Take the 2-minute tour ×
SharePoint Stack Exchange is a question and answer site for SharePoint enthusiasts. It's 100% free, no registration required.

Here is my scenario: I've got SSRS 2008 R2 running in integrated mode with SharePoint 2010. Everything works as expected in that I can create data sources, models (either through studio or via the "generate model" option on the ECB for a datasource in a report library). My datasource is using a dedicated SQL account with the stored credentials option. My model specifically hides a couple of columns so that my report builder 3.0 users don't have access to them (consider these sensitive columns).

What I've discovered though is that while a user cannot edit my model or the data source (they only have read access to them), they can (from another report library where they have contribute permissions) create a new report model (from SharEPoint) and simply past the url to the report data source I setup for them in my library. Once they do this, they end up with a model which does not have any of the hidden columns I setup in the locked-down model. This model also does not have any of the model item security settings I have applied - it's a brand new model only using the data source.

So here is my question: Microsoft implies that report model item security can be used to prevent users from accessing certain entities in the model (hence the term "report model item security"). But if users can simply create there own model using the SharePoint UI from a report library of their own creation and point to the datasource (.rsds file) that they have to have read access to, isn't this a bit of a security flaw?

share|improve this question
    
Interesting question. Do you have some links from MS regarding the item level security? I am interested to look into this. –  Russell Aug 1 '12 at 3:11
    
Yes, take a look at technet.microsoft.com/en-us/library/…. At the bottom under hiding model items and how to secure items it seems to imply that this is a valid approach to preventing access to specific entities in the model. –  Jared McGrath Aug 2 '12 at 13:33
    
I think the article explains hiding model items does not secure them, it simply sets the visibility to false. It says to use role assignments to secure items. –  Russell Aug 3 '12 at 0:10
    
You could always lock down a data source by having different data sources using different credentials to control access? –  Russell Aug 3 '12 at 0:25
    
Yes, I can see what you are saying regarding the article. However, I still feel it's a bit misleading. I'll give you full credit though for the answer. Thanks! –  Jared McGrath Aug 3 '12 at 17:47

1 Answer 1

up vote 0 down vote accepted

I think the article explains hiding model items does not secure them, it simply sets the visibility to false. It says to use role assignments to secure items.

You could always lock down a data source by having different data sources using different credentials to control access?

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.