locked
Installing CRM - A security question about SQL Reporting Services RRS feed

  • Question

  • I spent the day other day getting Microsoft Dynamics 4.0 installed and working on my test Small Business 2003 server. But I ran into a few show stoppers and I'm not sure if my work-arounds were done correctly.

    The first thing that stopped my installation was SQL Server Reporting Services. I had installed an instance of SQL Server 2005 Standard (both database and reporting services) just for Dynamics CRM. It's worth noting that I'm not a SQL expert. I've only used it for website databases. Yesterday was the first time I had ever installed/configured Reporting Services.

    During the installation of Dynamics CRM it checks to make sure everything is installed and configured correctly. It stopped me when it tried connecting to the SQL Reporting Services and I got a 401.1 error. I checked into it and it appeared that the reporting server was requiring a username/password in order to connect (or else it would give a 401.1 error). I wasn't sure on how to get around this, so I changed the settings within IIS for the virtual ReportingServices folder. The folder by default did not allow anonymous access, and it required a login/password in order to access the directory. So I simply checked the box to allow annonymous access and Dynmics CRM said all was well and it continued and finished installing.

    That being said, is it OK to allow anonymous access to the reporting server? It seams like that's the only way to get Dynamics CRM installed. Otherwise, SQL Reporting Server requires a password and Dynamics is telling me it doesn't have access so it can't install. I'm just worried that leaving the Reporting Services open could lead to security issues. But since I know almost nothing about SQL Reporting Services, I thought I'd ask here :).

    Wednesday, December 23, 2009 2:40 AM

Answers

  • That being said, is it OK to allow anonymous access to the reporting server? It seams like that's the only way to get Dynamics CRM installed. Otherwise, SQL Reporting Server requires a password and Dynamics is telling me it doesn't have access so it can't install. I'm just worried that leaving the Reporting Services open could lead to security issues. 
    I have not had to take the step to allow anonymous access to the reporting server.  My guess is that your login did not have rights to the report server db.  I would probably first try going into SQL and ensure the installation login you are using has rights to the SQL Report Server db.  Were you able to access the Report server from a browser after you completed the Report Server configuration?  http://SQLServerName/reportserver
    Best Regards, Donna
    • Marked as answer by Jim Glass Jr Tuesday, March 30, 2010 4:31 PM
    • Marked as answer by Jim Glass Jr Tuesday, March 30, 2010 4:31 PM
    Wednesday, January 6, 2010 4:20 PM

All replies

  • The default setting requires Windows Authentication, so when prompted for credentials, your credentials should have let you in. It probably challenged you for credentials because you don't have the URL to the Reporting Services site in your Local Intranet Zone in IE.

    Shafraz

    http://crmdude.wordpress.com/
    Wednesday, December 23, 2009 3:28 AM
  • The default setting requires Windows Authentication, so when prompted for credentials, your credentials should have let you in. It probably challenged you for credentials because you don't have the URL to the Reporting Services site in your Local Intranet Zone in IE.

    Shafraz

    http://crmdude.wordpress.com/
    Thank you for taking the time to help me out.

    So... when I installed SQL Server databases services and reporting services (to be run off of the Administrator account), I did that step correctly? Meaning, at that point in time, the reporting services was running correctly and no changes to IIS were needed.

    But, all I had to do was add https://mydomain/reportservices manually to the local intranet zone in IE? If I did that, then Dynamics CRM would be able to connect and install? If so, that would mean Dynamics CRM:

    1.) Uses Internet Explorer to confirm connectivity to SQL Reporting Services.

    2.) Internet Explorer can bypass login details as long as the local site requesting them is listed as a local intranet zone in IE.

    Is all that above correct?
    Wednesday, December 23, 2009 6:18 AM
  • 1) Yes, Dynamics CRM uses IE settings to confirm connectivity 
    2) It is not so simple... 

    Let me explain: 
    When a site is in Internet Security zone, it always ask for login/pwd (well, it depends on IE security zone settings but by default, it does)
    When a site is in local Intranet (and perhaps in trusted sites, can't remember), it uses the current user windows credentials (still by default) 

    But, because there is a "but", depending on your infrastructure, even if your reporting services site is in local intranet zone, it could keep asking you for credentials... If it does, it should be caused by the Kerberos authentication that requires you to parameterize your Active Directory to allow web application service account to relay the current user credentials (Service Principal Name stuffs, etc.): that is called delegation


    My blog : http://mscrmtools.blogspot.com
    You will find:
    Form Javascript Manager (export/import javascript from forms)
    ISV.Config Manager (graphical ISV.config edition - export/import)
    View Layout replicator (customize one view and replicate to others)
    And others (use tool tag on my blog)
    Wednesday, December 23, 2009 8:21 AM
    Moderator
  • That being said, is it OK to allow anonymous access to the reporting server? It seams like that's the only way to get Dynamics CRM installed. Otherwise, SQL Reporting Server requires a password and Dynamics is telling me it doesn't have access so it can't install. I'm just worried that leaving the Reporting Services open could lead to security issues. 
    I have not had to take the step to allow anonymous access to the reporting server.  My guess is that your login did not have rights to the report server db.  I would probably first try going into SQL and ensure the installation login you are using has rights to the SQL Report Server db.  Were you able to access the Report server from a browser after you completed the Report Server configuration?  http://SQLServerName/reportserver
    Best Regards, Donna
    • Marked as answer by Jim Glass Jr Tuesday, March 30, 2010 4:31 PM
    • Marked as answer by Jim Glass Jr Tuesday, March 30, 2010 4:31 PM
    Wednesday, January 6, 2010 4:20 PM