How does one secure SQL Server Reporting Services (SSRS)?

Question

I've installed SSRS on my development machine and everything works as expected - except anyone else who is logged on to my domain can view all of the reports by browsing to http://mymachine/reports. I find it a bit strange that the default behaviour is for everyone on the domain to have access to the reports.

• Am I doing anything wrong here?
• What are the steps I need to follow to ensure that only I am allowed access to the reports?
• And what therefore are the implications for my ASP.NET application that has to access the reports using the ReportViewer control?

On the Report Manager site (http://mymachine/reports > Properties > Security) I see only one group or user - MYDOMAIN\myusername, with all of the possible roles (Browser, Content Manager, My Reports, Publisher, Report Builder).

Any ideas?

EDIT: @davidsleeps : I'm using SSRS 2008 on my dev machine, with SSRS 2005 in production, unfortunately. I thought the security methods would have been transferrable between the two.

Answer 1

For the report manager (2005)
IF your machine is on the domain, you should be able to find the "Reports Manager" directory where it is installed and set permissions on the folder. You can use that to prevent other users from accessing http://mymachine/reports

I think the default path to that is something like:

C:\Program Files\Microsoft SQL Server\MSSQL.X\Reporting Services\ReportManager

But you can just open up IIS and check what the Virtual Path is...

For the reports
I'm not sure of the easiest way, but you can set the permissions on your reports and create an account which your ReportViewer control can use which has access to the reports. In your asp.net web app (or whatever) you can then pass the credentials through.