Limiting data access in SSRS Report Builder 3.0 - sql-server

I have made a shared data source using Oracle but I do not want other SSRS users to create a new data set. I want the users to use only my shared data set.
I want to disable "Use a data set embedded in my report" radio button in report builder.
Can it be done?

Related

Set DSN for all reports

I have a Report folder on Report server and this folder have 73 reports. I have created the shared data source (DSN). Now, I want to change the data source of all reports in one go. Is there any option to set common dsn for all report?
I have right click on report and selected manage tab. After that in property window I have set the data source and its done successfully,
But doing same way for all report will take more time, so I want any shortcut for that.
Unfortunately no. SSRS has very few bulk operations like that. The reports though, are just XML (called RDL). One option would be to modify one, find out the change that was made, and to write a small program to update all the reports.

Refreshing external data (from SQL Server) in org chart in Visio

I have linked SQL Server employee data to create an org chart in Visio, but I can't figure out how to refresh the data in the org chart - for example if a new employee is added for this to automatically appear in the org chart, or if there is a change in title for an existing employee for this to update automatically.
I have tried the "Refresh All" under "Data" this didn't work. It refreshes the "external data" that appears on the side (which is what is linked from the SQL Server), however not the data in the actual org chart image.
Any suggestions on how to get this to properly link would be much appreciated.
You can use Organization Chart Wizard in Visio, to create Organization chart using datasource.
File tab, point to New, click Organization Chart, choose Metric Units
or US Units and then click Create.
In the wizard, You can choose to create a organization chart from existing data source. You can create from excel file or any ODBC compliant source. Read more
When you refresh report, it only updates the existing shapes. If you
want to add/remove shapes, you have regenerate report.

Dynamically decide salesforce object name and fields in SSIS Salesforce Integration Toolkit Connector

I want to know is this possible to do in SSIS Salesforce Integration Toolkit.
I have installed microsoft visual studio 2015 with SQL server data tools.
I am trying to download salesforce objects data to local SQL server 2016 database. In which I have excel sheet with two columns object name and fields (separated by comma).
So I used ForEach loop container to iterate over the list from excel sheet. And using row values I generated query string i.e. SOQL query.
I tried to provide dynamically generated SOQL query to salesforce source connection But its not working, salesforce source connection editor not taking the dynamic value instead showing error message as shown in below screenshot.
Kindly provide any valuable suggestions to resolve the issue.
I want to dynamically build SOQL query and provide this to Salesforce connector and retrieve data for all salesforce objects i.e offcourse inside loop container.
For the issue you are getting, can you please try to provide a default value for #[User:Fields] and #[User:Oname] to see if it makes any differences? By doing this, the component can have default fields and entity to initiate the metadata.
We would also like to mention that, since the metadata (columns in the Columns page) is defined in the design-time and cannot be changed dynamically during the runtime, so you cannot just simply change the fields in the SOQL query to update the columns during the runtime. This means that the fields need to be exactly the same for each iteration (i.e. entity).

How to secure SharePoint Shared SSRS Datasources

I have a large reporting SharePoint site that contains about a dozen different shared data source connections, each one pointing at a different SQL server that is being utilized by the SSRS reports hosted on the site. Each data source has a cached account that is used to retrieve the data when a report runs so that report readers do not have to have read access to all of our SQL databases.
When someone with report building privileges creates a report, they are able to select one of the shared data sources hosted on the website, but then have to pass an authentication popup before they can actually write a query against the database:
The strategy currently in use is that our authors do have read access to the SQL database and use that authentication (Use the current Windows user) to create the report and then when they save the report, readers utilize the account stored in the shared data source. We then manage access to the data in the report through SharePoint security by only allowing people who should see that data to have access to the report.
This seems all very standard to me...however
I am able to query any database that any of the shared data sources have access to, regardless of my own permissions with a bit of rdl definition manipulation by following these steps:
1) Current account needs access to report builder and AD access to at least one SQL datasource (to make things easier)
2) Add a shared data source to the report that I have access to
3) Add a dataset with a query that follows this format SELECT '' as Field1 FROM DBNAME
4) Add a table to the report that simply displays Field1 from the query
5) Add one of the shared data sources that I should have no access to (there is no stopping me from adding the shared connection to the report, I simply am unable to use report builder to create a dataset using that data source)
6) Save report on the SharePoint site and then download a copy to local computer
7) Open rdl definition. Replace the data source for the SQL query with the name of the "unauthorized" data source (can delete original data source). Replace the SQL query with one that queries the database for a list of table names (SELECT name as Field1 FROM sys.Tables)
8) Upload report definition back to SharePoint and run report
The report now uses the cached account and I've bypassed the nice authorization window that using report builder would have provided. By using sys queries, I can find the databases, tables, columns and eventually the data without having to know anything about the database. I could slow this method done by preventing access to the master database so that a list of databases can't be retrieved, but that's minor and not a complete solution.
Options:
- Could enforce security at the database level, however I don't want report readers to have permission against any of my source databases. While each report could be fed from a view and then separately controlled to prevent access to anything more than what the report shows, this would be uncontrollable
- Force every report to use an embedded connection and not a shared connection. This would be hard to manage in the future when moving servers or when we need to know what reports are utilizing a specific connection (dependent items are available in the data source drop down menu)
I feel like I'm missing something obvious here as this seems to totally defeat the purpose of hosted, shared data sources.
The advantages of Shared Data Sources are administrative, in that they reduce the overhead in making changes to data source connection details such as passwords and server names. As you pointed out, using Shared Data Sources also allows you to easily identify dependent reports.
However Shared Data Sources are not a mechanism for securing data sources such as databases. Security really needs to be addressed at the database level to properly ensure only authorized people have access. If the credentials are stored in the report data source, then anyone able to access that data source or refernce it in a report is going to be able to execute queries on the connection.
I think the issue is in this step:
5) Add one of the shared data sources that I should have no access to
(there is no stopping me from adding the shared connection to the
report, I simply am unable to use report builder to create a dataset
using that data source)
There should be some way to prevent the report designers seeing shared data sources that they do not have permissions on. You might need to set individual permissions for each item, or put them in different locations to allow them to be secured with the correct permissions. I'm not a Sharepoint expert though so this is just a suggestion.

Setting up an SSRS data source to show only some views from the database

I am currently looking at setting up a number of SSRS data sources to a warehouse but one issue I can not get around is how to define which views are available to each data source. Can someone share how to limit these down so that I can have multiple data sources acting as data marts from the single warehouse.
Currently using SQL 2008 r2.
Thanks
When you create a view you assign a permission set to the view (certain users/groups can do selects others can do selects and inserts and others have no permission on the view).
When you set up a connection through a datasource the user on the datasource will have the permissions assigned to them through the view. When you deploy the report you assign a user and password to the report (Data Source) and that user's permission will apply to what they can objects that, and the report, can see. The permissions assigned to the report allow users to see/execute the report.

Resources