SQL Server Reporting Services Security

If you haven't tried out SQL Server Reporting Services you really should give it a look. It features a better than average report designer. You have shared data sources, a Query designer, drag and drop fields and sub-reports. Virtually every property of every object in the report can be configured by parametrized expressions. Report are easy to create, easy to deploy and easy to export to various formats. Best of all if you are SQL Server 2000 license owner the add-on is free. If you are running SQL Server 2005 its baked in.

By default SSRS (SQL Server Reporting Services) runs under windows domain authentication. This works great on the intranet but what happens when you want to use reporting over the Internet. It can be done but its going to be a bumpy ride.

SSRS has an extensible security architecture. You have to extend the existing security model to use Forms authentication. Authentications are handled through your database or a custom database supplied with the sample. Once you get through this the real trick is to seamlessly authenticate users who are using you application to display reports without having to ask them to supply their credentials again.  It be done but it took a weekend and three developers to get it working. Think twice before heading down this path.