Using the Reporting Services Web Service, how do you get the permissions of a particular user?

Question

Using the SQL Server Reporting Services Web Service, how can I determine the permissions of a particular domain user for a particular report? The user in question is not the user that is accessing the Web Service.

I am accessing the Web Service using a domain service account (lets say MYDOMAIN\SSRSAdmin) that has full permissions in SSRS. I would like to programmatically find the permissions of a domain user (lets say MYDOMAIN\JimBob) for a particular report.

The GetPermissions() method on the Web Service will return a list of permissions that the current user has (MYDOMAIN\SSRSAdmin), but that is not what I'm looking for. How can I get this same list of permissions for MYDOMAIN\JimBob? I will not have the user's domain password, so using their credentials to call the GetPermissions() method is not an option. I am however accessing this from an account that has full permissions, so I would think that theoretically the information should be available to it.

Answer 1

SSRS gets the NT groups from the users' NT login token. This is why when you are added to a new group, you are expected to log out and back in. The same applies to most Windows checks (SQL Server, shares, NTFS etc).

If you know the NT group(s)...

You can query the ReportServer database directly. I've lifted this almost directly out of one of our reports which we use to check folder security (C.Type = 1). Filter on U.UserName.

SELECT
    R.RoleName,
    U.UserName,
    C.Path
FROM
    ReportServer.dbo.Catalog C WITH (NOLOCK)    --Parent
    JOIN
    ReportServer.dbo.Policies P WITH (NOLOCK) ON C.PolicyID = P.PolicyID
    JOIN
    ReportServer.dbo.PolicyUserRole PUR WITH (NOLOCK) ON P.PolicyID = PUR.PolicyID 
    JOIN
    ReportServer.dbo.Users U WITH (NOLOCK) ON PUR.UserID = U.UserID 
    JOIN
    ReportServer.dbo.Roles R WITH (NOLOCK) ON PUR.RoleID = R.RoleID
WHERE
    C.Type = 1