rsAccessDenied - user in in administrators group

See more:

ASP.NET

SSRS

Hi all,

I've created a reporting app/portal at work which features a mix of asp.net charts and a load of SSRS reports.

In the development environment, the whole app works fine, reports and all.

I deployed to our test server today, fully expecting some issues to iron out, and I got the whole app minus the SSRS reports working just fine.

The report viewer in my app (I've used the ReportViewer web control to display in my pages) gives me the infamous rsAccessDenied.

I can view the reports on the server directly via the ReportManager page, and I can view them when I run my app as me, in VS2012, with the reports being served from our dev server.

I created a new account for this application (didn't want to use a built in one because I want to lock down the account to just what it needs/is allowed access to for security reasons.

I did everything by the book as far as I can tell. In the report manager, I added the new user account first as a 'browser' then as admin. No luck either way.

I then added the user account to the Administrators group directly on the box. Still no luck.

As far as I can see, the account currently has full admin privileges, yet I still get rsAccessDenied.

The account is currently also in the IUSR (or is it IIS_Users) group, which it needs to be so that IIS can serve my pages, otherwise I get a different error telling me that IIS couldn't write to the temporary asp.net pages folder or something (sorry, I'm not in front of my work machine right now).

Has anyone encountered this? If so, any ideas?

Thanks in advance.

PS. I'm rapidly losing faith in SSRS so would also be interested to hear about alternatives.

UPDATE:

I made some slight progress on this. It looks like IIS caches permissions, because if I restart IIS after making a change to the permissions of the user account, the changes take effect.

This means my app can now run if I grant local admin rights to the user account, however I don't want it to go live with admin rights for obvious reasons.

If I give the account admin rights, then restart the IIS app pool, the app works, and continues to work even AFTER taking the account out of the administrators group, but then it will break on the next app pool recycle.

Something is happening permissions wise between IIS and SSRS, because if I run IE (or Chrome) as my app user, even without Admin permissions, the reports run as expected.

I know that IIS is passing the right user context because I have a test page that displays it.

Any thoughts on this would be much appreciated, as the app is scheduled to go live in January.