SSRS Consuming WCF Service with Calling User Credentials Issue -
we have ssrs reports consume wcf service data needs use calling users credentials. on service side, use basic binding host service:
<binding name="thebasichttpbinding" maxreceivedmessagesize="50000000" transfermode="streamed"> <readerquotas maxarraylength="50000000"/> <security mode="transportcredentialonly"> <transport clientcredentialtype="windows"/> </security> </binding> <service behaviorconfiguration="defaultservicebehavior" name="web.theservice"> <endpoint binding="basichttpbinding" bindingconfiguration="thebasichttpbinding" name="servicehttpbinding" contract="web.itheservice"/> </service> during report development setup shared data source used of our reports. data source of type "xml" , points service endpoing .svc file. within each of our datasets make requests follows:
<query> <method name="getreferencedata" namespace="http://localhost/2009/theservice"> <parameters> <parameter name="type"></parameter> </parameters> </method> <soapaction>http://localhost/2009/theservice/itheservice/getreferencedata</soapaction> </query> our reports work on our development machines within vs2008 when calling our remotely hosted wcf service configurations , calls below.
also, our reports work when run them while logged ssrs reporting server , run them directly on ssrs reporting server within ie.
however, if access ssrs report links remotely (not sitting @ ssrs service machine) receive errors such:
an error has occurred during report processing. (rsprocessingaborted) execution failed shared data set 'clients'. (rsdatasetexecutionerror) query execution failed dataset ''. (rserrorexecutingcommand) failed execute web request specified url. unauthorized: remote server returned error: (401) unauthorized. (rsxmldataprovidererror) remote server returned error: (401) unauthorized. 401 - unauthorized: access denied due invalid credentials.
server error
401 - unauthorized: access denied due invalid credentials.
you not have permission view directory or page using credentials supplied.
--- end of inner exception stack trace --- @ microsoft.reportingservices.dataextensions.xmldp.inmemorycommand.executewebrequest(icredentials credentials) @ microsoft.reportingservices.dataextensions.xmldp.inmemorycommand.execute() @ microsoft.reportingservices.dataextensions.xmldp.inmemorycommand.<>c__displayclass1.b__0() @ microsoft.reportingservices.dataextensions.xmldp.webrequesthelper.executeservercallasntuser(servercall servercall, windowsidentity ntuser) @ microsoft.reportingservices.dataextensions.xmldp.inmemorycommand.executereader(commandbehavior behavior) @ microsoft.reportingservices.ondemandprocessing.runtimedataset.runembeddedquery(boolean& readerextensionssupported, boolean& readerfieldproperties, list
1 queryparams, object[] paramvalues) --- end of inner exception stack trace --- @ microsoft.reportingservices.ondemandprocessing.runtimedataset.runembeddedquery(boolean& readerextensionssupported, boolean& readerfieldproperties, list1 queryparams, object[] paramvalues) @ microsoft.reportingservices.ondemandprocessing.runtimedataset.rundatasetqueryandprocessasirowconsumer(boolean processasirowconsumer) @ microsoft.reportingservices.ondemandprocessing.runtimedataset.process() @ microsoft.reportingservices.ondemandprocessing.runtimedataset.processconcurrent(object threadset) --- end of inner exception stack trace --- @ microsoft.reportingservices.reportprocessing.reportprocessing.processshareddataset(datasetcontext dc, datasetdefinition datasetdefinition) @ microsoft.reportingservices.library.shareddataexecutioninstance.createdatachunk(ichunkfactory targetchunkfactory, string datachunkname) @ microsoft.reportingservices.library.shareddataexecutioninstance.execute(datasetinfo dataset, string targetchunknameinreportsnapshot, parameterinfocollection datasetparametervalues, reportprocessingcontext originalprocessingcontext, boolean originalrequestneedsdatachunk, irowconsumer originalrequest) @ microsoft.reportingservices.library.shareddatasetexecution.process(datasetinfo shareddataset, string targetchunknameinreportsnapshot, boolean originalrequestneedsdatachunk, irowconsumer originalrequest, parameterinfocollection datasetparametervalues, reportprocessingcontext originalprocessingcontext) @ microsoft.reportingservices.ondemandprocessing.runtimedataset.getshareddatasetchunkandprocess(boolean processasirowconsumer, datasetinfo datasetinfo, parameterinfocollection datasetparametercollection) @ microsoft.reportingservices.ondemandprocessing.runtimedataset.rundatasetqueryandprocessasirowconsumer(boolean processasirowconsumer) @ microsoft.reportingservices.ondemandprocessing.runtimedataset.process() @ microsoft.reportingservices.ondemandprocessing.runtimedataset.processconcurrent(object threadset) --- end of inner exception stack trace ---;
any ideas why our reports work within vs2008 calling our remote wcf service, , reports work fine when run directly on ssrs server ie, when calling these same report url's hosted on ssrs machine report processing error?
in order able access wcf service wsdl ssrs server, had add machine urls of our wcf service local intranet zones list in order don't challenged credentials. when remove these entries, don't have success ssrs reports when running them directly on ssrs machine itself. we're assuming issue lies in way user credentials passed ssrs , subsequent data source url connections established.
our datasource uses "windows integrated security" , account run within vs same account run ie on ssrs report server directly success. same account we're getting above exception when trying access ssrs report ie on remote machine.
anybody run before or have ideas? we've looked in ssrs logs not finding them helpful yet. note need run reports under actual end user credentials, these credentials need passed wcf service show/filter data based on permissions.
when setting "credentials stored securely in report server" true , storing own account (which used other successful tests), remote link works everyone. creates issue because wcf/xml requests used under context of credentials. need requests made using "windows integrated security" under context of calling user. question introduces, why if store credentials in report work remote users , myself, when setting datasource "windows integrated security" doesn't work me - same credentials.
update:
it seems "double hop" issue may we're experiencing: integrated security on reporting services xml datasource.
some articles found have same issue:
Comments
Post a Comment