ReportServer Forum

Patryx

Member

Registered: 2019-03-25

Report - can I grant/revoke permission to variants of report?

Hi,
Is there any possibility to grant different permission to each variant of report?
I know how to grant permission to base report but I would like to grant or revoke permission different for each variant.
Can I achieve this functionality nowadays?

jalbrecht

Administrator

Registered: 2016-10-21

Re: Report - can I grant/revoke permission to variants of report?

Dear Patryx,

unfortunately this is not possible. This is due to the fact that once you do have permission to access a report you can create all the variants needed yourself.
You can give users limited acces to teamspaces to control what thes can access though. You can permit and forbid creation and configuration of variants. This gives you usually anough freedom to configure what you users need to see.
Thus said we are in the process of reconsidering our report / variant concept.

wbr jan

Patryx

Member

Registered: 2019-03-25

Re: Report - can I grant/revoke permission to variants of report?

Thank you for replying.
I wanted to block some users for exporting some variants of report using URL without login, so I cannot see how teamspace would help me here.
In this case I will create 2 different base reports and appropriate variants for that.

eduardo

Administrator

Registered: 2016-11-01

Website

Re: Report - can I grant/revoke permission to variants of report?

Hi Patryx,

if you need to veto report export for some users and some variants, you can also use an export vetoer as in the following example. In the example, excel export is vetoed if the excel export is very large. But you can adapt the script to your needs:

import net.datenwerke.rs.core.service.reportmanager.exceptions.*;
import net.datenwerke.rs.core.service.reportmanager.hooks.*;
import net.datenwerke.rs.base.service.reportengines.table.TableReportUtils;
import net.datenwerke.rs.core.service.reportmanager.entities.reports.Report;
import net.datenwerke.rs.base.client.reportengines.table.dto.TableReportInformation;
import net.datenwerke.rs.core.service.reportmanager.ReportService;
 
 
def HOOK_NAME = "PROHIBIT_EXECUTION"
def callback = [
    notifyOfReportExecution : { report, parameterSet, user, outputFormat, configs ->  },
    notifyOfReportsSuccessfulExecution : { compiledReport, report, parameterSet, user,
outputFormat, configs -> },
    notifyOfReportsUnsuccessfulExecution : { e, report, parameterSet, user, outputFormat,
configs -> },
    doVetoReportExecution: { report, parameterSet, user, outputFormat, configs ->
        TableReportUtils tableReportUtils = GLOBALS.getInstance(TableReportUtils.class);
        ReportService reportService = GLOBALS.getInstance(ReportService.class);
      System.out.println("output format: " + outputFormat);
      if (outputFormat.equals("EXCEL")) {
        TableReportInformation tableReportInformation = tableReportUtils.getReportInformation(report, report.getName()+(new Date()).getTime());
        if (tableReportInformation.getDataCount() > 1000)
            throw new ReportExecutorException("Your report is too large to be exported to Excel");
      }
         
    }
] as ReportExecutionNotificationHook
 
GLOBALS.services.callbackRegistry.attachHook(HOOK_NAME, ReportExecutionNotificationHook.class,
    callback)

Regards,
Eduardo

Patryx

Member

Registered: 2019-03-25

Re: Report - can I grant/revoke permission to variants of report?

Hi Eduardo,

Thanks. I know that I can use such a hook but my solution is connected with: https://forum.reportserver.net/viewtopi … 5991#p5991, so I needed to find possible reports for user before executing it.
I solved such a problem adding a report metadata entry in variant reports where I wrote usernames which were disallowed to use a report. Then I additionaly verify in my script this metadata after checking built-in user execution right.
There is a small drawback of such a solution - if sb builds right URL for Report Execution Path and is authenticated in Report Server, such metadata won't be checked and report will be executed. So maybe I use in future "permission hook" to addionally block such users by checking metadata of variants in similar way as in my script.
Is such a hook fired just after opening Report Execution View or after choosing export button?

Last edited by Patryx (2019-07-03 06:41:20)

eduardo

Administrator

Registered: 2016-11-01

Website

Re: Report - can I grant/revoke permission to variants of report?

Hi Patryx,

you have the user in your doVetoReportExecution, why don't you iterate the reports using net.datenwerke.rs.core.service.reportmanager.ReportService.getAllReports()  and use this vetoer ?

Regards,
Eduardo

Patryx

Member

Registered: 2019-03-25

Re: Report - can I grant/revoke permission to variants of report?

Hi Eduardo,
How can I use vetoer for each report returned from net.datenwerke.rs.core.service.reportmanager.ReportService.getAllReports()?
I think I have to do export report each time what rejects such solution in my case.
Do you know what first is fired: "Veto hook" or built-in right permission mechanism?

Last edited by Patryx (2019-07-03 10:38:35)

eduardo

Administrator

Registered: 2016-11-01

Website

Re: Report - can I grant/revoke permission to variants of report?

I wanted to block some users for exporting some variants of report using URL without login

Hi Patryx,

so you are trying to block exporting a variant for some users.
In the vetoer example I sent:
- you have the current user trying to execute a report
- you have the variant
the only thing you would have to do is to check if the current user is able to execute the variant. If not,  throw new ReportExecutorException
Since variants are not able to have different permissions as the report, you would have to think out some mechanism e.g. with report properties for achieving this. But I don't see the problem here: You don't have to execute all reports, you just have to check if the current user is able to execute the current variant.

Regards,
Eduardo

Patryx

Member

Registered: 2019-03-25

Re: Report - can I grant/revoke permission to variants of report?

Hi Eduardo,
As I mentioned before I had to write a script to get list of all available reports (varinats) for defined user. In out application we need a list of all available reports of given user.
Your solution just blocks current user to export/preview report but it still allow to call by URL Report Execution Viewer and then there would be an error each time it tries to do sth with report.
Maybe I will user "doVeto hook" as additional protection if sb wants to omit calling my scrip

eduardo

Administrator

Registered: 2016-11-01

Website

Re: Report - can I grant/revoke permission to variants of report?

As I mentioned before I had to write a script to get list of all available reports (varinats) for defined user. In out application we need a list of all available reports of given user.
Your solution just blocks current user to export/preview report but it still allow to call by URL Report Execution Viewer and then there would be an error each time it tries to do sth with report.
Maybe I will user "doVeto hook" as additional protection if sb wants to omit calling my scrip

Hi Patryx,
ok, so you can use net.datenwerke.rs.core.service.reportmanager.ReportService.getAllReports() for this. By using getAllReports() you can get a list of the reports, then you can check permissions with your report properties / similar solution.

Regards,
Eduardo