Hi all,
I want to find out if this is reasonably feasable before I go down a dead end path. Here goes:
Think of my environment as an SAAS environment for businesses similar to a franciser/franchise relationship. We'll call the franchiser the CorpOffice and the franchisee anAssociate (company). Associates are independently owned and may have one or many Users. The CorpOffice has many Users, each of whom have authorization to access any report for any Associate.
Associates and Users are maintained in a database with unique IDs that will be used in the processing of the reports. Also, all Users are registered in Active Directory.
All reports are identical except that they are filtered by Associate and each report only includes the data specific to that Associate. One Associate can view only it's own reports. Any User employed by a given Associate can view all the reports for that
Associate.
Problem #1, Creating a Dynamic Subscription Path Dependent Upon Specific "Associate".
Story:
Run reports on a scheduled basis. For our purposes let's say the schedule is called Daily, and the report is called DailyReport. The DailyReport will be generated as a file share PDF with the Associate ID as part of the path. In the following example, "101"
is the Associate ID.
../AllReports/101/DailyReports/DailyReport.pdf
Any User who is a child member of the Associate has the authorization to open the report. The reports will be accessed from a password-protected web application, with security sharing credentials between the app and the report server (see Problem #2).
Question: How do I create a schedule for a file share and dynamically embed the Associate ID in the path for the fileshare, like this:
../AllReports/101/DailyReports/DailyReport.pdf
../AllReports/102/DailyReports/DailyReport.pdf
../AllReports/103/DailyReports/DailyReport.pdf
(etc.)
I'd like to put a parameter in the subscription path like this: ../AllReports/@AssociateId/DailyReports/DailyReport.pdf
Problem #2, Authentication on the Report Server Side.
Story:
A user will get an email with the URL to the report he or she is allowed to view, example:
Http://MyDomain.com/AllReports/101/DailyReports/DailyReport.pdf
That's all fine, but I have to put some kind of security layer to prevent URL injection. As it stands, any user would be able to copy the URL and simply put any Associate ID in the URL and get that other Associate's report.
At first I thought we can simply write some code and put it in the Report.BeforeOpen event (or similar event). My understanding is that there is no real object model like that for SSRS. The only other approach I can think of is to write an ISAPI extension
for the SSRS webserver to intercept every request. I'd rather do something more generally well known and more easily maintainable than an ISAPI extension.
Thanks in advance,
Bill
