I'm a bear with a very little brain. Please review the following story to see if I understand the concepts.
For the purposes of this exercise let's say that a database is used to control a building's HVAC (Heating, ventilation and cooling) system. It's installed by the HVAC vendor, who installs client software on the PC's in the building. This software allows the occupants of the building to alter the setting of the HVAC system. A young and foolish programmer/DBA - eager to show his mettle - accepts the responsibility of overseeing the system to make sure it works. What could go wrong? Easy money.
Given: A database that contains securable. (Tables, views, schema's etc).
By the second week, there is always someone complaining that it's too hot, too cold, too noisy (fans on too high). Everyone is setting their own settings. No one is happy - the only thing that they agree on is that the system doesn't work - and it's up to the less-young and less-foolish programmer/DBA to fix it.
Option #1: Create an Application Role (AIR_GOD) to control who can really write to the thermostat tables. This effectively blocks anyone who doesn't know the AIR_GOD password from fiddling. This password is only given to a carefully selected few.
Two weeks and fourteen passwords later:
Option #2: Create a fixed database role (AIR_GOD2) and drop only the selected few logins into it. (Our programmer is learning)
It helps. But since the users can access the whole thermostat-table - they end up setting each other's zones settings - sometimes by accident. Sometimes the values entered are insane.
Option #3: Create a Data Access Layer (DAL) Our programmer/DBA learns fast - he removes update rights to the thermostat-table from all users with a login. Now the only way to change a thermostat-table setting is through the stored-procedure(s) with the 'user without a login' impersonation. Values are checked before they're written etc.
Is that about right?
(Our story ends with the programmer/DBA growing older and wiser vowing never - ever - ever - to get involved with HVAC control systems again.)
I have posted this issue for a week, haven't got any reply yet, I posted it again and desperately need your help.
The article http://msdn2.microsoft.com/en-us/library/ms365343.aspx says: Model Item Security can be set for differnt security filters, but when I use SQL Server Management Studio to set Model Item Security, it seems "Permissions" property surpass "Model Item Security" property. -- My report server is using Custom Authentication.
For example, in "Permissions" property of the model, if I checked "Use these roles for each group or user account" without setting any user or group, no matter what users I added to "Model Item Security" with "Secure individual model items independently for this model" checked, NO one user can see the model on report manager and report builder;
in above situation, if I added "user1" and gave role such as "Browser" role to "user1" in "Permissions" property, if I checked "Secure individual model items independently for this model" in "Model Item Security" property, even I did NOT grant "user1" to root model and any entities under the model, the "user1" is able to access the model and all entities in report builder.
My question is on the same report model, how to set "AdminFilter" (empty security filter) for administrator permissions and set "GeneralFilter" (filtered on UserID) for general user based on their UserID?
The article also says:
"Security filters are always applied, even for users who have Content Manager or Administrator permissions to the model. To allow administrators or other users to see all rows of an entity on which row-level security is defined, you can create an empty security filter (which always returns True) and then use the filter to grant those users access to all the rows."
So I defined 2 filters "GeneralFilter" and "AdminFilter" for "Staff" entity for my report model "SSRSModel", I expect after I deployed the report model, the administrator users use report builder to build reports with all rows available, and the non-admin users can only see rows based on their UserID.
I can only get one result at a time but not both:
either the rows are filtered or not filtered at all, no matter how I set the "SecurityFilter" for the entity: I tried setting both "AdminFilter" and "GeneralFilter" for SecurityFilter at the same time, combination of "DefaultSecurityFilter" and "SecurityFilter", or one at a time.
I need some sugestions from all of you about setting up security model in our SQL2000 box.
The server was setup using Mixed mode. However, all the applications (web and MS access) access the server using "sa" userid.
There are several databases in our server. Ex: (DB1,DB2,DB3,DB4 and DB5)
Application 1: need read/write access to DB1,DB2 and DB3 Application 2: need read/write access to DB5 Application 3: need read/write access to DB4 and DB3
Should I set up three userids and give them the dbo access to those database that they need to use?
I have been playing with SRS 2005 for a few months now and have a decent setup going but am strugling with model security.
I have set my selected users up in the home folder and also as site users in site settings, they can launch the report builder and create reports fine.
HOWEVER
I intend to use the software accross multiple systems ie WMS, TMS, Finance package, T&A and therefore I only want the WMS users to see the WMS models and T&A users to only see the T&A models etc
No matter what settings are adjusted it seems that if you can launch the report builder then you can access all models and this poses an issue for me as systems like T&A and financials that I need to be as secure as possible.
I am aware that I can limit access to to models using Management studio but it seems to be basically on a column basis rather than the whole model.
Help!!!
Also aware of the fact im an idiot and basically posted the same thing 5 or 6 times! Hopefully the others are deleted
Is is possible to upgrade from 6.5 to 7.0 and have all the logins that have been granted the ability to make a trusted connection to 6.5 be created the same capability in 7.0?
When I did it the logins were created as standard logins in 7.0
Hi I just deploy a report model and want use report builder to create ad-hoc using this report model. I want some entitis and attributes are not visiable for some user, so I config the model item security for this model. But no matter which user I use to login the report server, I always can access all the entities. Even I delete all the groups and users in "Permissions" property of the model, I still can access this model through report builder. All the user I used to test are local user of server with report service, my server is SQL Server 2005+SP2.
I have a question on the security model for MSRS 2005. I have been working with the permissions for the reporting server folders and reports at my company. Now it seems to me that I can let a user have access to a folder but they will not be able to see any reports that they do not have permissions to see. This would seem different from the Windows Security model where I can see an executable but not actually execute it. (ie. In MSRS the user would be able to see the report but not execute it)
Am I correct in this assumption or is there a way to allow the user to see the report but not execute it using the MSRS permissions.
I am trying to use a very easy and simple feature of a reportmodel, model item security.
In my example i have two users; HGHJohn and HGHJKooi
I want to test if I am able to restrict access in the model to a whole entity. HGHJKooi shouldn't be able to see the entity 'Customers'.
These are the steps I executed:
1. In Sqlserver management studio I opened the properties of my model and navigated to the tabpage 'model item security'.
2. I activated the option 'secure individual model items...'
3. In the root of the model I declared two users(groups) as specified above
4. Automatically all nodes inherit these settings from the root.
5. For the entity 'Relations' I change the default, by selecting 'use these roles for each group or user account'
6. I removed HGHJKooi from this list, leaving only 'HGHJohn as model item browser
What I expected at this moment is that when I login the system as HGHJKooi, then I won't see this entity, but I still can! Does anybody know a solution to this problem?
I have created security roles that restrict access to a certain Dimension and a member therein.
The security works fine when the users finened in it runs a report: The data is accordingley ristricted.
The problem is when those same users run Report Builder and create a report, those members are no longer restricted and they have acces to absoluteley all data from the cubes.
Is there some way that I can force the Data Model to follow the cube's security roles?
Any help is much appreciated...
Gerhard Davids
EDIT: I have found that it uses the wrong user when opening report builder. For some reason it uses my windows account instead of the one I used to log onto report manager. This is way the security isnt working
We're running into an issue where analysts are having problems obtaining lift charts (via the Mining Accuracy Chart UI available in the Visual Studio Analysis Services project) and performing prediction (via the Mining Model Prediction UI).
The issue seems to be related to the underlying analyst security model. Note that this post is related to:
Analysts that work on the same problem will only have access to:
- A sandbox relational database (which contains views into the same source database). The analyst is db_owner of the sandbox database, so she/he can create data transformations required, etc. The sandbox database contains views to the source database, but the analyst only has read-access to the specific data elements needed from the source DB. So, they are very restricted w.r.t. the source database, but are db_owners of their sandbox relational databases. Note that the analyst will connect to he database via Windows Authentication.
- An Analysis Services sandbox database to use for their modeling, etc. In this AS sandbox db, we've created a role called "Administrator" and checked the permissions: Full control (Administrator), Process database, and Read definition. The analyst's windows account is the "user" associated with this role.
Also, in this situation, the SQL Server 2005 Relational Engine and Analysis Services are running on a single machine. The goal of this security model is to provide analysts with the ability to work in their "workspaces" (both SQL and AS), but not to see other analysts work, etc.
Under this model, Analysts are able to deploy mining models when the Data Source object that points to their relational "sandbox" DB is set-up with "Impersonation Information" = "Use a specific user name and password", where the Analyst provides their domain account information.
But, when trying to build a lift chart using the same data source view objects that were used to successfully train the model, the following error is occurring consistently:
Window Title: "Loading Mining Accuracy Chart" Window Text: "Failed to execute the query due to the following error: Execution of the managed stored rocedure GenerateLiftTableUsingDatasource failed with the following error: Exception has been thrown by the target of invocation. Either '<domain><login>' user does not have permission to access the '' object, or the object does not exist. Errors in the high-level relational engine. A connection could not be made to the data source specified in the query. Errors in the high-level relational engine. A connection could not be made to the data source specified in the query.."
Since the Analyst was able to build the model with her/his given '<domain><login>' credentials, it is puzzling why the lift chart is failing.
I have a question here for report model generated on top of SSAS 2005. If security has been defined in SSAS 2005 cube where RoleA only have access to certain dimension, is this security setting integrated with the report model and propogate down to the report builder when used where RoleA users have no access to dimension allowed?
Hi, I would like to demonstrate mining temporary models in an ASP.NET application.
Creating, trainning, predicating actions are all witten at C# codes as follows:
Code Snippet
using (AdomdCommand cmd = new AdomdCommand()) { // Build temporary mining model cmd.Connection = asConn; cmd.CommandText = "CREATE SESSION MINING MODEL " + modelName + " (" + "HCVS_MemberId Text KEY," + "HCVS_MeasureDate DATE KEY TIME, " + "SysPressure LONG CONTINUOUS PREDICT, " + "DiaPressure LONG CONTINUOUS PREDICT," + "Pluse LONG CONTINUOUS PREDICT" + ") " + "USING Microsoft_Time_Series(Missing_Value_Substitution='Mean' ) "; // Periodicity_Hint = '{12}' cmd.ExecuteNonQuery();
// Train Data cmd.CommandText = "INSERT INTO " + modelName + " (HCVS_MemberId, HCVS_MeasureDate, SysPressure, DiaPressure, Pluse) " + "OPENQUERY([Healthcare], " + " 'SELECT HCVS_MemberId, HCVS_MeasureDate, SysPressure,DiaPressure,Pluse" + " FROM v_VitalSignForecast WHERE HCVS_MemberId=''" + id + "'' AND HCVS_MeasureDate>=''" + from.ToShortDateString() + "'' AND HCVS_MeasureDate<=''" + to.ToShortDateString() +"'' ')";
cmd.ExecuteNonQuery(); // Predict upon the Train Data. In addition, the standard deviation of each predicated value is retrieved cmd.CommandText = "SELECT FLATTENED " + "( SELECT *, " + " SysPressure + PredictStdev(SysPressure) AS [SysPressure_PlusStdev], " + " SysPressure - PredictStdev(SysPressure) AS [SysPressure_MinusStdev] " + "FROM PredictTimeSeries(SysPressure, " + fDays + ") AS SysTable " + ") " + "FROM " + modelName ;
AdomdDataAdapter adapter = new AdomdDataAdapter(cmd);
DataSet sysDS = new DataSet(); adapter.Fill(sysDS); The problem is that I do not know how to configure my Analysis Service Server to let ASP.NET account can utilize it. And ASP.NET account in trun impersonates the account who is authorized to use Healthcare DB in the Openquery. Please give a help. Thanks a lot.
I've been through a number of tutorials on how to enable row-level security based on a userID, but my problem is more complicated and I do not have sufficient understanding of report models to guess.
My security information is defined in a table within my database. It contains a username and an account mask. An account mask maps to 1 or more account codes contained in the other data tables in my report model. A user may have more than one account mask defined for his account.
I understand the concept of directly mapping the logged-in user to a field containing a matching username. Is it possible to do a two-step mapping, so that based on the user ID I can get the account mask(s) and then evaluate which account codes match the mask(s)?
Or is there a different/better way to set this up? Defining SQL roles/groups is not an option, because of some compatibility issues with external systems.
So far, because my security table has no defined relationship with the data tables, I have not even been able to get it into my report model (Would love any suggestions on that one, too.)
I'd appreciate any ideas or suggestions - even if only something to investigate. Thanks, Sarah
I am working on the security model for an application that will be used by 100s of users with a dedicated SQL 2005 database for this application and access via SQL XML Web Services.
The client has asked to make it "open" during alpha testing such that anyone can access the web services without having to set them up first. Is there a way to do this? The best I can figure is to use mixed mode security and hard code a login and password. Any method using Windows authentication would require that I add every user at a minimum to the database.
In production, all users will have an active directory role specified that determines if they should have access to the web services or not. However, it is my understanding that to use Windows authentication, I would still need to add each individual user at a minimum as a Login to the SQL Server, and under best practices also as database users with permissions granted to the endpoint.
Am I correct in the above, or is there a more efficient way to achieve these results?
We have a current situation where analysts will be modeling a variety of problems, all stemming from the same source data (stored in a SQL-Server 2005 relational database).
Analysts that work on the same problem will only have access to:
- A sandbox relational database (which contains views into the same source database). The analyst is db_owner of the sandbox database, so she/he can create data transformations required, etc. The sandbox database contains views to the source database, but the analyst only has read-access to the specific data elements needed from the source DB. So, they are very restricted w.r.t. the source database, but are db_owners of their sandbox relational databases. Note that the analyst will connect to the database via Windows Authentication.
- An Analysis Services sandbox database to use for their modeling, etc. In this AS sandbox db, we've created a role called "Administrator" and checked the permissions: Full control (Administrator), Process database, and Read definition. The analyst's windows account is the "user" associated with this role.
Also, in this situation, the SQL Server 2005 Relational Engine and Analysis Services are running on a single machine. The goal of this security model is to provide analysts with the ability to work in their "workspaces" (both SQL and AS), but not to see other analysts work, etc.
I'm running into a problem when trying to build models using this security model by doing the following: - Running Visual Studio - Selecting File -> Open -> Analysis Services Database and choosing the AS DB that I have access to (this is the only one that appears in the drop-down, after specifying the AS server). - I've created a data source pointing to the relational sandbox DB. - I've created a data source view choosing the table/view needed for the case table. - I created a mining structure with a decision tree model
When I process the mining structure, I'm getting the following errors:
- If the data source Impersonation is "Default" -- the error is "The datasource, '<DS name>', contains an ImpersonationMode that is not supported for processing operations."
- If the data source Impersonation is "Use the credentials of the current user" -- the error is the same as "Default" above -- "The datasource, '<DS name>', contains an ImpersonationMode that is not supported for processing operations."
- If I change the data source Impersonation to "Use the service account" and select "OK" in the "Data Source Designer" window, and error comes up with message: "The ImpersonationInfo for '<DS name>' contains an ImpersonationMode that can only be used by a server administrator.
Any suggestions or pointers to help implement this security model to provide analysts with AS and SQL Relational resources for their modeling?
I need to develop a language specific dwh, meaning that descriptions of products are available from a SAP system in multiple languages. English is the most important language and that is the standard. But, there are also requirements of countries that wants productdescriptions in their language.
Productnr Productdesc Language 1 product EN 1 produkt DE
One option is to column the descriptions, but that is not very elegantly. I was thinking of using bridge tables to model this but you have to always select a language in a filter (I think)..
I'm thinking of a technical solution, such that when a user logs on, the language is determined and a view determines whether to pick a certain product table specific for a certain language. But then I don't have the opportunity to interchange the different language specific fields in a report (or in my case PowerPivot).
We have our Production server having database on which Few DTS packages execute every night. Most of them have Bulk Insert stored procedures running.
SO we have to set Recovery Model of the database to simple for that period of time, otherwise it will blow up our logs.
Is there any way we can set up log shipping between our production and standby server, but pause it for some time, set recovery model of primary db to simple, execute DTS Bulk Insert Jobs, Bring it Back to Full recovery Model AND finally bring back Log SHipping.
It it possible, if yes how can we achieve this.
If not what could be another DR solution in this scenario.
the aspx file with source code work good. when i try run project which created from VS i take "SQL Server does not exist or access denied." connection strings same:
I am having a problem reinstall SQL Express 2005. I had it installed, but then I unistalled it. I have tried installing it again, but everytime I do it says that the product is already installed. There is no instance of it in my Add/Remove Programs. I have read the threads that relate to this topic, but they haven't helped. I have looked at my logs of the installs, but they don't make sense neither. I just want the program installed again, or a way to get it so that I can use it.
When I try to manually uninstall using msiexec.exe /x <processid> I get an error saying that the package could not be opened. This happens with all the process ids I use that I get from the log files (I have 11 logs).
am using Visual Basic 2005 and trying to create a database, and it will not let me. That is how I know that it is not installed, plus I can't find any instance of it one my computer. Please help. Thanks.
I have MS Time Seeries model using a database of over a thousand products each of which has hundreds of cases. It amazingly takes only a few minutes to finish processing the model, but when I click Mining Model Viewer to view the models, it takes many hours to show up. Once the window is open, I can choose model for different products almost instantly. Is this normal?
I'm trying to put together a very simple page where you can click the up and down button to move the item up or down in the list and save the new list into the database. I've run the stored procedure... and it works so Its not a procedure problem. Here is the list in my databaseOrder_Id Item Position1 Sebring 12 GrandPrix 23 Accord 44 Miati 3 When I go to click the button I get a object reference not set to an instance of an object... This error haunts me many times. Heres the code to my project:BLL /// <summary> /// Gets Items from the Item table. /// </summary> /// <returns>A list of items.</returns> [System.ComponentModel.DataObjectMethodAttribute(System.ComponentModel.DataObjectMethodType.Select, true)] public OrderItemDataSet.OrderItemDataTable GetItemDataByPosition() { return OrderItemAdapter.GetItemDataByPosition(); }
/// <summary> /// Gets the order id based on the position specified. /// </summary> /// <returns>The order id.</returns> [System.ComponentModel.DataObjectMethodAttribute(System.ComponentModel.DataObjectMethodType.Select, true)] public int SelectOrderIdByPos(int pos) { return SelectOrderIdByPos(pos); }
/// <summary> /// Update Order list. /// </summary> /// <param name="newPos">Position to change to.</param> /// <param name="originalPos">Original position.</param> /// <param name="orderId">Original id.</param> /// <param name="otherOrderId">Position to change id.</param> /// <returns></returns> [System.ComponentModel.DataObjectMethodAttribute(System.ComponentModel.DataObjectMethodType.Update, true)] public void ReorderItemByIdAndPosition(int newPos, int originalPos, int orderId, int otherOrderId) { OrderItemAdapter.ReorderItemByIdAndPosition(newPos, originalPos, orderId, otherOrderId); } Codebehind 1 using ReorderListWebApplication.BLL; 2 using System; 3 using System.Collections; 4 using System.Configuration; 5 using System.Data; 6 using System.Linq; 7 using System.Web; 8 using System.Web.Security; 9 using System.Web.UI; 10 using System.Web.UI.HtmlControls; 11 using System.Web.UI.WebControls; 12 using System.Web.UI.WebControls.WebParts; 13 using System.Xml.Linq; 14 15 namespace ReorderListWebApplication 16 { 17 public partial class _Default : System.Web.UI.Page 18 { 19 protected void Page_Load(object sender, EventArgs e) 20 { 21 22 } 23 24 protected void UpButton_OnClick(object sender, EventArgs e) 25 { 26 Label posLabel = (Label)ReorderItemDataList.FindControl("PosLabel"); 27 Label idLabel = (Label)ReorderItemDataList.FindControl("IdLabel"); 28 29 using (ReorderListWebApplication.BLL.OrderItem item = new ReorderListWebApplication.BLL.OrderItem()) 30 { 31 int pos = 0; 32 33 pos = item.SelectOrderIdByPos(Convert.ToInt32(idLabel.Text) - 1); 34 35 // Grab other orderId!! 36 item.ReorderItemByIdAndPosition((Convert.ToInt32(posLabel.Text) - 1), Convert.ToInt32(posLabel.Text), 3, pos); 37 } 38 } 39 40 protected void DownButton_OnClick(object sender, EventArgs e) 41 { 42 using (ReorderListWebApplication.BLL.OrderItem item = new ReorderListWebApplication.BLL.OrderItem()) 43 { 44 45 } 46 } 47 } 48 } 49
Description: An unhandled exception occurred during the execution of the current web request. Please review the stack trace for more information about the error and where it originated in the code. Exception Details: System.InvalidOperationException: You have specified that your update command compares all values on SqlDataSource 'SqlDataSource5', but the dictionary passed in for oldValues is empty. Pass in a valid dictionary for update or change your mode to OverwriteChanges. can somebody tell me what this is? Angiemarie
Hello, I could use some help with this error message: Subquery returned more than 1 value. This is not permitted when the subquery follows =, !=, <, <= , >, >= or when the subquery is used as an expression. This if statement is the problem IF (select bill_freq from #header1) = '1' update #header1 Set [Monthend] = aa.pername from sv00564 zz inner join sv00532 aa on zz.wennsoft_period_id = aa.wennsoft_period_id Where zz.rmdnumwk like #header1.Invoice_Number
This is failing:// Trying to update DynamicPageContent.Html where DynamicPageContent.PageID='121'//With// Select Html from DynamicPageHistory where HistoryID='831'//Update DynamicPageContentSET Html=(SELECT Html FROM DynamicPageHistory WHERE HistoryID='831')WHERE PageID='121'With the following error:Server: Msg 279, Level 16, State 3, Line 1The text, ntext, and image data types are invalid in this subquery or aggregate expression.DynamicPageContent.Html is Ntext size 16 and DynamicPageHistory.Html is Ntext size 16. PageID is and int and HistoryID is an int. It fails with single quotes around 831 and 121 and it fails without single quotes. The error message is the same both ways.Ideas?Thanks,Rex
I feel extremly happy today and let me share with this wonderful forum why.
SQL is awesome and I'm really learning that theres alot of resources out there and coding is not that hard once you understand what your doing. Just took awhile for things to sink in. I still have a long ways to go but I'm really enjoying using sql. I practically live in our SQL Server 2000 at work and I'm learning more and more about it everyday.
Thank YOu so much guys I really appreciate all the help you've given me Now I'm gonna study for the sql cert
The error was: System.FormatException: Input string was not in a correct format.
The line this is happening on is: Response.Write("<TD><p>" + rdData("ClientRepID") + "</p></td>")
I don't understand, it is giving that error particularly when I want to get ClientRepID
Some more lines from the code: Response.Write("<TD><p>" + rdData("Username") + "</p></TD>") Response.Write("<TD><p>" + rdData("ClientRepID") + "</p></td>")
The first line the compiler had no problem but when it gets to the second line with ClientRepID it gives me this error. (ClientRepID exists in the database)
Hello, i just bought sql server 2005 with 5 cals (previously i was using a shared sql server with my previous host)... I probably should have asked this question before i bought it... i don't understand how the cal licencing works... the sql server is for running our ecommerce site, i just got a dedicated server to put this on... but from reading the licencing does this mean that only 5 internet users can access my website(or the information in the database) at a time???
OK, so I know that following works if I want update/insert the value "joe's bar" into the table.
set SET QUOTED_IDENTIFIER on update #temp set id=4 where name ='joe''s bar'
The thing is, I do not conceptually understand what is happening and it is driving me nuts. I have read and re-read the description of quoted_identifier in books online and I still don't get it. How does the extra ' after joe make it work? Is there any hope for me? :)
