dbTalk Databases Forums  

Re: Security problems - Help !!!

microsoft.public.sqlserver.olap microsoft.public.sqlserver.olap


Discuss Re: Security problems - Help !!! in the microsoft.public.sqlserver.olap forum.



Reply
 
Thread Tools Display Modes
  #1  
Old   
DBA_33
 
Posts: n/a

Default Re: Security problems - Help !!! - 09-02-2003 , 09:18 PM







Thank you for your reply.



My account setting is done properly. I have a account called "tester"
which is in OLAP administrator role. At the same time, i have also
added this account into my cube secirity setting to allow it to access
to the cube.



My SQL Server Server is Standard Edition.


--
Posted via http://dbforums.com

Reply With Quote
  #2  
Old   
Eugene
 
Posts: n/a

Default Re: Security problems - Help !!! - 09-03-2003 , 06:02 PM






I want solve the same problem. According to MS, AS must be Enterprise
Edition to have this work. I have Enterprise and still can't make it work.
Microsoft: I have read your white paper and copied the MSOlap.asp and
Msmdpump.dll into the wwwroot, did everything in the paper and still can't
make it work. Is there anything missing here?
"DBA_33" <member37692 (AT) dbforums (DOT) com> wrote

Quote:
Thank you for your reply.



My account setting is done properly. I have a account called "tester"
which is in OLAP administrator role. At the same time, i have also
added this account into my cube secirity setting to allow it to access
to the cube.



My SQL Server Server is Standard Edition.


--
Posted via http://dbforums.com



Reply With Quote
  #3  
Old   
Dave Wickert [MSFT]
 
Posts: n/a

Default Re: Security problems - Help !!! - 09-03-2003 , 10:20 PM



Let's consider intranet users:

First you need to realize that even though you are using IIS to generate the
OWC ActiveX control, the actual connection from the client machine where OWC
is running and the AS server uses normal client-server connections (using
port 2725). IE/ASP is only used to provide the screen real estate for the
ActiveX control. Under the covers, the ActiveX control is making a normal
client-server connection to AS. So you have two sessions running. One using
port 80 through IIS for IE go generate the OWC ActiveX control and a second
using port 2725 from the ActiveX control to AS for data access. The actual
data connection is done by the OWC ActiveX control through PTS on the client
machine to Analysis Services.

It is PTS that notices that the server name is TEST_SERVER and thus it uses
the normal client-server access type.

Thus one of the problems might be that PTS hasn't been installed properly on
the client machines. Go to your AS SP3 distribution and look in the folder
\msolap\install\pts\ptslite.exe and run that on the machines that are
causing problems.

Another possible problem might be the security environment. Since this is a
normal client-server connection, PTS requires NT authentication from the
client machine to the AS server. On the client machine, for normal
client-server access, PTS will use the logged in user's credentials when
accessing the AS server. Thus there needs to be a trust relationship in the
domain between the user's machine and the AS server.

If you still are getting into problems, try and identify what is *different*
from those machines that work and those that don't.

Now let's consider Internet users:

Are you planning on openning up all of the required ports that allow
Internet access?? Normal client-server access isn't typically advised across
the Internet as it requires full NT authentication. I suppose you could do
it but it has lots of security issues. You should be looking at http access
for Internet access, but you will need Enterprise Edition for that. See BOL
for how you configure http access, but basically you specify in the connect
string "http://TEST_SERVER/olapaccess" as the server name. A server name
like that tells PTS to not use normal client-server access, but to use http
access. The data connection is then routed through IIS to the virtual
directory called 'olapaccess' (I used that just as a sample). The virtual
directory can use any IIS authentication method -- and you can use other IIS
features such as SSL to ensure that the data is encrypted and private across
the Internet.

Hope that helps.

--
Dave Wickert [MSFT]
dwickert (AT) online (DOT) microsoft.com
Program Manager
BI Practices Team
SQL BI Product Unit (Analysis Services)
--
This posting is provided "AS IS" with no warranties, and confers no rights.

"DBA_33" <member37692 (AT) dbforums (DOT) com> wrote

Quote:
Thank you for your reply.



My account setting is done properly. I have a account called "tester"
which is in OLAP administrator role. At the same time, i have also
added this account into my cube secirity setting to allow it to access
to the cube.



My SQL Server Server is Standard Edition.


--
Posted via http://dbforums.com



Reply With Quote
  #4  
Old   
Mosha Pasumansky [MS]
 
Posts: n/a

Default Re: Security problems - Help !!! - 09-03-2003 , 10:22 PM



"Eugene" <eugene.chen (AT) iwl (DOT) com.au> wrote

Quote:
I want solve the same problem. According to MS, AS must be Enterprise
Edition to have this work. I have Enterprise and still can't make it work.
Microsoft: I have read your white paper and copied the MSOlap.asp and
Msmdpump.dll into the wwwroot, did everything in the paper and still can't
make it work. Is there anything missing here?
1. What are the sympthoms that you see ?
2. How IIS is configured (especially with respect to security) ?

--
==================================================
Mosha Pasumansky - www.mosha.com/msolap
Development Lead in the Analysis Server team
All you need is love (John Lennon)
Disclaimer : This posting is provided "AS IS" with no warranties, and
confers no rights.
==================================================




Reply With Quote
  #5  
Old   
Dave Wickert [MSFT]
 
Posts: n/a

Default Re: Security problems - Help !!! - 09-03-2003 , 10:22 PM



This a totally different issue that the one originally posted in this
thread.
The original poster asked about normal client-server access; this concerns
how to configure http access.
If you will start another thread, I'd be glad to assist -- I don't want to
mix advise between the two topics.
Thanks.

--
Dave Wickert [MSFT]
dwickert (AT) online (DOT) microsoft.com
Program Manager
BI Practices Team
SQL BI Product Unit (Analysis Services)
--
This posting is provided "AS IS" with no warranties, and confers no rights.

"Eugene" <eugene.chen (AT) iwl (DOT) com.au> wrote

Quote:
I want solve the same problem. According to MS, AS must be Enterprise
Edition to have this work. I have Enterprise and still can't make it work.
Microsoft: I have read your white paper and copied the MSOlap.asp and
Msmdpump.dll into the wwwroot, did everything in the paper and still can't
make it work. Is there anything missing here?
"DBA_33" <member37692 (AT) dbforums (DOT) com> wrote in message
news:3322367.1062555517 (AT) dbforums (DOT) com...

Thank you for your reply.



My account setting is done properly. I have a account called "tester"
which is in OLAP administrator role. At the same time, i have also
added this account into my cube secirity setting to allow it to access
to the cube.



My SQL Server Server is Standard Edition.


--
Posted via http://dbforums.com





Reply With Quote
  #6  
Old   
DBA_33
 
Posts: n/a

Default Re: Security problems - Help !!! - 09-04-2003 , 04:14 AM




Thanks all especially to Dave Wickert,

Your information has cleared a lot of my doubts.



I understand that to use the HTTP connection for IIS to Analysis Server
we need to have Enterprise Edition installed. I have installed the MS
SQL 2000 Enterprise Edition/Analysis Server on the live server where an
IIS is running. I have done the MSOLAP setting in the IIS and the
security setting is turned into "Basic Authentication". I have done all
the settings stated in the MSDN online resources.



Here is the scenario, kindly refer to my original posted message for
reference. TQ

1) I used the http://TEST_SERVER for my asp application and assume all

the coding are still the same. I got the error message when i run my

asp application, "The http server cannot be found".



Then i changed the http://Test_Server to http://192.168.30.8 (where

this ip is my Test_server 's IP) . Then the application was
succussfully

loaded. Please note that i am using the same name (Test_Server) for

my Computer name, SQL Server Instance name and also the Analysis

Server Instant name.

I shall code the HTTP://Myservername/Olapservername or

HTTP://MYOLAPSERVERNAME ?



Can you kindly enlighten me what is happening in the backend. TQ.



2) I finally get the ASP application running. But i some problems
occured

instead:

- The PC previously tested working with the client-server enviroment

was having error message "The connection may be in used, ....

I am sure i got the sufficient licenses to run the
application. I wonder

what has causing this.

- The PC that was having problem is running successfully. But i

discovered that the Cube security setting was not taking
place where

it allowed the specific user to view all the data from the
Pivot list.

This user that i mentioned belongs to "user" group and
restricted to

access only certain salesmen information. But i can see all
instead.



Is there any standard version or Service packs for OWC, IE , IIS,
drivers, W2k server that i must use in order to make it run smoothly on
all machines ?





Once again, thank you in advance for all you information. Kindly help me
out of this situation.



Best Regards,

Jeff


--
Posted via http://dbforums.com

Reply With Quote
  #7  
Old   
Dave Wickert [MSFT]
 
Posts: n/a

Default Re: Security problems - Help !!! - 09-04-2003 , 10:44 PM



1) Since using the IP address works; but the computer name doesn't -- I
would assume that you have some kind of networking problems.
Check with your networking administrator. Can you map to other resources on
that computer by machine name?

2) You access the computer by referring to the server name in the connect
string as http://<machinename>/<virtual directory> where the msolap.asp file
is located in that virtual directory.

3) If you are going to use basic authentication across the Internet then you
should look at using SSL (and referring to the server as
https://<machinename>/<virtual directory> ) -- basic authentication only
lightly encrypts the username and password (does a base64 on it) -- thus the
requirement for SSL.

4) With regards to your user seeing all members, two possibilities come to
mind. First, if the user is a member of the OLAP Administrators group, then
they automatically see all members; second, have you checked that you don't
have an Everyone role enabled.

--
Dave Wickert [MSFT]
dwickert (AT) online (DOT) microsoft.com
Program Manager
BI Practices Team
SQL BI Product Unit (Analysis Services)
--
This posting is provided "AS IS" with no warranties, and confers no rights.

"DBA_33" <member37692 (AT) dbforums (DOT) com> wrote

Quote:
Thanks all especially to Dave Wickert,

Your information has cleared a lot of my doubts.



I understand that to use the HTTP connection for IIS to Analysis Server
we need to have Enterprise Edition installed. I have installed the MS
SQL 2000 Enterprise Edition/Analysis Server on the live server where an
IIS is running. I have done the MSOLAP setting in the IIS and the
security setting is turned into "Basic Authentication". I have done all
the settings stated in the MSDN online resources.



Here is the scenario, kindly refer to my original posted message for
reference. TQ

1) I used the http://TEST_SERVER for my asp application and assume all

the coding are still the same. I got the error message when i run my

asp application, "The http server cannot be found".



Then i changed the http://Test_Server to http://192.168.30.8 (where

this ip is my Test_server 's IP) . Then the application was
succussfully

loaded. Please note that i am using the same name (Test_Server) for

my Computer name, SQL Server Instance name and also the Analysis

Server Instant name.

I shall code the HTTP://Myservername/Olapservername or

HTTP://MYOLAPSERVERNAME ?



Can you kindly enlighten me what is happening in the backend. TQ.



2) I finally get the ASP application running. But i some problems
occured

instead:

- The PC previously tested working with the client-server enviroment

was having error message "The connection may be in used, ....

I am sure i got the sufficient licenses to run the
application. I wonder

what has causing this.

- The PC that was having problem is running successfully. But i

discovered that the Cube security setting was not taking
place where

it allowed the specific user to view all the data from the
Pivot list.

This user that i mentioned belongs to "user" group and
restricted to

access only certain salesmen information. But i can see all
instead.



Is there any standard version or Service packs for OWC, IE , IIS,
drivers, W2k server that i must use in order to make it run smoothly on
all machines ?





Once again, thank you in advance for all you information. Kindly help me
out of this situation.



Best Regards,

Jeff


--
Posted via http://dbforums.com



Reply With Quote
  #8  
Old   
Dave Wickert [MSFT]
 
Posts: n/a

Default Re: Security problems - Help !!! - 09-04-2003 , 10:46 PM



Lastly look at this KB article:
http://support.microsoft.com/service.../WCT120401.asp

--
Dave Wickert [MSFT]
dwickert (AT) online (DOT) microsoft.com
Program Manager
BI Practices Team
SQL BI Product Unit (Analysis Services)
--
This posting is provided "AS IS" with no warranties, and confers no rights.

"DBA_33" <member37692 (AT) dbforums (DOT) com> wrote

Quote:
Thanks all especially to Dave Wickert,

Your information has cleared a lot of my doubts.



I understand that to use the HTTP connection for IIS to Analysis Server
we need to have Enterprise Edition installed. I have installed the MS
SQL 2000 Enterprise Edition/Analysis Server on the live server where an
IIS is running. I have done the MSOLAP setting in the IIS and the
security setting is turned into "Basic Authentication". I have done all
the settings stated in the MSDN online resources.



Here is the scenario, kindly refer to my original posted message for
reference. TQ

1) I used the http://TEST_SERVER for my asp application and assume all

the coding are still the same. I got the error message when i run my

asp application, "The http server cannot be found".



Then i changed the http://Test_Server to http://192.168.30.8 (where

this ip is my Test_server 's IP) . Then the application was
succussfully

loaded. Please note that i am using the same name (Test_Server) for

my Computer name, SQL Server Instance name and also the Analysis

Server Instant name.

I shall code the HTTP://Myservername/Olapservername or

HTTP://MYOLAPSERVERNAME ?



Can you kindly enlighten me what is happening in the backend. TQ.



2) I finally get the ASP application running. But i some problems
occured

instead:

- The PC previously tested working with the client-server enviroment

was having error message "The connection may be in used, ....

I am sure i got the sufficient licenses to run the
application. I wonder

what has causing this.

- The PC that was having problem is running successfully. But i

discovered that the Cube security setting was not taking
place where

it allowed the specific user to view all the data from the
Pivot list.

This user that i mentioned belongs to "user" group and
restricted to

access only certain salesmen information. But i can see all
instead.



Is there any standard version or Service packs for OWC, IE , IIS,
drivers, W2k server that i must use in order to make it run smoothly on
all machines ?





Once again, thank you in advance for all you information. Kindly help me
out of this situation.



Best Regards,

Jeff


--
Posted via http://dbforums.com



Reply With Quote
Reply




Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

vB code is On
Smilies are On
[IMG] code is On
HTML code is Off



Powered by vBulletin Version 3.5.3
Copyright ©2000 - 2012, Jelsoft Enterprises Ltd.