MOSS 中的 PerformancePoint 仪表板权限问题
我有一个在 MOSS 2007 门户中运行的 PerformancePoint 仪表板。该仪表板包含一份在 SharePoint 集成模式下运行的 SSRS 2005 报告。
NT Authority\Authenticated Users 对包含 SSRS 报告的报告库、仪表板以及包含仪表板的报告库具有读取权限。
尝试访问仪表板的用户会收到以下错误消息：
授予用户的权限 '域名\名字.姓氏' 是 不足以执行此操作 手术。 （rsAccessDenied）
然后，单击 MOSS 中报告的直接链接的用户将毫无问题地看到报告。随后对仪表板的访问显示报告没有问题。
该报表使用的数据源位于报表位置上一级文件夹中。该报告已更新为在部署后指向正确的共享数据源。报告和数据来源均已发布。数据源使用存储的凭据，以及已设置为用作 Windows 凭据的域服务帐户。此服务帐户正在为其他区域的其他报告提供服务，没有任何问题。
编辑：
好的，我已经获得了关于这个问题的更多信息。实际上从未向数据源发出请求。用户进入仪表板并首次使用其识别自己的 kerberos 令牌请求报告。该报表在报表服务器数据库中查找，发现它们未在用户表中列出，并生成此 rsAccessDenied 错误。一旦他们直接查看报告，他们的名字就会出现在该表中，并且他们再也不会遇到问题。
不幸的是，从 RS 数据库的 Users 表中删除用户实际上并不会导致此错误再次发生。
我读过的所有内容都表明，当您在 MOSS 集成模式下运行报表服务器时，您的所有权限都在 MOSS 报表库级别处理，并且所有 Auth 用户都拥有报表库的权限，如前所述。有什么想法吗？
I have a PerformancePoint dashboard running in MOSS 2007 portal. The dashboard consists of one SSRS 2005 report, running in SharePoint Integrated mode.
NT Authority\Authenticated Users have read permissions to the report library containing the SSRS report, the dashboard, and the report library containing the dashboard.
Users that attempt to access the dashboard receive the following error message:
The permissions granted to user
'DOMAIN\firstname.lastname' are
insufficient for performing this
operation. (rsAccessDenied)
Users that then click on the direct link to the report in MOSS will see the report with no problem. Subsequent visits to the dashboard show the report with no problem.
The report is using a data source that is located one folder up from the report location. The report has been updated to point to the correct shared data source after deployment. Both the report and the data source have been published. The data source is using stored credentials, with a domain service account that has been set to Use as Windows credentials. This service account is serving other reports in other areas with no problem.
Edit:
Ok, I've gotten a lot more information on this problem. The request is never actually being made to the data source. The user comes in to the dashboard and requests a report for the first time using their kerberos token identifying themselves. The report looks in the Report Server database and finds that they are not listed in the users table and generates this rsAccessDenied error. Once they view the report directly their name is in this table and they never have the problem again.
Unfortunately, removing the user from the Users table in the RS database doesn't actually cause this error to happen again.
Everything I've read says that when you run a Report Server in MOSS integrated mode all your permissions are handled at the MOSS report library level, and all Auth users have permissions to the report library, as stated earlier. Any ideas?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（3）
听起来仪表板页面没有将凭据传递到报表服务器。因为您说过，如果用户直接点击报表，它就会起作用，然后如果他们通过仪表板，它就会起作用。那么它是否在一段时间后停止工作，表明缓存了会话？
我会仔细查看仪表板上性能点的属性，看看它是否正在传递凭据或尝试使用匿名。我希望这不是双跳和 Kerberos 的情况:(
It sounds like the dashboard page is not passing credentials to the report server. Because you stated if the user hits the report directly it works and then if they go through the dashboard it works. So does it stop working after a certain period, indicating a cached session?
I would look carefully at the properties on the dashboard in performance point to see if it is passing credentials or trying to use anonymous. I hope this isn't a case of double hop and Kerberos :(
我不确定这是否实际上是同一个问题，但您可以仔细检查数据源是否设置为“已批准”，而不是“待定”。这是一个延伸，但值得一试。
I'm not sure if this is actually the same issue, but you could double check that the data sources are set to "Approved", not "Pending". It's a stretch, but it's worth a shot.
我实施了一个解决方法：
我知道这是一个错误，甚至可能取决于页面的加载顺序。因此，我真的很想找出导致此问题的原因，以便我可以永久解决它。
编辑：
我不想接受我自己的答案，因为这只是一种解决方法。如果任何人都可以发布与放入报表服务器数据库的用户名相关的任何内容以及它与 SharePoint 集成模式的关系，您将获得奖励。
I implemented a work-around:
<iframe style="display:none;" src="https://link/to/my/report.rdl"></iframe>I know this is a kludgy, and might even be dependent on the loading order of the page. Therefore, I would really like to find out what's causing this issue so I can fix it for good.
Edit:
I don't want to accept my own answer, since it's just a work-around. If anyone can post anything relevant to the user name placed into the Report Server DB and how that relates to SharePoint Integrated mode, you'll get the bounty.