I want to know if it is possible to create a group "internal" to SSRS without having to add the group to the ReportServer box itself.

I do not have permissions to the box to create groups and/or add users to existing groups. I know that this is a way (the only way?) to have groups that can be assigned permissions in the SSRS interface.

I do have all the permissions I need within the SSRS interface. I have the System Administrator System Role on the ReportServer instance, as well as full sysadmin rights to the ReportServer database.

I am trying to simplify our security structure and it would be peachy if I could create a group, assign users to that group, and then permissions to the group. But all I seem to be able to do is assign permissions to the groups set up on the box.

Any ideas?

EDIT: Active Directory groups are not an option for me. :(

  • is your report server on a domain? – swasheck Jun 25 '12 at 17:31
  • yes, the report server is on a domain. – JHFB Jun 25 '12 at 17:31
  • Sorry. I was deleting that comment - I'm not 100% sure I'm following you given the amount of time "Report Server" is used. Are you asking if you can create a group on the SSRS implementation that has permissions to a report/set of reports without having to assign them permission on the actual server itself MYREPORTSERVER.DOMAIN.EXT ? – swasheck Jun 25 '12 at 17:33
  • I just edited my post to clarify my use of ReportServer (I hope). To answer your question in the coment - yes, that is what I am trying to do. – JHFB Jun 25 '12 at 17:39
  • My first inclination would be to have AD groups set up and then you can divvy up permissions through the SSRS interface MYREPORTSERVER/Reports/Pages/… – swasheck Jun 25 '12 at 17:50

There are a couple of courses of action for you:

  • If you're friendly with your Windows Admin, I'd thoughtfully think out some AD Groups and then present them to the admin and ask them to be created (in whatever workflow you have).
  • From there you can assign permissions on the individual folders by these groups. Click on the folder, then click on Properties.

enter image description here

  • On the left you will see "Security," click that. Then click "Edit Item Security." You may get a dialog that tells you that the item currently inherits from parent. You may need to wait for a bit before this completes, but be patient.

enter image description here

  • If successful you will have checkboxes next to the principles already with access. From here choose "New Role Assignment"

enter image description here

  • Now you can add your AD Group in the next page and assign it the permissions necessary. Try with DOMAIN\GroupName

enter image description here

Obviously this will be much easier if you have AD groups, but if you can't get that, then you can do this with individual domain users. That would be a management nightmare?

  • Thanks for all the detail, @swasheck. Problem is, I don't have access to AD groups - and I can't get friendly with my Windows Admin. Any other options? I'm looking at 150+ users that could be divided into 50 or so groups to ease the pain. I miss other BI tools right now... :( – JHFB Jun 26 '12 at 10:51
  • 1
    Wow, that's a real shame. 150+ users is a management nightmare to do individually. I am thinking of a hacky workaround, but it's not really the right way. I'd probably push the political system at your pace of employment to come to a workable solution for everyone. Otherwise it's create a linked server to AD using ADSI to query AD and get SIDs for users. Then you could put those into ReportServer.dbo.Users and then map the users to Roles and then PolicyUserRole using items in Catalog. There are probably a few more that I'm missing. – swasheck Jun 26 '12 at 14:37

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.