Showing posts with label request. Show all posts
Showing posts with label request. Show all posts

Monday, March 26, 2012

Permitted Host Problem

I have Reporting Service up and running and able to send email of the
reports. I have a request from a client to set their system up so that
reports are email to approved recipients. I have the DefaultHost
(called DomainA) to the local SMTP domain, and have put in a domain in
the PermittedHost (called DomainB), in the config file. When I send a
report the the permitted DomainB, works fine. When I send same report
to DomainC, (which is not a permitted host) and that report gets
delivered also. I would think that since it was not a permitted host
the report should have not been sent. Am I missing a configuration? If
there were multiple hosts to permit, would they be separated with a
comma(,) or semicolon (;)?
The SMTP server has been setup to relay to a Smart Host for delivery.
Below is my email configuration. I show the current setup and I also
have show a 2nd setup that I have tried, but get the same results.
<Extension Name="Report Server Email"
Type="Microsoft.ReportingServices.EmailDeliveryProvider.EmailProvider,ReportingServicesEmailDeliveryProvider">
<MaxRetries>3</MaxRetries>
<SecondsBeforeRetry>900</SecondsBeforeRetry>
<Configuration>
<RSEmailDPConfiguration>
<SMTPServer>Relay Server</SMTPServer> Current Setup
#** <SMTPServer>localhost</SMTPServer> Have also tried Setup #2
<SMTPServerPort></SMTPServerPort>
<SMTPAccountName></SMTPAccountName>
<SMTPConnectionTimeout></SMTPConnectionTimeout>
<SMTPServerPickupDirectory></SMTPServerPickupDirectory> Current Setup
#**
<SMTPServerPickupDirectory>c:\inetpub\mailroot\Pickup</SMTPServerPickupDirectory>
Have also tried Setup #2
<SMTPUseSSL></SMTPUseSSL>
<SendUsing></SendUsing> Current Setup
#** <SendUsing>1</SendUsing> Have also tried Setup #2
<SMTPAuthenticate></SMTPAuthenticate>
<From>Server@.DomainA.com</From>
<EmbeddedRenderFormats>
<RenderingExtension>MHTML</RenderingExtension>
</EmbeddedRenderFormats>
<PrivilegedUserRenderFormats></PrivilegedUserRenderFormats>
<ExcludedRenderFormats>
<RenderingExtension>HTMLOWC</RenderingExtension>
<RenderingExtension>NULL</RenderingExtension>
</ExcludedRenderFormats>
<SendEmailToUserAlias>True</SendEmailToUserAlias>
<DefaultHostName>DomainA</DefaultHostName>
<PermittedHosts>DomainB.com</PermittedHosts>
</RSEmailDPConfiguration>
</Configuration>
Server Information (This is a development server, so everything is
installed):
W2K3 w/IIS and SMTP
SQL 2000 SP3a
SQL Reporting SP2
If you need more information, please let me know.
Thanks in Advance for any help,
Zing1atuWe are investigating whether PermittedHost is still working. If it is a bug
and this is essential functionality for you, you will have to request a
hotfix through product support.
--
Brian Welcker
Group Program Manager
Microsoft SQL Server
This posting is provided "AS IS" with no warranties, and confers no rights.
"Zing1atU" <gsnyder5@.csc.com> wrote in message
news:1115734700.870300.288860@.o13g2000cwo.googlegroups.com...
>I have Reporting Service up and running and able to send email of the
> reports. I have a request from a client to set their system up so that
> reports are email to approved recipients. I have the DefaultHost
> (called DomainA) to the local SMTP domain, and have put in a domain in
> the PermittedHost (called DomainB), in the config file. When I send a
> report the the permitted DomainB, works fine. When I send same report
> to DomainC, (which is not a permitted host) and that report gets
> delivered also. I would think that since it was not a permitted host
> the report should have not been sent. Am I missing a configuration? If
> there were multiple hosts to permit, would they be separated with a
> comma(,) or semicolon (;)?
> The SMTP server has been setup to relay to a Smart Host for delivery.
> Below is my email configuration. I show the current setup and I also
> have show a 2nd setup that I have tried, but get the same results.
> <Extension Name="Report Server Email"
> Type="Microsoft.ReportingServices.EmailDeliveryProvider.EmailProvider,ReportingServicesEmailDeliveryProvider">
> <MaxRetries>3</MaxRetries>
> <SecondsBeforeRetry>900</SecondsBeforeRetry>
> <Configuration>
> <RSEmailDPConfiguration>
> <SMTPServer>Relay Server</SMTPServer> Current Setup
> #** <SMTPServer>localhost</SMTPServer> Have also tried Setup #2
> <SMTPServerPort></SMTPServerPort>
> <SMTPAccountName></SMTPAccountName>
> <SMTPConnectionTimeout></SMTPConnectionTimeout>
> <SMTPServerPickupDirectory></SMTPServerPickupDirectory> Current Setup
> #**
> <SMTPServerPickupDirectory>c:\inetpub\mailroot\Pickup</SMTPServerPickupDirectory>
> Have also tried Setup #2
> <SMTPUseSSL></SMTPUseSSL>
> <SendUsing></SendUsing> Current Setup
> #** <SendUsing>1</SendUsing> Have also tried Setup #2
> <SMTPAuthenticate></SMTPAuthenticate>
> <From>Server@.DomainA.com</From>
> <EmbeddedRenderFormats>
> <RenderingExtension>MHTML</RenderingExtension>
> </EmbeddedRenderFormats>
> <PrivilegedUserRenderFormats></PrivilegedUserRenderFormats>
> <ExcludedRenderFormats>
> <RenderingExtension>HTMLOWC</RenderingExtension>
> <RenderingExtension>NULL</RenderingExtension>
> </ExcludedRenderFormats>
> <SendEmailToUserAlias>True</SendEmailToUserAlias>
> <DefaultHostName>DomainA</DefaultHostName>
> <PermittedHosts>DomainB.com</PermittedHosts>
> </RSEmailDPConfiguration>
> </Configuration>
> Server Information (This is a development server, so everything is
> installed):
> W2K3 w/IIS and SMTP
> SQL 2000 SP3a
> SQL Reporting SP2
> If you need more information, please let me know.
> Thanks in Advance for any help,
> Zing1atu
>|||Stayed on top of this with Microsoft. Results were that you need to add
a little more to the Permitted Host section to make it work. The
following is what needed to be added:
<SendEmailToUserAlias>False</SendEmailToUserAlias>
<PermittedHosts>
<HostName>domain.com</HostName>
</PermittedHosts>
After making these changes, was successfully able to send to the host
name allowed and any other host name brought up an error, that the
named host was not permitted.
Hopefully, this will be documented a little better in the next release
of On-line documentation.

Wednesday, March 21, 2012

Permissions problem accessing external DLL through reports

Hi,
I'm having this wee problem when trying to view my report via the report
manager screen - I get the following error "Request for the permission of
type System.Security.Permissions.SecurityPermission, mscorlib,
Version=1.0.5000.0, Culture=neutral, PublicKeyToken=b77a5c561934e089
failed"...This seems to be due to me trying to access a seperate DLL which in
turn accesses the database that I created for the reports for translation
purposes (I added the DLL to the References collection for each of the
reports). Any suggestions would be greatly appreciated.I am also tring to use an assembly to translate y i got the same message.
I already try to configure my rssvpolicy.config like:
<CodeGroup class="UnionCodeGroup"
version="1"
PermissionSetName="XMLFile_MultiLang_Permission"
Name="MultiLangCodeGroup"
Description="A special code group for my custom assembly.">
<IMembershipCondition class="UrlMembershipCondition"
version="1"
Url="C:\Program Files\Microsoft SQL Server\MSSQL\Reporting
Services\ReportServer\bin\MultLang.dll"/>
</CodeGroup>
but i habe the same error.
Have you found out how to solve it ?
"Rowan Massey" wrote:
> Hi,
> I'm having this wee problem when trying to view my report via the report
> manager screen - I get the following error "Request for the permission of
> type System.Security.Permissions.SecurityPermission, mscorlib,
> Version=1.0.5000.0, Culture=neutral, PublicKeyToken=b77a5c561934e089
> failed"...This seems to be due to me trying to access a seperate DLL which in
> turn accesses the database that I created for the reports for translation
> purposes (I added the DLL to the References collection for each of the
> reports). Any suggestions would be greatly appreciated.sql

Permissions on sp_OASetProperty

We have a request to be able to execute the following from an application:
declare @.languageValue varchar(1000)
exec sp_OASetProperty @.languageValue, 'CharSet', 'Shift-JIS'
Currently the developer is unable to because they get an "EXECUTE permission
denied on object 'sp_OASetProperty', database 'master', owner 'dbo'." when
running this.
We have no users (other than dbo & guest) in the master database. How can
this be setup with the least amount of permissions being given.
I appreciate any suggestions.
thanks
Meenal> We have no users (other than dbo & guest) in the master database. How can
> this be setup with the least amount of permissions being given.
Assuming SQL 2000 SP3 or above, you can use cross-database ownership
chaining to allow limited access to the sp_OA* procs and other potentially
dangerous master procs. Note that you should enable 'db chaining' in an
sa-owned database when only sysadmin role members are permitted to create
dbo-owned objects in that database.
1) From Enterprise Manager, uncheck 'only uses with sysadmin...' under
Management-->SQL Server Agent-->Job System and specify a Windows proxy
account when prompted. This proxy account is used as the OS security
context for access to external resources.
2) Change your user database owner to 'sa':
USE MyDatabase
EXEC sp_changedbowner 'sa'
3) Enable the 'db chaining' database option
EXEC sp_dboption 'MyDatabase', 'db chaining', true
4) Create a proc to wrap the needed functionality:
CREATE PROC dbo.usp_DoSomething
@.MyData
AS
--initialization code, including sp_OACreate
EXEC sp_OASetProperty
@.token,
@.languageValue,
'CharSet',
'Shift-JIS'
--other code, including sp_OADestroy
GO
5) Create execute permission to users:
GRANT EXEC ON dbo.usp_DoSomething TO MyRole
This will provide an unbroken ownership chain because all of the objects
involved have the same owner (dbo) and both database owners are owned by the
same login (sa).
It is important that the proc be constructed in such a way as to prevent
ad-hoc execution of unintended commands.
Hope this helps.
Dan Guzman
SQL Server MVP
"Meenal Dhody" <meenal_dhody@.hotmail.com> wrote in message
news:%23EjS4BkaGHA.3992@.TK2MSFTNGP05.phx.gbl...
> We have a request to be able to execute the following from an application:
> declare @.languageValue varchar(1000)
> exec sp_OASetProperty @.languageValue, 'CharSet', 'Shift-JIS'
> Currently the developer is unable to because they get an "EXECUTE
> permission
> denied on object 'sp_OASetProperty', database 'master', owner 'dbo'." when
> running this.
> We have no users (other than dbo & guest) in the master database. How can
> this be setup with the least amount of permissions being given.
> I appreciate any suggestions.
> thanks
> Meenal
>
>
>|||Thanks alot for you suggestion- just a question or 2.
If the database is owned by an nt account and we use mixed mode for SQL
authenticate would I just set the proxy account up using the SQL NT login?
thanks
Meenal
"Dan Guzman" <guzmanda@.nospam-online.sbcglobal.net> wrote in message
news:OBMImNsaGHA.1812@.TK2MSFTNGP04.phx.gbl...
can[vbcol=seagreen]
> Assuming SQL 2000 SP3 or above, you can use cross-database ownership
> chaining to allow limited access to the sp_OA* procs and other potentially
> dangerous master procs. Note that you should enable 'db chaining' in an
> sa-owned database when only sysadmin role members are permitted to create
> dbo-owned objects in that database.
> 1) From Enterprise Manager, uncheck 'only uses with sysadmin...' under
> Management-->SQL Server Agent-->Job System and specify a Windows proxy
> account when prompted. This proxy account is used as the OS security
> context for access to external resources.
> 2) Change your user database owner to 'sa':
> USE MyDatabase
> EXEC sp_changedbowner 'sa'
> 3) Enable the 'db chaining' database option
> EXEC sp_dboption 'MyDatabase', 'db chaining', true
> 4) Create a proc to wrap the needed functionality:
> CREATE PROC dbo.usp_DoSomething
> @.MyData
> AS
> --initialization code, including sp_OACreate
> EXEC sp_OASetProperty
> @.token,
> @.languageValue,
> 'CharSet',
> 'Shift-JIS'
> --other code, including sp_OADestroy
> GO
> 5) Create execute permission to users:
> GRANT EXEC ON dbo.usp_DoSomething TO MyRole
>
> This will provide an unbroken ownership chain because all of the objects
> involved have the same owner (dbo) and both database owners are owned by
the
> same login (sa).
> It is important that the proc be constructed in such a way as to prevent
> ad-hoc execution of unintended commands.
> --
> Hope this helps.
> Dan Guzman
> SQL Server MVP
> "Meenal Dhody" <meenal_dhody@.hotmail.com> wrote in message
> news:%23EjS4BkaGHA.3992@.TK2MSFTNGP05.phx.gbl...
application:[vbcol=seagreen]
when[vbcol=seagreen]
can[vbcol=seagreen]
>|||I'm not sure why you ask this question. The proxy account is used as the
external OS security context when non-sysadmin users execute the sp_OA*
procs. That Windows account doesn't even need access to SQL Server.
Setting unless the code invoked via sp_OA* connects to SQL using a trusted
connection.
Unless you specify 'sa' as the user database owner, you'll need to add the
users to the master database and grant execute permissions on the sp_OA*
procs. It is technically possible to simply grant execute permissions to
guest or public but that's a very bad security practice.
Hope this helps.
Dan Guzman
SQL Server MVP
"Meenal Dhody" <meenal_dhody@.hotmail.com> wrote in message
news:eEF4P6UbGHA.3812@.TK2MSFTNGP04.phx.gbl...
> Thanks alot for you suggestion- just a question or 2.
> If the database is owned by an nt account and we use mixed mode for SQL
> authenticate would I just set the proxy account up using the SQL NT login?
> thanks
> Meenal
> "Dan Guzman" <guzmanda@.nospam-online.sbcglobal.net> wrote in message
> news:OBMImNsaGHA.1812@.TK2MSFTNGP04.phx.gbl...
> can
> the
> application:
> when
> can
>

Monday, March 12, 2012

permissions for sp_OASetProperty

We have a request to be able to execute the following from an application:
declare @.languageValue varchar(1000)
exec sp_OASetProperty @.languageValue, 'CharSet', 'Shift-JIS'
Currently the developer is unable to because they get an "EXECUTE permission
denied on object 'sp_OASetProperty', database 'master', owner 'dbo'." when
running this.
We have no users (other than dbo & guest) in the master database. How can
this be setup with the least amount of permissions being given.
I appreciate any suggestions.
thanks
MeenalI answered your question in the security group.
Hope this helps.
Dan Guzman
SQL Server MVP
"Meenal Dhody" <meenal_dhody@.hotmail.com> wrote in message
news:eQW9OItaGHA.5108@.TK2MSFTNGP05.phx.gbl...
> We have a request to be able to execute the following from an application:
> declare @.languageValue varchar(1000)
> exec sp_OASetProperty @.languageValue, 'CharSet', 'Shift-JIS'
> Currently the developer is unable to because they get an "EXECUTE
> permission
> denied on object 'sp_OASetProperty', database 'master', owner 'dbo'." when
> running this.
> We have no users (other than dbo & guest) in the master database. How can
> this be setup with the least amount of permissions being given.
> I appreciate any suggestions.
> thanks
> Meenal
>
>
>
>

permissions for sp_OASetProperty

We have a request to be able to execute the following from an application:
declare @.languageValue varchar(1000)
exec sp_OASetProperty @.languageValue, 'CharSet', 'Shift-JIS'
Currently the developer is unable to because they get an "EXECUTE permission
denied on object 'sp_OASetProperty', database 'master', owner 'dbo'." when
running this.
We have no users (other than dbo & guest) in the master database. How can
this be setup with the least amount of permissions being given.
I appreciate any suggestions.
thanks
MeenalI answered your question in the security group.
--
Hope this helps.
Dan Guzman
SQL Server MVP
"Meenal Dhody" <meenal_dhody@.hotmail.com> wrote in message
news:eQW9OItaGHA.5108@.TK2MSFTNGP05.phx.gbl...
> We have a request to be able to execute the following from an application:
> declare @.languageValue varchar(1000)
> exec sp_OASetProperty @.languageValue, 'CharSet', 'Shift-JIS'
> Currently the developer is unable to because they get an "EXECUTE
> permission
> denied on object 'sp_OASetProperty', database 'master', owner 'dbo'." when
> running this.
> We have no users (other than dbo & guest) in the master database. How can
> this be setup with the least amount of permissions being given.
> I appreciate any suggestions.
> thanks
> Meenal
>
>
>
>

Permissions error while upgrading to SP2 CTP...

Hi Folks,

I have a request from one of our researchers to upgrade to CTP SP2. I am getting the error message:

MSP Error: 29506 SQL Server Setup failed to modify security permissions on file C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Data\ for user Administrator. To proceed, verify that the account and domain running SQL Server Setup exist, that the account running SQL Server Setup has administrator privileges, and that exists on the destination drive.

I added server\administrators - full control to the permissions of \Data\, but it still does not work.

Has anyone else ran into this, and how do I fix it?

Thanks,

Alainna

Error 29506. SQL Server Setup failed to modify security permissions on file E:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Data\ for user administrator.

The problem is that there exists a file in this Data directory that the user running SP1 does not have permissions to modify. The workaround is to figure out which file this is (typically a user created DB or some backup program files) and to temporarily assign permission to that file(s). You can revert back to the intended permissions after running SP1.

Thanks,
Sam Lester (MSFT)

|||Sam,

Thank you, that worked. I have no idea why I didn't check the files before posting, but thank you!

- Alainna