Hi all,


--
-= Tonio =-

Ooops, here's my question, sorry

When i try to register the ASPNET user of a remote server into a cube role,
i just get an unexplained system error (3238068224). This user is required
because, even in an integrated security logic, the connection is initiated by
the ASPNET user and then, passed to the real user. If i don't give rights to
this user, i fall back on an anonymous connection ...

I use Management Studio from the remote server to connect my SSAS database,
and then register ASPNET user (in fact this action fails with all local user
i try to add to the role memberships). This method always worked, even with
Analysis Services 2K, and i can't figure out why it fails now ...

Any idea about this ?

Here's the xml command failing, according to the SQL Server Profiler :
<Alter AllowCreate="true" ObjectExpansion="ObjectProperties"
xmlns="http://schemas.microsoft.com/analysisservices/2003/engine">
<Object>
<DatabaseID>TestMKT_AS</DatabaseID>
<RoleID>Role 1</RoleID>
</Object>
<ObjectDefinition>
<Role xmlns:xsd="http://www.w3.org/2001/XMLSchema"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
<ID>Role 1</ID>
<Name>Role</Name>
<Members>
<Member>
<Name>Administrateur</Name>
</Member>
<Member>
<Name>ASPNET</Name>
</Member>
</Members>
</Role>
</ObjectDefinition>
</Alter>

Thanks in advance !

--
-= Tonio =-

no, ASPNET user is not required in the role.
you have to use the Kerberos delegation to use the end user account when you
access the AS Server. (with impersonation the user account is used to access
backend ressources)

but you have to be in active directory mode and you have to use a domain
account to run your IIS application pool.
you can't use local account from server A into the server B.

if you are not in an active directory, then you can't impersonate the user
using the windows NT authentication through your ASP.Net application.
instead, use the basic authentication, in this case there is no kerberos
setup and less impersonation issue, but its less secure and prompt the user
for a login/password.

if you don't want to impersonate the user and you want to use the IIS
application pool account to access the cubes.
you have 2 options:
insure that the user account used is the same on the 2 servers (same
username and password)
use a domain or active directory account for your application pool identity
force the usage of a specific account in the <identity> tag of the
web.config file

good luck.


"Antoine Prevot" <AntoinePrevot (AT) discussions (DOT) microsoft.com> wrote

Hi Jéjé, long time no see !

Thanks for your help, i was confusing with the AS2K vs NTLM authentication
approach. I activated delegations for the different servers/accounts, and
used a domain account for my application pool, and everything works fine !

Thanks again !

--
-= Tonio =-