
results, and feel free to post it in the group.
Sincerely yours,
Michael Cheng
Microsoft Online Support
************************************************** *********
Get Secure! - www.microsoft.com/security
This posting is provided "as is" with no warranties and confers no rights.
Please reply to newsgroups only, many thanks.
|||1. I'm using Enterprise Manager
2. I've tried to modify the database fields in Enterprise Manager
3. I'm an administrator and logged on in using integrated security
4. I've kept the service packs up to date in SQL
Thanks.
|||Hi Dslaby,
I don't know what your means about 'database fields', Does it mean
'datatype of the coloumn'?
In this case, it is an known issue especially when you are trying to change
it from FLOAT to INTEGER. We have an hotfix, however, This fix is not
publicly available through the Microsoft website as it has not gone through
full Microsoft regression testing. If you would like confirmation that
this fix is designed to address your specific problem, or if you would like
to confirm whether there are any special compatibility or installation
issues associated with this fix, you are encouraged to speak to a Support
Professional in Product Support Services, by contacting us at
1-(800)936-5800 or by choosing one of the options listed at
http://support.microsoft.com/default...d=sz;en-us;top
As a workaround, you could make your change by Query Analyzer
Thank you for your patience and cooperation. If you have any questions or
concerns, don't hesitate to let me know. We are here to be of assistance!
Sincerely yours,
Michael Cheng
Microsoft Online Support
************************************************** *********
Get Secure! - www.microsoft.com/security
This posting is provided "as is" with no warranties and confers no rights.
Please reply to newsgroups only, many thanks.
|||I was trying to change the length of a varchar from 250 to 1000. Now I get this message:
- Unable to create index 'PK_tblJobBoard'.
ODBC error: [Microsoft][ODBC SQL Server Driver]Invalid cursor state
I am unable to do any modifications to any of the database objects in Enterprise Manager. I'll try reinstalling SQL 2000.
|||Hi Dslaby,
ThereYou could try to do modification by Query Analyzer and you should
using ALTER statement like this if you want to alter column attribute
ALTER TABLE tableName ALTER COLUMN columnName columnType
(tableName, columnName and columnType should be changed according to your
own database settings)
More information about ALTER statement could be found at BooksOnline title
"ALTER TABLE" or MSDN Online:
ALTER TABLE
http://msdn.microsoft.com/library/de...us/tsqlref/ts_
aa-az_3ied.asp
After you apply SQL Server 2000 Service Pack 3 (SP3) hotfix build versions
between 8.00.0859 and 8.00.0875, you will encounter this kind of message
when using SQL Enterprise Manager to alter table column. Based on my
testing, a SQL Server without service pack (build version 8.00.0194) and
latest hotfix (builder version 8.00.0927) will not encounter this kind of
issue.
(You could use select @.@.version to find your SQL Server Versions by using
Query Analyzer)
In Summary, I recommand you using Query Analyzer to modify table column or
contact Product Support Services for latest update.
Thank you for your patience and cooperation. If you have any questions or
concerns, don't hesitate to let me know. We are here to be of assistance!
Sincerely yours,
Michael Cheng
Microsoft Online Support
************************************************** *********
Get Secure! - www.microsoft.com/security
This posting is provided "as is" with no warranties and confers no rights.
Please reply to newsgroups only, many thanks.
|||PS. Does the technet CD subscription have the latest version?
Thanks.
|||I have build .859 from SP3a installed. How do I know the latest build versions on PSS?
Also, I installed SQL Reporting. Did this install require a re-install of SP3a?
Thanks.
|||Hi Dslaby,
System Requirements for Reporting Services could be found at:
http://www.microsoft.com/sql/reporti...fo/sysreqs.asp
from which you could see that you must update to Service Pace 3a or higher
to install SQL Server Reporting Services
However, The hotfix I have mentioned is not publicly available through the
Microsoft website as it has not gone through full Microsoft regression
testing. If you would like confirmation that this fix is designed to
address your specific problem, or if you would like to confirm whether
there are any special compatibility or installation issues associated with
this fix, you are encouraged to speak to a Support Professional in Product
Support Services, by contacting us at 1-(800)936-5800 or by choosing one of
the options listed at
http://support.microsoft.com/default...d=sz;en-us;top
Based on my test, build 927 has eliminate this kind of issue.
Bottom line - have a good backup strategy.
Thank you for your patience and cooperation. If you have any questions or
concerns, don't hesitate to let me know. We are here to be of assistance!
Sincerely yours,
Michael Cheng
Microsoft Online Support
************************************************** *********
Get Secure! - www.microsoft.com/security
This posting is provided "as is" with no warranties and confers no rights.
Please reply to newsgroups only, many thanks.
|||I called the support number and they are unable to send me the patch without an article number. Could you email the patch? Thanks.

invalid cursor state

I am unable to save modifications to changes in a database. I get the follow
ing error:
- Unable to preserve security settings for user 'RIMSUser'.
ODBC error: [Microsoft][ODBC SQL Server Driver]Invalid cursor state
Any suggestions?Hi Dslaby,
From your description, I understand that you would like to make your
modifications successfully without error message "Invalid cursor state".
Have I fully understood you? If there is anything I misunderstood, please
feel free to let me know.
Before we go any further, I would like to collect more information from you:
1. Could you let me know what the front-end program that you ran the your
query is? Access or others?
2. Which SQL Statement you run? Did you try other SQL statements? Such as
Select, Insert into, Update, etc.. Will they get the same results?
3. Do you have the correct security authority to do modifications in SQL
Server? Could you login SQL Server as 'RIMSUser' in Query Analyzer and make
modifications for database?
4. Have you updated to the latest service pack for SQL Server and ODBC
Driver?
Moreover, you could get the latest updates from
Microsoft Data Access Components (MDAC) 2.8
http://www.microsoft.com/downloads/...0fe3-c795-4b7d-
b037-185d0506396c&DisplayLang=en
Microsoft SQL Server 2000 Service Pack 3a
http://www.microsoft.com/downloads/...d52c-0488-4e46-
afbf-acace5369fa3&DisplayLang=en
Please apply my questions and suggestions above and let me know the
results, and feel free to post it in the group.
Sincerely yours,
Michael Cheng
Microsoft Online Support
****************************************
*******************
Get Secure! - www.microsoft.com/security
This posting is provided "as is" with no warranties and confers no rights.
Please reply to newsgroups only, many thanks.|||1. I'm using Enterprise Manager
2. I've tried to modify the database fields in Enterprise Manager
3. I'm an administrator and logged on in using integrated security
4. I've kept the service packs up to date in SQL
Thanks.|||Hi Dslaby,
I don't know what your means about 'database fields', Does it mean
'datatype of the coloumn'?
In this case, it is an known issue especially when you are trying to change
it from FLOAT to INTEGER. We have an hotfix, however, This fix is not
publicly available through the Microsoft website as it has not gone through
full Microsoft regression testing. If you would like confirmation that
this fix is designed to address your specific problem, or if you would like
to confirm whether there are any special compatibility or installation
issues associated with this fix, you are encouraged to speak to a Support
Professional in Product Support Services, by contacting us at
1-(800)936-5800 or by choosing one of the options listed at
http://support.microsoft.com/defaul...id=sz;en-us;top
As a workaround, you could make your change by Query Analyzer
Thank you for your patience and cooperation. If you have any questions or
concerns, don't hesitate to let me know. We are here to be of assistance!
Sincerely yours,
Michael Cheng
Microsoft Online Support
****************************************
*******************
Get Secure! - www.microsoft.com/security
This posting is provided "as is" with no warranties and confers no rights.
Please reply to newsgroups only, many thanks.|||I was trying to change the length of a varchar from 250 to 1000. Now I get
this message:
- Unable to create index 'PK_tblJobBoard'.
ODBC error: [Microsoft][ODBC SQL Server Driver]Invalid cursor state
I am unable to do any modifications to any of the database objects in Enterp
rise Manager. I'll try reinstalling SQL 2000.|||Hi Dslaby,
ThereYou could try to do modification by Query Analyzer and you should
using ALTER statement like this if you want to alter column attribute
ALTER TABLE tableName ALTER COLUMN columnName columnType
(tableName, columnName and columnType should be changed according to your
own database settings)
More information about ALTER statement could be found at BooksOnline title
"ALTER TABLE" or MSDN Online:
ALTER TABLE
http://msdn.microsoft.com/library/d...-us/tsqlref/ts_
aa-az_3ied.asp
After you apply SQL Server 2000 Service Pack 3 (SP3) hotfix build versions
between 8.00.0859 and 8.00.0875, you will encounter this kind of message
when using SQL Enterprise Manager to alter table column. Based on my
testing, a SQL Server without service pack (build version 8.00.0194) and
latest hotfix (builder version 8.00.0927) will not encounter this kind of
issue.
(You could use select @.@.version to find your SQL Server Versions by using
Query Analyzer)
In Summary, I recommand you using Query Analyzer to modify table column or
contact Product Support Services for latest update.
Thank you for your patience and cooperation. If you have any questions or
concerns, don't hesitate to let me know. We are here to be of assistance!
Sincerely yours,
Michael Cheng
Microsoft Online Support
****************************************
*******************
Get Secure! - www.microsoft.com/security
This posting is provided "as is" with no warranties and confers no rights.
Please reply to newsgroups only, many thanks.|||PS. Does the technet CD subscription have the latest version?
Thanks.|||I have build .859 from SP3a installed. How do I know the latest build versio
ns on PSS?
Also, I installed SQL Reporting. Did this install require a re-install of SP
3a?
Thanks.|||Hi Dslaby,
System Requirements for Reporting Services could be found at:
http://www.microsoft.com/sql/report...nfo/sysreqs.asp
from which you could see that you must update to Service Pace 3a or higher
to install SQL Server Reporting Services
However, The hotfix I have mentioned is not publicly available through the
Microsoft website as it has not gone through full Microsoft regression
testing. If you would like confirmation that this fix is designed to
address your specific problem, or if you would like to confirm whether
there are any special compatibility or installation issues associated with
this fix, you are encouraged to speak to a Support Professional in Product
Support Services, by contacting us at 1-(800)936-5800 or by choosing one of
the options listed at
http://support.microsoft.com/defaul...id=sz;en-us;top
Based on my test, build 927 has eliminate this kind of issue.
Bottom line - have a good backup strategy.
Thank you for your patience and cooperation. If you have any questions or
concerns, don't hesitate to let me know. We are here to be of assistance!
Sincerely yours,
Michael Cheng
Microsoft Online Support
****************************************
*******************
Get Secure! - www.microsoft.com/security
This posting is provided "as is" with no warranties and confers no rights.
Please reply to newsgroups only, many thanks.|||I called the support number and they are unable to send me the patch without
an article number. Could you email the patch? Thanks.

intrusion detection, etc. for sql server

Does SQL Server 2000 Enterprise Edition have any built-in security features
for account management, such as logging user logins and locking an account w
hen a user uses the wrong password X number of times. If there is no built i
n functionality, has anyone
implemented these kinds of security features?
Thanks,
KatieThe only thing that SQL has is auditing for successfull and failed logins.
To protect your SQL Server and/or restrict access to it, you could put it
behind ISA server and only allow certain computers to connect.
We don't check for NT policies on password attempts.
Thanks,
Kevin McDonnell
Microsoft Corporation
This posting is provided AS IS with no warranties, and confers no rights.|||Hi! The functionality you are looking for (account lockouts) is already avai
lable on the OS side which I think is why it is no longer built into SQL Ser
ver. Just use Windows authentication if you need this functionality, but of
course you already knew tha
t..... HTH. =)|||Ricky - With the OS security, it can detect when someone tries to access SQL
Server with a SQL login and fails? I am not so worried about Windows logins
, but I want to prevent people opening up QA and trying to run a script on a
database using their appli
cation's SQL login.
Kevin - I found the SQL Server security feature on the Security tab of Serve
r Properties in EM, and I have checked the box to audit failed logins, but w
here do the failed logins get logged?
Thanks for all your help guys!|||Failed logins would be logged to the SQL Errorlogs and the NT Application
Event log. But you'll need to restart MSSQLServer to enable the changes.
Thanks,
Kevin McDonnell
Microsoft Corporation
This posting is provided AS IS with no warranties, and confers no rights.