AD security group issues in SharePoint 2013 Integrated Mode
Hello,
Sorry if this is the wrong forum, I'm not sure if this is a SharePoint issue or a Reporting Services configuration issue (or if it should be in a SharePoint forum regardless).
I have SSRS2012 on SharePoint 2013 in integrated mode. We are doing item level permissions, which means we have an AD security group Reports-All with
Read to the Reports document library, then each actual report has unique permissions. We have a report with the ProjectManagers AD
security group on it with Read (plus some other stuff to let them manage subscriptions), and another AD security group ProjectUsers with
just Read access so they can open the reports. The data source used by this report has the AD security group I mentioned before, Reports-All,
with Read.
At a SharePoint level, things appear to work. When a user in ProjectManagers or ProjectUsers browses
to the library, they see only the 3 reports that those two security groups have permission to see (out of a lot more in the library). That means SharePoint is reading those security group memberships correctly as far as I can tell.
The issue is when a user in ProjectManagers or ProjectUsers clicks
on a report, they get a reporting server based error message, and the ULS logs have an error specific to the user trying to run the report.
Microsoft.ReportingServices.Diagnostics.Utilities.AccessDeniedException: The permissions granted to user 'MyDomain\MyUser' are insufficient for performing this operation. (Fault Detail is equal to Microsoft.ReportingServices.ServiceContract.RsExceptionInfo)
If I add that specific user with Read permissions to the report and the data source, they are then able to run the report without errors. It seems like some Report Server component is not liking the fact that I'm using security groups.
Has anyone seen this behavior with AD security groups? Any ideas on why my environment does not want to work properly with those even though AD security groups are working fine for other non-Reporting Services files?
Thanks,
Aaron
Hi aaronzott,
According to your description, you configured SSRS 2012 of SharePoint integrated mode. You added read permission to reports and data source to AD security group Reports-All, then added just read permission to ProjectManagers and ProjectUsers groups. When
users in ProjectManagers or ProjectUsers groups click report, the error message occurred. After you added Read permissions to the report and the data source to the groups, they can preview the report without errors.
Report definition permissions are defined through List permissions on the library that contains the report, but we can set permissions on individual reports if we want to restrict access. Set properties on a report including data source connection information,
processing options, and parameter properties. Edit Items on the library that contains the report or on the individual report. We also need to have view permissions on a shared data source (.rsds) to select it for use with the report.
For more information about Set Permissions for Report Server Operations in a SharePoint Web Application, please refer to the following document:
http://msdn.microsoft.com/en-us/library/bb326286(v=sql.110).aspx
If you have any more questions, please feel free to ask.
Thanks,
Wendy Fu
If you have any feedback on our support, please click
here.
Similar Messages
-
Where yo find reporting services log files in sharepoint 2013 integrated mode
i use to find the reporting services log files in the msrs folder in sharepoin 2010 integrated mode. but when we migrated to sharepoint 2013. i am not able to find the logs.i wanted to check all the executed sql statement using the logs as we don't have
access to sql server profiler. does anybody know the location of yhe logs?Hi there,
Not sure you'll see the sql statements however you can find information on the ULS logs here:
http://technet.microsoft.com/en-us/library/cc627510(v=sql.105).aspx
http://technet.microsoft.com/en-us/library/ff487871(v=sql.105).aspx
and here:
http://technet.microsoft.com/en-us/library/ms156500(v=sql.105).aspx
You might want this once ULS log is capturing info.
http://archive.msdn.microsoft.com/ULSViewer
cheers,
Andrew
Andrew Sears, T4G Limited, http://www.performancepointing.com -
SSRS 2014 with SharePoint 2013 - Integrated Mode vs Native Mode Questions
Hi,
We are using SharePoint 2013 and SQL Server 2014.
We are building a number of SSRS Reports that pull data from SQL Databases. (Pl note, we are not pulling any data from SharePoint Lists)
We have to make a choice between running the Reports in Native Mode or SharePoint Integrated Mode.
We saw this link: https://technet.microsoft.com/en-us/library/bb326290(v=sql.105).aspx - but it has no updated version for SQL 2014.
We have questions on which one to choose - based on what criteria, based on performance (which will be faster), other benefits, pros and cons and also on things that work only on SharePoint Integrated Mode and things that work only on Native Mode.
Would appreciate guidance on the above.
Thanks
Karthick S
Karthick SHi Karthick S,
If you had install Sharepoint server, then configure the Reporting Services in Sharepoint mode to take advantage of the Sharepoint. However, when you run a report in the SharePoint integrated mode in SQL Server Reporting Services, the report may run noticeably
slower than when you run the same report in native mode.More details information please reference to:General overhead performance differences when you view reports in SharePoint integrated mode versus in SharePoint
native mode
For more information about the features supported by Reporting Services in Sharepoint Integrated Mode(SSRS 2014), please see below article:
Reporting Services Report Server (SharePoint Mode)
Similar thread for your reference:
SSRS naitive Mode VS Share Point Integrated Mode
SQL Server Reporting Services - Native Mode or SharePoint Integrated Mode?
If you still have any problem, please feel free to ask.
Regards,
Vicky Liu
If you have any feedback on our support, please click
here.
Vicky Liu
TechNet Community Support -
Issues with SharePoint 2013 after upgrading from windows 2012 to 2012 r2
We have a Sharepoint with Sp1 environment on windows 2012. Recently we upgraded the windows 2012 to 2012 r2. After the upgrade sharepoint environment is completely unstable.
At first all the sites returned 401 errors. After resolving by resetting the object cache accounts the sites are back.
Then i see that none of the performance point dashboards work. I figured that claims to windows token service is defaulted to local system account. I previously configured with a domain account. I reconfigured to work with domain account.
All the dashboard pages throw error.
Some Error logs:Failed to get document content data. System.ComponentModel.Win32Exception (0x80004005): Cannot complete this function at Microsoft.SharePoint.SPSqlClient.GetDocumentContentRow
Application error when access /Dashboards/Performance Dashboard/Main.aspx, Error=The EnableScriptGlobalization property cannot be changed during async postbacks or after the Init event. at System.Web.UI.ScriptManager.set_EnableScriptGlobalization(Boolean
value)
4. I tried to create a new dashboard and this time the performancepoint designer wont launch. After some troubleshooting i see that c2w host file didnot have the caller C:\Program Files\Windows Identity Foundation\v3.5.
I added <add value="WSS_WPG" /> and now it launches
5. Now the Dashboard launches and peruser identity works without having kerberos enabled at IIS. I have all the spn and required delegations setup for this url . But i did not configure at the IIS level
yet.
It looks like lot of things got messed up and reset. Can we upgrade to windows 2012 r2 with a sharepoint application inplace. what is the recommended approach and Whats happening with Performancepoint dashboards. IS there a known issue with sharepoint 2013
sp1.
Raj-ShptThanks for the above article. Few issues are solved . One of the main issue is with Performancepoint Dashboard.
I have all the spn and required delegations setup for this url . But i did not configure at
the IIS level yet. Still per user identity works without having kerberos enabled at IIS.
Raj-Shpt -
Issue in sharepoint 2013 designer workflow kickoff
We are facing issues in sharepoint 2013 designer workflow kickoff. When we kick off custom designer workflow using AD user with contribute/approve access, sendemail from task does not send an email. When we kickoff using administrator account task in
the designer workflow sends an email. There seems to be multiple issues with kickoff. and it even does not give any error task gets created but send email does not work.
Another issue in another approach-
We are also not able to kickoff using one AD account which we are not login in everyday. If we kickoff using this account after 2/3 days kickoff says invalid state of object for that user. Once we login manually with that admin workflow kick off account
again kick off starts. We do not want to let current user kickoff the workflow.
In both cases we are using new AD import in sp2013 and sync is done every 5 minutes.
MCTS Sharepoint 2010, MCAD dotnet, MCPDEA, SharePoint LeadMay be a permission issue, see whether the contributor has enough permission to participate in the workflow.
Also try to set Design permission to test and see whether that works.
Hope this helps!
Ram - SharePoint Architect
Blog - SharePointDeveloper.in
Please vote or mark your question answered, if the reply helps you -
We are attempting to add OfficeWriter report rendering extensions for SSRS 2012 in SharePoint (2010) integrated mode through powershell. The documentation for “New-SPRSExtension” is rather
sparse and we have not found any clear examples on the internet. With SSRS 2012 in native mode, we make the following two changes to the config files:
We add the following report rendering extension declaration to
RSReportServer.config:
<Configuration>
<Extensions>
<Render>
<Extension Name="XLTemplate" Type="SoftArtisans.OfficeWriter.ReportingServices.ExcelTemplateRenderer,
SoftArtisans.OfficeWriter.RS2008"/>
<Extension Name="WordTemplate" Type="SoftArtisans.OfficeWriter.ReportingServices.WordTemplateRenderer,
SoftArtisans.OfficeWriter.RS2008"/>
</Render>
</Extensions>
</Configuration>
We add the following security trust codegroup to
RSSvrPolicy.config:
<configuration>
<mscorlib>
<security>
<policy>
<PolicyLevel version="1">
<CodeGroup version="1" PermissionSetName="Nothing">
<CodeGroup
version="*"
PermissionSetName="FullTrust"
Name="SoftArtisans_OfficeWriter_Strong_Name"
Description="This
code group grants SoftArtisans OfficeWriter code full trust.">
<IMembershipCondition
class="StrongNameMembershipCondition"
version="*"
PublicKeyBlob="00240000048000009400000006020000002400005253413100040000010001004779CB207F11
5E86EF9DD3233F9F130F8891911345176650F72330F84CA3F54C96DEB08439680660F02872EEF5DA3955
A14C63F96E57DFB71B1535280C37DA2CB5BA37D78A9882414DB11F67FD66DEBC4AD93DD34F4A587D34D
B4D23D9C6AF83431D88A7EF42BB01082913F3560DCB50129C5BBA7ECA0DE8BC286DA74F58FADE"/>
</CodeGroup>
</CodeGroup>
</PolicyLevel>
</policy>
</security>
</mscorlib>
</configuration>
What would be the equivalent syntax for “New-SPRSExtension” to do the above for SSRS 2012 in SharePoint (2010) integrated mode?
Alison Bird SoftArtisans Technical Services www.softartisans.comHi Alison,
Unlike the deployment of other custom extensions such as custom delivery extension and data processing extension, it is not necessary to add a code group for the custom assembly that grants FullTrust permission for the extension during the deployment of
custom rendering extension. If you have copy the custom assembly to the %ProgramFiles%\Microsoft SQL Server\MSRS11.<InstanceName>\Reporting Services\ReportServer\Bin folder, and modify the RSreportserver.config file to add the extention entry properly,
please open the SSRS Service Application created on the SharePoint and verify that your extension is included in the list of available export types for a report.
Reference:
Deploying a Rendering Extension
Regards,
Mike Yin
TechNet Community Support -
Office Web Apps Load Balancing Configuration Issue for SharePoint 2013
I have load balanced servers dedicated for Office Web Apps with name “md1xxxwfe1” and “md1xxxwfe2”
, both this servers are load balanced by CISCO Load balancer. And I have mapped Load Balancer Virutal IP with host name officeapps.jda.corp.local in the DNS records.
Things are working fine if I add new farm by using New-OfficeWebAppsFarm
with server name as internalurl in PowerShell console
as like “ -internalurl http://
md1xxxwfe1 but when I use –internalurl officeapps.jda.corp.local it is not working at all. I’m not getting what to do at this point.
I have gone through following blogs but no luck.
http://blogs.technet.com/b/meamcs/archive/2013/03/27/office-web-apps-2013-multi-servers-nlb-installation-and-deployment-for-sharepoint-2013-step-by-step-guide.aspx
http://blogs.technet.com/b/office_resource_kit/archive/2012/09/11/introducing-office-web-apps-server.aspx
http://davidlimsharepoint.blogspot.in/2013/02/installing-and-configuring-office-web.html
http://sps2013.blogspot.in/2013/09/office-web-apps-with-sharepoint-2013.html
The output of the wfe1 server is attached with this. When I open http:// /hosting/discovery in wfe1 I’m getting following result (attached
screenshot) but it should show hostname rather than server name.
Please help me
Thanks, Ram ChHi Ram ,
For troubleshooting your issue, please take steps as below:
Just about any load balancing solution will work, including a server that runs the Web Server (IIS) role running Application Request Routing (ARR):Install
Application Request Routing
Install the certificate on the load balancer as described under Securing Office Web Apps Server communications by using
HTTPS.
Make sure you have configured the cluster correctly for full internet name:
Reference:
http://technet.microsoft.com/en-us/library/jj219435.aspx#loadbalancer
Thanks,
Eric
Forum Support
Please remember to mark the replies as answers if they help and unmark them if they provide no help. If you have feedback for TechNet Subscriber Support,
contact [email protected]
Eric Tao
TechNet Community Support -
Impersonation based on security groupe dosent work Exchanfge 2013 sp1 ru 5
New-ManagementScope -Name:mcscope -RecipientRestrictionFilter {MemberOfGroup -eq "cn=Securitygroupe,ou=temp,dc=contoso,dc=com"}
when i use the management scope in a New-ManagementRoleAssignment , the users that is in the security groupe
impersenation does not Work..
the impersenation is for crm 2013 ..
wil be nice if i can get som help on this one :-)
TNXHello,
Thank you for your post.
This is a quick note to let you know that we are performing research on this issue.
If you have feedback for TechNet Subscriber Support, contact
[email protected]
Simon Wu
TechNet Community Support -
Work Manager Configuration Issue with SharePoint 2013
Hi,
We are facing issue to configure the Workflow Manager with SharePoint 2013.
===========================================================
Please provide any solution/inputs to resolve this issue.
Thanks.Hi ,
According to your description, my understanding is that you got an error when you configured Workflow Manager for SharePoint 2013.
For resolving your issue, please do as the followings:
1.Start -> Programs -> Workflow Manager 1.0 -> Workflow Manager Configuration -> Remove from Farm (not to be confused with SharePoint “farm”)
2.Drop SQL databases for Workflow Manager. (SbGatewayDatabase, SbManagementDB, SBMessageContainer01, WFInstanceManagementDB, WFManagementDB, WFResourceManagementDB)
3.Start-> Programs-> Workflow Manager 1.0 -> Workflow Manager Configuration -> Configure Workflow Manager with Default Settings (Recommended)
4.Ran the wizard just like before and it should be completed successfully this time.
More information, please refer to the link below:
http://www.spjeff.com/tag/workflow-manager-1-0/
I hope this helps.
Thanks,
Wendy
Wendy Li
TechNet Community Support -
Limitations of SharePoint 2013 integration with Exchange 2010?
Customer using SharePoint 2013 and looking at whether its possible to integrate this with Exchange 2010 and which features would be available / limitations. Looking for a matrix similar to those found in the Good, Better, Best documents available for previous
versions. Nothing available on Recently Published content for SharePoint 2013 yet http://technet.microsoft.com/en-us/library/cc262043.aspxI haven't seen a specific list, but the three features I've run into that only work with Exchange 2013 are eDiscovery in Exchange, Automatic Task Synchronization with Outlook and the Site Mailbox feature. There is a Legacy Task Synchronization mode
available that will work with Exchange 2010 if you turn off the Farm level feature controlling Exchange 2013 task synchronization. It lets users manually sync specific task lists with Outlook. But there is no task aggregation. I found this
whitepaper helpful for exploring the new features and how to turn them off when using Exchange 2010.
http://www.microsoft.com/en-us/download/details.aspx?id=38799
Paul Stork SharePoint Server MVP
Principal Architect: Blue Chip Consulting Group
Blog: http://dontpapanic.com/blog
Twitter: Follow @pstork
Please remember to mark your question as "answered" if this solves your problem. -
Multi Level Grouping Issue in SharePoint 2010
Hi All
I want to acheive multilevel grouping in my SharePoint Views.I need to acheive grouping up to 5-6 levels of columns.
Is there any way we can acheive this?
Any Pointers to Custom Solutions,Custom Controls in .NET can be utilised in SharePoint to acheive this?
Please provide some pointers
Regards
MaheshHello,
previously asked questions contain a link to:
http://techtrainingnotes.blogspot.in/2011/01/sharepoint-group-by-on-more-than-2.html
The article basically describes how to create and use a DVWP instead of a XSLT List View. The out of the box SharePoint list view cannot have more than two groups. You need to either edit the View page and add a DVWP or create a new page with a DVWP.
SP 2010 view pages lose some functionality if web parts are added (showing ribbon is not as straightforward and view selector disappears), but there are workarounds.
In some cases, a Web Part Page with a DVWP may be a better alternative.
cheers, teylyn -
SSRS report viewer webpart issues in SharePoint 2013
Even though SSRS Add in has been installed on both the frontends which are in the same SharePoint 2013 farm, SSRS report viewer web part does not render any reports from one of the servers and on that server it just asks to configure the webpart by giving
an option to open the tool pane...
I am really not sure why it is not picking up the report RDL configuration, which is working fine from the other server.
Any help on this would be really appreciated.
Thanks in advance.Run the SharePoint Products and Technologies Wizard on this server. If simply running it does not fix it, remove the server from the farm and then re-join it, using the wizard.
Stacy Anothersharepointblog.blogspot.com -
SSRS with SharePoint 2013 Integrated and Claims
I have been reading a number of sources for SQL Server 2012 SSRS and I can't quite seem to get a straight answer about this. Does SSRS support SAML Token Claims? or does it still require the C2T conversion (which effectively requires a windows account
to work)? The reason we ask is that they have other uses for SharePoint and would prefer to not go too far outside the box with the identity provider, but still do not want to stand up an externally facing AD.Hi Kpvuppala,
From the Reporting Services Clients do not support LiveID or SAML Claims Authentication section of the
Claims Authentication and Reporting Services document, we can see that:
The Reporting Services client applications: Report Builder, the Report Designer in Business Intelligence Development Studio, and Management Studio do not support connecting and authenticating with LiveID or SAML Claims based SharePoint Web applications.
The clients can work with other forms of Claims Authentication because they use the Reporting Services authentication endpoint. The endpoint allows the clients to communicate to SharePoint through the same components used by ASP.NET forms authentication. SAML
Claims and LiveID authentication work differently and are not supported by the Reporting Services clients.
There is no official document on this topic for SSRS 2012 and SharePoint 2013. Although it is for SSRS 2008 R2 and SharePoint 2010 products, I think it applies to SSRS 2012 and SharePoint 2013 as well. The SAML Claims authentication may not use Reporting
Services authentication endpoint still.
Regards,
Mike Yin
If you have any feedback on our support, please click
here
Mike Yin
TechNet Community Support -
Formatting issues in sharepoint 2013 when copy/paste from word document
Hi,
When we copy/paste content(rich text, tables, styles) from a word document to SharePoint site whole formatting is messed up.
is this the limitation of SharePoint 2013?
Thanks,
Shiva.Hi Shiva,
Some styles for font of rich text aren't be kept when I copy the content from Word 2013 and paste into a wiki page from SharePoint 2010/2013(even SharePoint 2007 like this
post) site as same as yours, it looks like a limitation.
As a workaround, we can publish the Word content as a Blog article in SharePoint site, then copy the content from the blog page to the needed SharePoint page, it will keep the rich text content format, you can have a try.
http://plexhosted.com/billing/knowledgebase/274/How-to-publish-a-SharePoint-blog-article-via-Microsoft-Word-2013-SharePoint-2013.html
Thanks
Daniel Yang
TechNet Community Support
Please remember to mark the replies as answers if they help, and unmark the answers if they provide no help. If you have feedback for TechNet Support, contact
[email protected] -
Security Groups when in 'Project Server Permissions Mode' - Project Online
Hi All,
We have Project Online up and running, by default the PWA instance we added to O365 was in "SharePoint Permissions" Mode, we changed to "Project Server Permissions" Mode because of some complex security we need to configure. For some
reason (different from Project Server 2013) Project Online creates a number of Security Groups by default that seem to be duplicates. For example for Administrators there are:
- Administrators
- Administrators for Project Web App
- Web Administrators (Project Web App Synchronized)
For Project Managers:
- Project Managers
- Project Managers (Project Web App Synchronized)
- Project Managers for Project Web App
And there is something similar for all the groups (compared to Project Server 2013):
I have looked online, with no luck, for some guidance on what all these groups are and if I can delete some of them without causing PWA to crash.
If anyone out there can point me in the right direction / send me some documentation or links it will be greatly appreciated!
Thanks!
JorgeHi Jorge, I had the same thing on two different tenants within the last week - one today. I will just clean up the SharePoint groups manually. The ones with the descriptions are the correct Project Server permission mode groups... Hopefully Microsoft will
fix this soon, you could raise a support ticket on your office 365 tenant - support is pretty quick! Paul
Paul Mather | Twitter |
http://pwmather.wordpress.com | CPS
Maybe you are looking for
-
Why is Adobe Air crashing Dofus on Windows 7 64-bit
Hello! I play an MMORPG called Dofus, which runs on Adobe Air. I've been having this problem with Dofus since I started playing again a few weeks ago. My Dofus client and/or Adobe Air will crash, causing the error popup "DofusMod.exe has stopped r
-
I just restored my Mac HD from a time machine back-up and PS 4 Will not open. I get an error code 150:30. Any Idea what I should do ?
-
2005 iBook G4 lcd display has turned streaky fuzzy pink and blue
Boot up laptop screen looks fine. Goes to sleep, wake it up, screen is now weird. Gone fuzzy, no true colors, looks streaky, pink and blue. I rebooted, no change. I'm plugged in, so it is not a power/battery issue. Since I've had this since 2005 I su
-
Office files like Word-to-PDF converter ribbon on Mac side?
Is there a ribbon feature available on the Mac side for converting Office files like Word-to-PDF? http://www.adobe.com/products/acrobat/word-to-pdf-converter.html I have Adobe Acrobat Pro XI and a MacBook Air running Mavericks. Thanks!
-
How to run server in my eclipse
HI friends , How to run server in my eclipse i am using my eclipse and the version is 3.1.1 and i am facing difficulty while running server .so pls give me some steps regarding running a server .