Help with Custom Security Extension and Application Pool Identity

This is an interesting one.
We have implemented a custom security extension that we call from
within an application. We pass in a userid and password into the
LogonUser method, which is then checked against our database.
However, we have a Master database, and then a few other small
databases for different clients, so the extension uses another
supplied value to go to the master database, and lookup which database
it needs to verify the user in.
So, in the RSReportServer.config file, we store the connection string
to the Master DB.
This is used to connect to the Master DB, and then lookup the
connection string for the secondary DB.
The connection string for the secondary DB uses Integrated
Authentication (as our application requires this).
When the Application Pool (in IIS) that ReportServer runs under, is
set to the NetworkUser, we get an error returned from the WebService
(called from within our application), which says that the Network
Service was not authorized to access the secondary DB. Understandable
:)
So, we changed the Application Pool, so that it uses a Domain account
as it's Identity. Now we receive the following error back (and in all
the log files I can find)..
System.Web.Services.Protocols.SoapException: An internal error
occurred on the report server. See the error log for more details.
--> Microsoft.ReportingServices.Diagnostics.Utilities.InternalCatalogException:
An internal error occurred on the report server. See the error log for
more details. --> System.IO.FileNotFoundException: The system cannot
find the file specified. at
System.Runtime.InteropServices.Marshal.ThrowExceptionForHR(Int32
errorCode, IntPtr errorInfo) at
RSManagedCrypto.RSCrypto.ExportPublicKey() at
Microsoft.ReportingServices.Library.ConnectionManager.GetEncryptionKey()
at Microsoft.ReportingServices.Library.ConnectionManager.ConnectStorage()
at Microsoft.ReportingServices.Library.ConnectionManager.VerifyConnection()
at Microsoft.ReportingServices.Library.ConnectionManager.get_Connection()
at Microsoft.ReportingServices.Library.Storage.get_Connection() at
Microsoft.ReportingServices.Library.Storage.NewStandardSqlCommand(String
storedProcedureName) at
Microsoft.ReportingServices.Library.DBInterface.GetOneConfigurationInfo(String
key) at Microsoft.ReportingServices.Library.CachedSystemProperties.GetSystemProperty(String
name) at Microsoft.ReportingServices.Library.CachedSystemProperties.Get(String
name) at Microsoft.ReportingServices.Library.CachedSystemProperties.GetParameter(String
name) at Microsoft.ReportingServices.Library.RSService.get_MyReportsEnabled()
at Microsoft.ReportingServices.Library.RSService.PathToInternal(String
source) at Microsoft.ReportingServices.Diagnostics.CatalogItemContext.SetPath(String
path, Boolean validate, Boolean convert, Boolean translate) at
Microsoft.ReportingServices.Diagnostics.CatalogItemContext.SetPath(String
path) at Microsoft.ReportingServices.Diagnostics.CatalogItemContext..ctor(IPathTranslator
pathTranslator, String userSuppliedPath, String parameterName) at
Microsoft.ReportingServices.Library.RSService.FindItems(String folder,
String operation, SearchCondition[] properties) -- End of inner
exception stack trace -- at
Microsoft.ReportingServices.Library.RSService.FindItems(String folder,
String operation, SearchCondition[] properties) at
Microsoft.ReportingServices.WebServer.ReportingService.FindItems(String
Folder, BooleanOperatorEnum BooleanOperator, SearchCondition[]
Conditions, CatalogItem[]& Items) -- End of inner exception stack
trace -- at Microsoft.ReportingServices.WebServer.ReportingService.FindItems(String
Folder, BooleanOperatorEnum BooleanOperator, SearchCondition[]
Conditions, CatalogItem[]& Items)
The Application Pool User is a member of the IIS_WPG group, and has
been granted write access to the Windows\Temp folder, and the MSSQL
folder where RS is installed (and sub folders).
I also tried adding it to the local machine admin group, and it made
no difference.
That user also has DBO access to all the DBs on our database server.
Can anyone help please?
Thanks
RichardWill you send the report server web service log file?
Also, can you verify that the new identity has a user profile on the machine
(the user should have an entry under c:\Documents and Settings)?
--
This posting is provided "AS IS" with no warranties, and confers no rights
"Richard Greenwell" <lazygun@.gmail.com> wrote in message
news:42b7583d.0406251224.18af1b8@.posting.google.com...
> This is an interesting one.
> We have implemented a custom security extension that we call from
> within an application. We pass in a userid and password into the
> LogonUser method, which is then checked against our database.
> However, we have a Master database, and then a few other small
> databases for different clients, so the extension uses another
> supplied value to go to the master database, and lookup which database
> it needs to verify the user in.
> So, in the RSReportServer.config file, we store the connection string
> to the Master DB.
> This is used to connect to the Master DB, and then lookup the
> connection string for the secondary DB.
> The connection string for the secondary DB uses Integrated
> Authentication (as our application requires this).
> When the Application Pool (in IIS) that ReportServer runs under, is
> set to the NetworkUser, we get an error returned from the WebService
> (called from within our application), which says that the Network
> Service was not authorized to access the secondary DB. Understandable
> :)
> So, we changed the Application Pool, so that it uses a Domain account
> as it's Identity. Now we receive the following error back (and in all
> the log files I can find)..
> System.Web.Services.Protocols.SoapException: An internal error
> occurred on the report server. See the error log for more details.
> -->
Microsoft.ReportingServices.Diagnostics.Utilities.InternalCatalogException:
> An internal error occurred on the report server. See the error log for
> more details. --> System.IO.FileNotFoundException: The system cannot
> find the file specified. at
> System.Runtime.InteropServices.Marshal.ThrowExceptionForHR(Int32
> errorCode, IntPtr errorInfo) at
> RSManagedCrypto.RSCrypto.ExportPublicKey() at
> Microsoft.ReportingServices.Library.ConnectionManager.GetEncryptionKey()
> at Microsoft.ReportingServices.Library.ConnectionManager.ConnectStorage()
> at
Microsoft.ReportingServices.Library.ConnectionManager.VerifyConnection()
> at Microsoft.ReportingServices.Library.ConnectionManager.get_Connection()
> at Microsoft.ReportingServices.Library.Storage.get_Connection() at
> Microsoft.ReportingServices.Library.Storage.NewStandardSqlCommand(String
> storedProcedureName) at
>
Microsoft.ReportingServices.Library.DBInterface.GetOneConfigurationInfo(Stri
ng
> key) at
Microsoft.ReportingServices.Library.CachedSystemProperties.GetSystemProperty
(String
> name) at
Microsoft.ReportingServices.Library.CachedSystemProperties.Get(String
> name) at
Microsoft.ReportingServices.Library.CachedSystemProperties.GetParameter(Stri
ng
> name) at
Microsoft.ReportingServices.Library.RSService.get_MyReportsEnabled()
> at Microsoft.ReportingServices.Library.RSService.PathToInternal(String
> source) at
Microsoft.ReportingServices.Diagnostics.CatalogItemContext.SetPath(String
> path, Boolean validate, Boolean convert, Boolean translate) at
> Microsoft.ReportingServices.Diagnostics.CatalogItemContext.SetPath(String
> path) at
Microsoft.ReportingServices.Diagnostics.CatalogItemContext..ctor(IPathTransl
ator
> pathTranslator, String userSuppliedPath, String parameterName) at
> Microsoft.ReportingServices.Library.RSService.FindItems(String folder,
> String operation, SearchCondition[] properties) -- End of inner
> exception stack trace -- at
> Microsoft.ReportingServices.Library.RSService.FindItems(String folder,
> String operation, SearchCondition[] properties) at
> Microsoft.ReportingServices.WebServer.ReportingService.FindItems(String
> Folder, BooleanOperatorEnum BooleanOperator, SearchCondition[]
> Conditions, CatalogItem[]& Items) -- End of inner exception stack
> trace -- at
Microsoft.ReportingServices.WebServer.ReportingService.FindItems(String
> Folder, BooleanOperatorEnum BooleanOperator, SearchCondition[]
> Conditions, CatalogItem[]& Items)
> The Application Pool User is a member of the IIS_WPG group, and has
> been granted write access to the Windows\Temp folder, and the MSSQL
> folder where RS is installed (and sub folders).
> I also tried adding it to the local machine admin group, and it made
> no difference.
> That user also has DBO access to all the DBs on our database server.
> Can anyone help please?
> Thanks
> Richard|||I have emailed you the log file for this problem.
The user that the application pool runs under does not have an entry
under Docs and Settings, but it is a different user to that which the
Report Server Windows Service runs under, which Does have an entry
under Docs and Settings.
I have never seen an app pool user have a Docs and Settings folder :)
Thank you
Richard
"Brian Hartman [MSFT]" <brianhartman@.hotmail.com> wrote in message news:<OTBYLlYXEHA.748@.TK2MSFTNGP11.phx.gbl>...
> Will you send the report server web service log file?
> Also, can you verify that the new identity has a user profile on the machine
> (the user should have an entry under c:\Documents and Settings)?
> --
> This posting is provided "AS IS" with no warranties, and confers no rights
>
<snip>sql

help with celkos tree model

hello i have implemented joe celko's model to store heirarchy and it
works well and nice
i have a question about SQL

this is the actual table

member side left right
-------------
nancy L 1 36
andrew L 4 21
steven R 5 12
ina L 6 7
david R 10 11
margaret L 13 20
ann R 14 15
laura L 18 19
janet R 24 35
michael L 25 30
dan R 26 27
ron L 28 29
robert R 33 34

the Side column is to tell its left, or right. this is a binary
heirarcy.
i have this problem i have to solve, im still banging my head. If
given the member

'Nancy' , i need to find left-most(Laura) and right-most(Robert)
'Janet' = left most is ron, right most is robert
'Andrew = left most is laura, right most is David

Hope u get my plan. could u help me with the sql ?On 24 Oct 2004 23:04:40 -0700, Nick Chan wrote:

>hello i have implemented joe celko's model to store heirarchy and it
>works well and nice
(snip)
>the Side column is to tell its left, or right. this is a binary
>heirarcy.

Hi Nick,

You seem to have a slight misunderstanding about Joe Celko's nested set
model. A bit of googling got me this quote (from a message in another
newsgroup, written by Joe Celko himself):

"The nested set model has an implied ordering of siblings which
the adjacency list model does not."

From the context, it was clear that Joe meant that for each pair of
siblings, the one with the lower lft and rgt values should be considered
to be to the left of the one with the higher lft and rgt values.

I've drawn a picture of your hierarchy with the "left" descendant always
on the left side and the "right" descendant always on the right side; then
I re-assigned the lft and rgt numbers according to Joe Celko's nested set
model. The result looks like this:

member lft rgt
--------
nancy 1 26
andrew 2 15
margaret 3 8
laura 4 5
ann 6 7
steven 9 14
ina 10 11
david 12 13
janet 16 25
michael 17 22
ron 18 19
dan 20 21
robert 23 24

>i have this problem i have to solve, im still banging my head. If
>given the member
>'Nancy' , i need to find left-most(Laura) and right-most(Robert)
>'Janet' = left most is ron, right most is robert
>'Andrew = left most is laura, right most is David

After re-arranging the lft and rgt values as above, it's not too hard
anymore:

SELECT o.member AS member, l.member AS leftmost, r.member AS rightmost
FROM hierarchy AS o
INNER JOIN hierarchy AS l
ON l.rgt = (SELECT MIN(rgt)
FROM hierarchy
WHERE lft BETWEEN o.lft AND o.rgt)
INNER JOIN hierarchy AS r
ON r.lft = (SELECT MAX(lft)
FROM hierarchy
WHERE lft BETWEEN o.lft AND o.rgt)
WHERE o.member IN ('nancy', 'janet', 'andrew')

Best, Hugo
--

(Remove _NO_ and _SPAM_ to get my e-mail address)|||>> I have implemented Joe Celko's model to store heirarchy and it
works well and nice I have a question about SQL <<

You might want to buy a copy of my book TREES & HIERARCHIES IN SQL :)

>> This is the actual table .. the Side column is to tell its left, or
right. This is a binary heirarchy. <<

I have a better model for binary trees! Remember "heapsort" from your
first data structures/algorithms class in college?

CREATE TABLE Heap
(member CHAR(15) NOT NULL,
place INTEGER NOT NULL PRIMARY KEY
CHECK(place > 1);

root = 1
place of left child of member (n) = (2*n)
place of right child of member (n) = (2*n +1)

Use integer division to travel toward the root of the tree.

('Somebody', 2, 3) is missing in the data you posted, but it looks
like ('nancy', 1) is the root of the tree.

>> 'Nancy', I need to find left-most(Laura) and right-most(Robert) <<

Is this correct? I keep going left (or right) until I get to a leaf
node in the tree or to a node without a left (or right) child:

A
/ \
/ \
B C
/ \
/ \
D E

leftmost(A) = B
rightmost(A) = E
leftmost(C) = D
rightmost(C) = E
leftmost(D) = NULL
rightmost(D) = NULL

So the leftmost(n) member is MAX(2* .. (2*n) ..) if the whole
generated set is in the heap. The rightmost(n) member is MAX(2* ..
(2*n+1) ..+1) +1) if the whole generated set is in the heap.

You can use a loop, recursion or a look-up table for the math.|||Saw the first part of your question on experts-exchange and asked a
buddy of mine (Corey Aldebol) how his tree model would work for your
problem. Take a look here for his reply:
http://www.sqlteam.com/forums/topic.asp?TOPIC_ID=41772

*** Sent via Developersdex http://www.developersdex.com ***
Don't just participate in USENET...get rewarded for it!