AppPool Permission Issue with Accessing Report Server

Question

I have a SQL Server 2008 R2 Report Server running on a Windows 7 machine as well as an ASP.NET application. The ASP.NET application makes requests to the Report Server to display a list of reports, render reports, etc. My ASP.NET application successfully gets the list of reports but when it tries to render a report I get the following error:

The permissions granted to user 'IIS APPPOOL\DefaultAppPool' are insufficient for performing this operation. (rsAccessDenied)

Description: An unhandled exception occurred during the execution of the current web request. Please review the stack trace for more information about the error and where it originated in the code. 

Exception Details: Microsoft.Reporting.WebForms.ReportServerException: The permissions granted to user 'IIS APPPOOL\DefaultAppPool' are insufficient for performing this operation. (rsAccessDenied)

Source Error: 

An unhandled exception was generated during the execution of the current web request. Information regarding the origin and location of the exception can be identified using the exception stack trace below.

Stack Trace: 

[ReportServerException: The permissions granted to user 'IIS APPPOOL\DefaultAppPool' are insufficient for performing this operation. (rsAccessDenied)]
Microsoft.Reporting.WebForms.ServerReportSoapProxy.OnSoapException(SoapException e) +89
Microsoft.Reporting.WebForms.Internal.Soap.ReportingServices2005.Execution.ProxyMethodInvocation.Execute(RSExecutionConnection connection, ProxyMethod`1 initialMethod, ProxyMethod`1 retryMethod) +404
Microsoft.Reporting.WebForms.Internal.Soap.ReportingServices2005.Execution.RSExecutionConnection.LoadReport(String Report, String HistoryID) +180
Microsoft.Reporting.WebForms.ServerReport.EnsureExecutionSession() +79
Microsoft.Reporting.WebForms.ServerReport.GetParameters() +54

Note: This same code base has worked fine on multiple machines running Windows 7 and Windows Server 2008. Iv'e been trying many different things based on web searches but haven't found a solution. Any insight into this would be greatly appreciated.

Solution 1

Another solution as mreyeros put it in the comment is to give the Browser permission to the IIS APPPOOL\DefaultAppPool user in Report Manager.

To do that you should open the Report Manager website (http:///Reports) in Home folder click Folder Settings -> Security, click New Role Assignment and input the IIS APPPOOL\DefaultAppPool as name, select permissions from the list.

Solution 2

Almost the same situation here except IIS and Report Server running on Windows Server 2008 R2. I used to have the asp.net application running with it's own application pool and everything worked. When I changed the application to the DefaultAppPool (due to a different problem), I got the permissions problem. I changed the Identity of the DefaultAppPool from ApplicationPoolIdentity to LocalSystem (in IIS, Advanced Settings) and it worked again.

Solution 3

As Michal Drozdowicz said, create the AppPool user as a browser role. The part that is missing is

1. The name of the user (at least on Windows 2012 is 'IIS APPPOOL\pool name' This is the exact name that will appear on the error page. Do not put the quotes around the user name when entered in the permission dialog.
2. The browser role must be created at the main folder. Of course, if you need the permission at a sub-folder, ensure that the sub-folder is still inheriting permissions or set it manually

Solution 4

I don't want to set my application pool to LocalSystem as I believe this is bad practice.

For Microsoft recommendations (don't use LocalSystem, use ApplicationPoolIdentity), see here: https://technet.microsoft.com/en-us/library/jj635855.aspx#AppPools.

For justification, see here: https://stackoverflow.com/a/510225/44169

I was experiencing the error described. I had added my app pool identity to my Report Server folder permissions, but this was being overridden by the security settings of a subfolder. I fixed this by selecting the subfolder and clicking "Revert to Parent Security Settings".

View more solutions

Comments

[JabberwockyDecompiler]

This was the answer I was looking for because I did not want to put an AD account on the app pool, but I was not able to get this to work. Did you try anything else that was related to allowing the apppool, ex I tried restarting the report server.

[jon bosker]

I agree that this is a much better solution because it works with the current configuration of IIS rather than changing the security of the site. ApplicationPoolIdentity allows more granular control (i.e. each site can access just the databases it requires). Thanks Michal.