1

I have PowerBi Server (Jan 2019) installed on my server. I can see from the default trace that that the PowerBi Service account NT SERVICE\PowerBIReportServer is granting execute permissions on a stored procedure ExtendEditSessionLifetime to the RSExecRole (within the ReportServer database):

GRANT EXECUTE ON [dbo].[ExtendEditSessionLifetime] TO RSExecRole

This is happening frequently many times during the hour, most hours (around 50 times an hour) there doesn't seem to a pattern that I can see and I can't find any documentation online about what the stored procedure does. I can't see anything obvious in the PowerBI logfiles or the event viewer either.

What could be causing this (or is it intended behaviour?)

  • Is this causing some problem, or are you just asking out of curiosity? – Max Vernon Jul 4 at 19:22
  • No problem other than filling the default trace really. However, I do find it strange why this would happen and wondered if it is some sort of issues with our setup / bug etc – SEarle1986 Jul 5 at 8:47
  • Setup a trace on the NT SERVICE\PowerBIReportServer to see what it's doing before the GRANT statement is executed, as I suspect it's missing a permission allowing it to see what permissions currently exist on the RSExecRole. – John Eisbrener Jul 8 at 16:29
  • @JohnEisbrener, I will set that up and see if it gives any clues but the NT SERVICE\PowerBIReportServer account is in the db_owner group in the ReportServer database – SEarle1986 Jul 9 at 7:51
0

I have worked out what is happening here

If I run:

SELECT * FROM sys.sql_modules WHERE definition LIKE '%GRANT EXECUTE ON \[dbo\].\[ExtendEditSessionLifetime\] TO RSExecRole%' ESCAPE '\'

I can see stored procedures that have that grant statement within them.

This returned one record and the definition field begins

CREATE PROC [dbo].[ExtendEditSessionLifetime]      @EditSessionID varchar(32)...... 

If I navigate to this stored procedure in the object tree and right click and script it out, I can see the stored procedure is written in this format

CREATE PROC [dbo].[ExtendEditSessionLifetime]
    -- params
AS
BEGIN
    --code
END

GRANT EXECUTE ON [dbo].[ExtendEditSessionLifetime] TO RSExecRole
GO

I wasn't aware of this but it seems that when you create a stored procedure, you can place a GRANT after the END and it becomes part of the definition (I thought it had to be part of the BEGIN .... END construct (when there is one)

Therefore, everytime ExtendEditSessionLifetime is run, it is re-granting permissions to RSExecRole

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.