In the healthcare and financial industries, where database applications often
process confidential information, using authentication and encryption to secure
access to data has become a common practice. Indeed, for companies that are
affected by industry regulations such as the Health Insurance Portability and
Accountability Act (HIPAA), securing data is an absolute requirement. For many
other industries, however, ensuring the security of reporting systems and the
databases they access remains a low priority on system designers' and administrators'
to-do lists because of its seeming complexity.
It doesn't have to be difficult, though, especially if you're using SQL Server
Reporting Services (SSRS) as your reporting system. Bundled with SQL Server
2005, SSRS can simplify securing your reporting data by using a role-based access
control (RBAC) model to leverage your existing Windows Server 2003 or Windows
2000 Active Directory (AD) infrastructure. Let's look at how you can configure
SSRS to secure access to your data.
Roles and Their Tasks
To understand SSRS's access-control model, you must first understand the RBAC
concept of a role. A role is a set of operations or tasks
that a particular subset of users needs to be able to perform. The exact combination
of tasks that constitute a role enables a particular type of user to do his
or her work (and nothing more or less) in the context of a given application.
For example, SSRS includes a Browser role for users who simply need to view
reports and a Publisher role for users who must view, manage, and publish reports.
To enforce RBAC, you link roles to an application's resources, then map roles
to user identities.
To get you started quickly on defining your report application's RBAC model,
SSRS includes a set of predefined roles. You can use the predefined roles to
secure SSRS resources or define custom roles and delete the predefined ones.
SSRS includes two predefined role categories:
- Item-level roles define what users and data administrators can do with SSRS
items such as report folders and reports.
- System-level roles define the administrative tasks that system users and
system administrators can perform on an SSRS server. Under system-level roles,
SSRS defines a restricted System User role and a broader System Administrator
role. If you assign a system administrator only a system-level role
and not an item-level role too, and the administrator isn't a local administrator,
then the administrator can perform only SSRS system administration tasks and
can't access SSRS report content. This is a very important point: System-level
roles don't convey any access to reports, report folders, or the SSRS report
folder hierarchy. Users who need access to those resources must have an appropriate
item-level role assignment.
SSRS predefines 16 item-level tasks and 9 system-level tasks. Together, these
25 tasks cover all actions a user or administrator can perform in SSRS. Web
Tables 1 and 2 (http://www.sqlmag.com,
InstantDoc ID 95730) show the item-level and system-level task assignments for
the predefined SSRS roles. Unlike with SSRS roles, you can't define your
own tasks or delete predefined tasks.
Configuring Roles and Their Tasks
To view or edit the default SSRS roles and their task assignments or to define
custom roles, you can use the GUI-based SQL Server Management Studio (SSMS)
or the Web-based SSRS Report Manager.
To use SSMS to define SSRS roles, start SSMS. In the Connect to Server
dialog box, type the name of your SSRS server, making sure that you select the
Reporting Services option in the Server type drop-down box; enter your
credentials and an authentication method, and click Connect. You'll see the
SSMS configuration dialog box. To view the predefined item- and system-level
roles, expand the Security container. The item-level roles are in the Roles
container, and the system-level roles are in the System Roles container. To
view the task assignments for a role, double-click the role, or right-click
the role and select Properties.
To modify predefined roles and their task assignments, open Report Manager
in Microsoft Internet Explorer (IE) by going to http://Your_SSRS_Server_Name/reports.
Click Site Settings in the top right corner of the SSRS Home page. At the bottom
of the Site Settings page, click Configure item-level role definitions
or Configure system-level role definitions to bring up a list of the
itemlevel or system-level role definitions. From this list, click a role to
edit its description or to view and modify its task assignments. Figure
1 shows the task assignments for the predefined Publisher role.
Role Assignments
You can leverage roles to enforce access control on SSRS resources such as reports,
report folders, and configuration settings. A nice, timesaving feature of SSRS
is the ability to leverage the Windows user accounts and groups that are defined
in AD to control access to SSRS resources.
When you first access a brand new SSRS installation, you immediately experience
the effects of SSRS role assignments. Because by default only the BUILTIN\Administrators
group is assigned the Content Manager and System Administrator roles, only the
members of the BUILTIN\Administrators group (which in an AD domain environment
includes enterprise administrators and domain administrators) can access an
SSRS server's report content and configuration. If you want to allow any other
user to access an SSRS system and its content, you must log on to Windows using
an administrator account that's a member of the BUILTIN\Administrators group,
then assign the user's AD account an item- or system-level role from one of
the SSRS role assignment configuration interfaces, a process which I describe
later.
Prev. page
[1]
2
next page 
