SSRS 2005 基于参数的安全性
我在A公司工作。A公司有一个姐妹公司B。A公司和B公司使用相同的ERP数据库。我创建了一份可供两家公司使用的 SSRS 2005 报告。它有一个 CompanyID 参数，用于确定是否显示公司 A 或公司 B 的数据。
对于大多数报告来说，这没问题，但对于公司敏感信息（例如工资单），这将是一个问题，因为公司 A 的任何人都可以更改CompanyID 参数为公司 B 的 ID，反之亦然。
我处理此问题的最初想法是创建一个 链接报告对于每个公司各自的文件夹 A 和 B，其中文件夹 A 的安全性仅允许公司 A 用户，而文件夹 B 的安全性仅允许公司 B 用户。然后，我将向每个链接的报告添加默认的 CompanyID 参数并向用户隐藏这些参数。到目前为止，一切都很好。这样做的问题是您仍然可以使用 URL 查询字符串更改参数值。例如，公司 A 的用户可以将报表 URL 更改为：
http://server/ReportServer /ReportViewer.aspx?/Payroll/A&rs:Command=渲染
到：
http://server/ReportServer/ReportViewer.aspx?/Payroll/A&rs:Command=Render&CompanyID=B
隐藏的默认参数。
解决这个问题的好方法是什么？如果可能的话，我想分享两家公司之间的报告。
更新： 我们还有公司特定的 ASP.NET Intranet，它已经通过 AD 域限制了基于公司的访问。我想我可以使用 Intranet 页面上的 ReportViewer 控件来应用运行时适当的参数。我可能可以将此逻辑合并到可用于任何报告的通用报告页面中，对吧？ （请原谅我的无知，我是一个十足的SSRS n00b）
I work for company A. Company A has a sister company B. Both companies A and B use the same ERP database. I have created an SSRS 2005 report that can be used by both companies. It has a CompanyID parameter that determines whether to display data for company A or company B.
For most reports this will be OK, but for company sensitive information (such as payroll), this will be an issue since anybody at company A can change the CompanyID parameter to company B's ID, and visa versa.
My initial idea to handle this was to create a linked report for each company in their own respective folders, A and B, where security on folder A only allowed company A users and folder B security only allowed B users. Then I would add a default CompanyID parameter to each linked report and hide the parameters from the user. So far so good. The problem with this is that you can still change the parameter values using the URL query string. For example, a user at company A could change the report url from:
http://server/ReportServer/ReportViewer.aspx?/Payroll/A&rs:Command=Render
to:
http://server/ReportServer/ReportViewer.aspx?/Payroll/A&rs:Command=Render&CompanyID=B
Now they have completely bypassed the hidden default parameter.
What is a good approach to solve this? I would like to share reports between both companies if possible.
Update:
We also have company specific ASP.NET intranets that already restrict access based on company via AD domain. I suppose I could use the ReportViewer control on an intranet page to apply the appropriate parameters at run time. I could probably incorporate this logic into a generic report page that could be used for any report, right? (Please excuse my ignorance, I'm a total SSRS n00b)
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
你们这里的安全装置是什么？在我看来，一个可靠且安全的解决方案是根据用户帐户驱动对数据的访问。报告数据是如何收集的？是直接在你的数据集中SELECT吗？你是在调用程序吗？针对视图进行选择？
编辑：由于您正在选择联合各个公司数据的视图，因此如果您向具有访问权限的用户或角色授予对视图的权限，您可能能够创建一个场景，其中数据根据用户的信息返回给用户权利。
What is your security apparatus here? It seems to me a solid and secure solution would be to drive the access to data based on the user account. How is the report data gathered? Is it SELECT directly in your data set? Are you calling procedures? selecting against a view?
EDIT: Since you are selecting against a VIEW which unions the respective company data, if you grant rights to the views to the users or roles which have access you may be able to create a scenario where the data is returned to the user based on their rights.
您可以使用基于表达式的连接字符串，以便不必使用链接报告，但它仍然意味着将信息作为参数传递，该参数将在 GET 请求中公开。
您必须区分要为谁显示/运行报告，这是无法回避的问题。
You could use Expression Based Connection Strings in order to not have to use linked reports, but it still means passing information as a parameter which will get exposed in the GET request.
There's no getting around that you have to distinguish for whom the report is going to be displayed/run for.