CODEWITHSUNDEEP
asp.netreporting-servicesssrs-2008
ns12345
ns12345

Reputation: 3105

Security for SSRS reports within an Asp.net application

If I pass in some Ids from an Asp.net application to SSRS server to render reports - how do I make sure that Ids are not read/modified by the end user?

One way I guess is to use ReportViewer control in Asp.net app and have SSL implemented, but is that foolproof? or are their better/alternate ways to implement security in such an app.

Upvotes: 1

Views: 643

Answers (2)

Frank Goortani
Frank Goortani

Reputation: 1433

You can also add your security to your report level. Use User!UserID to capture who is logging into your report. and check that with a dataset you create from the application database that manages the access rights to the reports. This way, you can filter the data from showing for wrong users.

Note: Please consider this as another layer to your system security and Do not rely only on this. There are ways that a power user can go around this.

Upvotes: 0

djangojazz
djangojazz

Reputation: 13171

Three levels you could do for security purposes:

  1. Change the default port on the SSRS server to something other than 80. EG: Change it to 81 and then someone needs to connect via: http:// (servername):81/ReportServer. Using a different port makes traffic not on the common internet port of 80 may be a good way to hide usage. This would also require that on the server hosting this port that you open this port up under Windows Firewall settings for use with this application.

  2. Use the HTTPS with a certificate to determine that connection is valid between a host and target.

  3. Set up only a single user on the SSRS Site aside from a local admin. Give that user read only rights. Set up your application to authenticate to the ReportViewer via remote mode but HARD CODE this value into your method, do not put in an app or web config. This way someone would have to have access to source code to be able to view user, they would not be able to get into the SSRS site to even see the user if they were not a local admin on the server hosting SSRS.

Those are my ideas anyways. Most of the time people have problems with SSRS being too secure to just get in versus yours you want more security. I hope some of this helps as I know that this method I cannot say is 100% foolproof(nothing is IMHO) but it now has added a level of complexity in adding a different port as well as a dedicated user with minimal permission only viewable by one other account but can be hardcoded in front end applications.

Upvotes: 1

Related Questions