Hi All,

Env:
Analysis Services 2005.
Visual Studio 2005.

Problem:
I am trying to open up a connection from the web application using ADOMD.NET.

Here is the connection string we use

<add key="Cube_ConnStr" value="Data Source=ServerName\InstanceName;Initial
Catalog=Cube1;user id=domain\user;password=pwd;Provider=MSOLAP/>

I have created a Role in the Analysis Services database and added the
domainuser as a member.

When I try to run the application, it throws the error message…



AdomdConnection objConn = new AdomdConnection(ConfigurationSettings.
AppSettings["Cube_ConnStr"]);

objConn.Open(); - Error here

"A connection cannot be made. Ensure that the server is running"


But when I add the key <identity impersonate="true"/>, I am not getting any
error, I can open the connection and manipulate things inside the cube

I know I am missing some permission settings, please let me know….what I am
missing

I cannot go with impersonate in production…

Thanks in advance
Balaji

--
Message posted via SQLMonster.com
http://www.sqlmonster.com/Uwe/Forums...-olap/200607/1

Hi Balaji,
I have doubt about about "initial catalog=Cube1" in your text
"Initial Catalog" refers to OLAP database name, not cube name.
Peter Kao



"balajikkrishnan via SQLMonster.com" wrote:

yeah,
initial catalog=<Foodmart>;initial cube=<sales>

but the userid and PWD options are not available until you use an HTTP
connection with basic authentication.
when you use a direct access (like your connection string) the delegation is
used
try playing with this option:
<identity impersonate="true" /> (use the current user identity, good if your
web site use the Basic or NTLM authentication, not good for form based
authentication)
or
<identity impersonate="true" userName="domain\user" password="password" />
(use the specified username / password when the ASPX page access a secured
resource requiring n identity, like the cube access)
or
<identity impersonate="false" /> (will use the application pool identity to
access the resources)



"Peter" <Peter (AT) discussions (DOT) microsoft.com> wrote

Hi Peter/Jeje,

Thanks for your reply.
I don't have any issue with the connection string, because I am using Initial
Catalog in the connection string and when querying the I use the cube name
inside the code.

AdomdConnection objConn = new AdomdConnection(ConfigurationSettings.
AppSettings["Cube_ConnStr"]);
objConn.Open();
AdomdCommand objCmd = new AdomdCommand();
objCmd.Connection = objConn;
objCmd.CommandText = "Select from [ActualCube]";
CellSet Objcs = objCmd.ExecuteCellSet();

it works when <identity impersonate="true" /> or <identity impersonate="true"
userName="domain\user" password="password" />

But I dont want to imperonate the account, I want to connect to the cube
using the default ASPNET account.

How can I add a ASPNET user to the OLAP Admin in another server...?
Any thoughts?

Balaji

--
Message posted via SQLMonster.com
http://www.sqlmonster.com/Uwe/Forums...-olap/200607/1

a local account cannot be used to access network resources.(except if the
target server has the exact same username / password created locally.
change the account of your application pool to a domain account, this
account will be used to access the network resources (so the cube).

you can also try to use the default network service account and, if my
memory is good, authorize the domain\machine$ account to access the cube.

if you authorize the anonymous account to access your site, change the logon
behind this anonymous account to a domain account.

another option is to setup IIS on the AS server and install the xml/a HTTP
access. then setup this virtual folder to use the basic authentication.
in your frontend application the connection string will contain a login /
password like you setup the first time:
data source=http://asserver/xmla/msmdpump.dll;user
id=machine\account;password=password;


"balajikkrishnan via SQLMonster.com" <u5178@uwe> wrote

Jeje,

Thanks again for the reply.

I have couple of questions.

1. If I change my web application account to run under the doamin account
(say impersonate the user), my entire web application will run under this
doamin\user account instead of ASPNET account. - Is this correct, do we have
any issues on running this in production.

2. Say if my analysis services and web application are on the same machine, I
can add the ASPNET account to the OLAP admin group, - will this work.

Please advice.

Thanks
balaji

--
Message posted via SQLMonster.com
http://www.sqlmonster.com/Uwe/Forums...-olap/200607/1

1. there is no issue until the user account used is not administrator or
have too many privilege.
You can use a specific delegation account for a set of pages instead-of all
the pages of the application.
take a look at the <location> tag in the web.config
(not tested, but should works fine)

2. if everything is on the same computer, then you have less issues, but
don't add the ASP.Net account in the OLAP admin group!!!
its a big security hole.
on 1 computer, local account can be used to access the cube, so the ASP.NET
account can access the cubes.


"balajikkrishnan via SQLMonster.com" <u5178@uwe> wrote

jeje,

I saw some examples in using the location tag....

<location path="AdminSite">
<system.web>
<customErrors mode="Off" />
<authorization>
<allow roles="Admin">
<deny users="*" />
</authorization>
</system.web>
</location>

do we need to specify the aspx page name(where the analysis services opens
the connection) in the path....

Also can this be used in PRODUCTION.

Thanks
Balaji

--
Message posted via SQLMonster.com
http://www.sqlmonster.com/Uwe/Forums...-olap/200607/1

I think the location option works only with folders, not a specific page.

there is other ways to change the current user context, but this required
some code.

I really recommand to change the account used by the application pool.
Its safe, easy to do and maintain.


"balajikkrishnan via SQLMonster.com" <u5178@uwe> wrote

jeje,

We changed the application pool account to doamin user account, it works....
Thanks a lot, we are in QA phase now....just want to check if we have any
issue........

Thanks again.....

We have one more issue with snowflake schema in AS2005....
http://www.sqlmonster.com/Uwe/Forum....-Very-Critical


Can you throw me some inputs on this.

Balaji

--
Message posted via http://www.sqlmonster.com