SQL Server Reporting Services experiences
I'm in the middle of debugging and enhancing a group of Reports using SQL Server Reporting Services.
Overall I like the product a lot. It's got a very slick designer. The one-touch deployment is outstanding. It isn't lacking for much in the way of features. I still think the reports out to have a managed event-driven code-behind, but I'm able to work around that in most cases. The webservice API is fairly easy to use. I was able to use it to implement my own custom navigation and parameter UI fairly rapidly.
There is one major drawback that should be mentioned though. You cannot use SQL Server Security to access it. It relies on Integrated Windows Security. In the Enterprise Edition you can implement a custom Security extension, which will allow you to basically use any kind of security you can code. This is not available in the Standard version, however.
This creates a problem for me because the app I am working on is a LAN app that uses SQL Server Security. This means that each user has to be set up in a SQL Server role AND their Windows Account name as be set up in the same role--argh! As if security wasn't complex enough! Since our app is a web app, it also means that if a user to to another machine, logs into our app using their SQL Server Credentials, they still view reports in Reporting Services as if they were the logged into the Windows Account.
Am I the only one that finds it strange that an alleged “bolt-on“ to SQL Server can't use SQL Server Security? Does Analysis Services have the same security model?
Again, overall I think this product is outstanding, especially for a first effort. I just question the security model.
UPDATE
Roman writes: “What you have to remember is that RS is a combination of SQL Server and IIS components. SQL Server supports both Windows and SQL Authentication but IIS supports only Windows Authentication. If you wanted to avoid administering dual groups, you would have to switch from Standard to Windows in your other application and set up RS to use Windows Authentication in report data sources.”
You know, I get that. I really do. I guess I expected to be able to allow anonymous access to the Report Manager via IIS, and have the Report Manager query the user for SQL Server credentials when they access the reports. Since Microsoft has a graduated licensing model for Report Access, I guess that wasn't a viable solution for them.