ssrs new role assignment

Navigation Menu

Search code, repositories, users, issues, pull requests..., provide feedback.

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly.

To see all available qualifiers, see our documentation .

• Notifications You must be signed in to change notification settings

create-and-manage-role-assignments.md

Latest commit, file metadata and controls, create and manage role assignments.

A role assignment is a security policy that determines a user's or group's permissions. Permissions decide whether the user or group can access or modify a specific report server item, or do a task. A role assignment consists of a single user or group account name and one or more role definitions.

Role assignments are scoped to the item level or system level .

An item-level role assignment is created for a specific item or branch of the folder hierarchy on the report server. You navigate to a specific folder or item to create a role assignment for it.

System-level role assignments give selected users the capability to do tasks that affect the report server site as a whole. These tasks include:

• Creating shared schedules
• Managing jobs
• Processing reports
• Setting properties

System-level security doesn't convey access to items in the report server folder hierarchy.

Create an item-level role assignment

From here, you can create a separate role assignment for each user or group account that requires access to the report server. If the account is on a domain other than the one that contains the report server, include the domain name. After you specify an account, you choose one or more role definitions. The role definitions are additive. The combined set of all tasks from all definitions is supported in the assignment for a particular user or group.

To enable widespread access, you choose an item that is high in the folder hierarchy (for example, the root folder Home). Later, you can create role assignments to lock down specific areas of the folder hierarchy.

You must be a member of the local Administrator's group on the report server computer to create a role assignment. You can delegate that responsibility by assigning other users to the Content Manager role.

To create or manage role assignments, or for more information, see Grant user access to a report server

Create a system-level role assignment

System-level and item-level role assignments go together. You create a system-level role assignment for each user or group that has an item-level role assignment.

System-level role assignments include a wide range of permissions, but they don't include permissions that are part of an item-level role assignment.

In contrast with system permissions on a computer, system roles in reporting servers don't convey overarching permissions that include all possible tasks. Instead, system-level role assignments are simply a set of tasks that are scoped to the report server site. System role assignments determine whether users can view application properties, such as the image or title of the Home page. They also determine whether users can view or manage shared schedules or use Report Builder.

To create or manage a system-level role assignment or for more information, see Grant user access to a report server and Predefined roles .

Modify a role assignment

You can modify a role assignment at any time. Your changes take effect when you save the role assignment. Role assignment changes don't affect user sessions. If a user has a report open, and you modify a role assignment to deny access, the user can continue to use the report for that active session.

If you add a user account to a group that is already part of a role assignment, there's a delay before the user account is able to access items from the change. The Internet Information Services (IIS) causes the delay by caching authentication tokens. You can either wait for the tokens to refresh (typically 15 minutes), or you can reset IIS to update the cache immediately.

You can only modify one role assignment at a time. You can't perform a global search-and-replace operation to change role definition names, role assignment settings, or to find all the role assignments that include a specific user or group.

Delete a role assignment

You can delete role assignments by selecting the checkbox by each assignment you want to delete, and then clicking Delete . You can also delete role assignments by clicking Revert to Parent Security . When you select this button, the existing role assignments for the item are deleted, and replaced with the assignments inherited from the parent item.

Related content

• Grant user access to a report server
• Role assignments
• Role definitions
• Predefined roles
• Grant permissions on a native mode report server

This browser is no longer supported.

Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.

Create, delete, or modify a role (Management Studio)

• 10 contributors

Reporting Services provides predefined roles that define levels of access to the report server. Each user or group who requires access to the report server, is assigned a role that defines the allowed tasks. Roles are defined for the report server as a whole. You must be consistent in how a role is defined and used throughout all areas of the report server.

To create, modify, or delete roles, you can use SQL Server Management Studio. You can only delete roles that aren't in use.

To assign users and groups to the roles that you create, use the SSRS web portal. For more information, see Grant User Access to a Report Server .

If the report server is configured for SharePoint integrated mode, and you connected to the SharePoint site that the report server is integrated with, you can view and modify the permission levels that control access to report server content and operations.

Create a role definition

In Object Explorer, expand a report server node.

Expand the Security folder.

If you're creating an item-level role definition, right-click Roles > New Role .

Or, if you're creating a system-level role definition, right-click System Roles > New System Role .

Enter a unique name for the role. A name must contain at least one character. It can also include spaces and certain symbols, but not the following characters [; : \ / @ & = + , $ / * < > | "] .

Optionally enter a description. In Management Studio, this description is visible only on this page. Users who view this item through the web portal can see this description in that tool.

Select the tasks that members of this role can do.

Select OK .

Delete or modify a role definition

To delete or modify an item-level role definition, expand the Roles folder, then do one of the following actions:

To delete a role definition, right-click the item > Delete . The Delete Catalog Items dialog box is displayed. Select OK to delete the role.

To modify a role definition, right-click the item > Properties . The General page of the User Role Properties dialog box is displayed.

Select the tasks that members of this role can do, and then select OK .

To delete or modify a system-level role definition, expand the System Roles folder. Do one of the following actions:

To delete a system role definition, right-click the item and select Delete . The Delete Catalog Items dialog box is displayed. Select OK to delete the role.

To modify a system role definition, right-click the item and select Properties . The General page of the System Role Properties dialog box is displayed. Select the tasks that members of this role can do, and select OK to apply the changes.

Related content

• Connect to a report server in Management Studio
• Create and manage role assignments
• Reporting Services in SQL Server Management Studio (SSRS)

Was this page helpful?

Additional resources

SQL Server Reporting Services 2012 Permissions

By: Scott Murray   |   Updated: 2012-10-23   |   Comments (36)   |   Related: > Reporting Services Security

About the author

Comments For This Article

Related Content

SQL Server Reporting Services Security

SQL Server Reporting Services Custom Security with Single Sign-on

SQL Server Reporting Services Encryption Key

SQL Server Reporting Services Report Manager Site Permissions Error After Installation

Determining who is viewing reports in SQL Server 2012 Reporting Services

SQL Server Reporting Services Security Options

SQL Server Reporting Services Column Level Security

Free Learning Guides

Learn Power BI

What is SQL Server?

Download Links

Become a DBA

What is SSIS?

Related Categories

Reporting Services Administration

Reporting Services Best Practices

Reporting Services Configuration

Reporting Services Installation

Reporting Services Migration

Reporting Services Monitoring

Reporting Services Network Load Balancing

Reporting Services Performance

Reporting Services Security

Development

Date Functions

System Functions

JOIN Tables

SQL Server Management Studio

Database Administration

Performance

Performance Tuning

Locking and Blocking

Data Analytics \ ETL

Microsoft Fabric

Azure Data Factory

Integration Services

Popular Articles

Date and Time Conversions Using SQL Server

Format SQL Server Dates with FORMAT Function

SQL Server CROSS APPLY and OUTER APPLY

SQL Server Cursor Example

SQL CASE Statement in Where Clause to Filter Based on a Condition or Expression

SQL NOT IN Operator

How to install SQL Server 2022 step by step

SQL EXISTS Use Cases and Examples

DROP TABLE IF EXISTS Examples for SQL Server

Rolling up multiple rows into a single row and column for SQL Server data

Format numbers in SQL Server

SQL Convert Date to YYYYMMDD

Script to retrieve SQL Server database backup history and no backups

Resolving could not open a connection to SQL Server errors

SQL Server Management Studio Dark Mode

Setup Excel as Front End Application for SQL Server

SQL Server PIVOT and UNPIVOT Examples

How to monitor backup and restore progress in SQL Server

An Introduction to SQL Triggers

Using MERGE in SQL Server to insert, update and delete at the same time

Stack Exchange Network

Stack Exchange network consists of 183 Q&A communities including Stack Overflow , the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Q&A for work

Connect and share knowledge within a single location that is structured and easy to search.

Adding, removing or editing permissions of a user in SSRS 2008 is throwing error ""Response is not well-formed XML

I am totally stumped by a really stubborn problem: When I try to take any action (add, remove, edit) in the Security tab of a report's Properties page on SSRS 2008 UI I get a generic error. All it says is this: Response is not well-formed XML.

Digging in the LogFiles folder at the SSRS installation root, I see this:

role assignment is not valid. The role assignment is either empty, specifies a user or group name that is already used in an existing role assignment for the current item, or specifies duplicate roles for the same user or group. ui!ReportManager_0-1!32c!07/23/2011-15:03:33:: e ERROR: Response is not well-formed XML. ui!ReportManager_0-1!32c!07/23/2011-15:03:33:: e ERROR: HTTP status code --> 500 -------Details-------- System.InvalidOperationException: Response is not well-formed XML. ---> System.Xml.XmlException: Unexpected end of file has occurred. The following elements are not closed: Message, detail, soap:Fault, soap:Body, soap:Envelope. Line 3, position 5470. at System.Xml.XmlTextReaderImpl.Throw(Exception e) at System.Xml.XmlTextReaderImpl.ThrowUnclosedElements() at System.Xml.XmlTextReaderImpl.ParseElementContent() at System.Xml.XmlLoader.LoadNode(Boolean skipOverWhitespace) at System.Xml.XmlLoader.ReadCurrentNode(XmlDocument doc, XmlReader reader) at System.Xml.XmlDocument.ReadNode(XmlReader reader) at System.Web.Services.Protocols.SoapHttpClientProtocol.ReadSoapException(XmlReader reader) at System.Web.Services.Protocols.SoapHttpClientProtocol.ReadResponse(SoapClientMessage message, WebResponse response, Stream responseStream, Boolean asyncCall) at System.Web.Services.Protocols.SoapHttpClientProtocol.Invoke(String methodName, Object[] parameters) --- End of inner exception stack trace --- at System.Web.Services.Protocols.SoapHttpClientProtocol.Invoke(String methodName, Object[] parameters) at Microsoft.SqlServer.ReportingServices2005.ReportingService2005.SetPolicies(String Item, Policy[] Policies) at Microsoft.SqlServer.ReportingServices2005.RSConnection.SetPolicies(String Item, Policy[] Policies) at Microsoft.ReportingServices.UI.ImageTextButton.RaisePostBackEvent(String eventArgument) at System.Web.UI.Page.RaisePostBackEvent(IPostBackEventHandler sourceControl, String eventArgument) at System.Web.UI.Page.ProcessRequestMain(Boolean includeStagesBeforeAsyncPoint, Boolean includeStagesAfterAsyncPoint) library!ReportServer_0-2!a14!07/23/2011-15:03:33:: Call to GetSystemPropertiesAction(). ui!ReportManager_0-1!32c!07/23/2011-15:03:33:: e ERROR: Exception in ShowErrorPage: System.Threading.ThreadAbortException: Thread was being aborted. at System.Threading.Thread.AbortInternal() at System.Threading.Thread.Abort(Object stateInfo) at System.Web.HttpResponse.End() at Microsoft.ReportingServices.UI.ReportingPage.ShowErrorPage(String errMsg) at at System.Threading.Thread.AbortInternal() at System.Threading.Thread.Abort(Object stateInfo) at System.Web.HttpResponse.End() at Microsoft.ReportingServices.UI.ReportingPage.ShowErrorPage(String errMsg)

The databases (ReportServer and ReportServerTempDB) came out clean when I ran DBCC CHECKDB.

This error is preventing me to do any of the following actions: 1. Use "Edit Item Security" for a report or folder 2. Delete a User name from the Home folder Security page 3. Add a new user using "New Role Assignment"

The really weird thing is that some of these 3 actions work in some report folders. There is nothing I can see common between the ones that work and those that don't.

Any ideas??

• Almost certainly you should post the resolution as an answer below and mark it as accepted. –  jscott Commented Jul 26, 2011 at 23:51
• I didn't quite realize where the option to answer it myself was. But it was right below the post and comments! I just posted the Answer but I still can't figure out where to accept it as an answer.Thanks for suggesting :) –  crosswalk Commented Jul 27, 2011 at 21:53

2 Answers 2

THIS ISSUE HAS BEEN RESOLVED!

Root cause: There was a user who was somehow added 3 times to four different roles under Home folder. Any sub folder using the same permissions as Home (inheritance) suffer the same consequences. Why should SSRS allow this in the first place or not flag it clearly in the error log is beyond me!

Resolution: Removed the duplicates for the user (2 of the 3 entries) on SSRS UI.

Lessons learned: 1. Read each error a few times BUT do not get carried away with the most flagrant error 2. Try and separate symptoms from causes (in this case the existence of duplicate IDs was the cause but in the error logs you will see whole bunch of language like "Unexpected end of file has occurred" that under the stressful circumstances could easily mislead and send you down a rabbit hole! 3. Take any suggestion you get with a pinch of salt but vet it properly

If possible, I would:

• Export the reports from SRSS
• Uninstall SRSS
• Delete/rename the SRSS databases (backing up would be a good idea too)
• Create a new SRSS instance
• Add all reports again (manually if you can) and trying to configure preferences.

• That is really not possible for us but I did restore the ReportServer and ReportServerTempDB databases on a new SQL Server and pointed a new SSRS instance to them but I got the same error still! –  crosswalk Commented Jul 26, 2011 at 8:17
• That would imply that your SSRS databases are corrupted which only makes my suggestion sit even better. Export the reports from the current instance, import them into a new instance and see if you experience the same problem - if not, it again confirms that your SSRS databases are in a foul state. Your only hope is to reinstall (read: blow away) that instance. Can I ask why its not really possible for you? SSRS isn't very highly integrated with anything and there isn't a lot to lose from reinstalling. –  Ashley Commented Jul 26, 2011 at 22:14

You must log in to answer this question.

Not the answer you're looking for browse other questions tagged ssrs ssrs-2008 ..

• The Overflow Blog
• CEO Update: Building trust in AI is key to a thriving knowledge ecosystem
• How to improve the developer experience in today’s ecommerce world
• Featured on Meta
• Preventing unauthorized automated access to the network
• Upcoming initiatives on Stack Overflow and across the Stack Exchange network...

Hot Network Questions

• Are there planetary scientists who suggest that the term "exosphere" does more harm than good?
• Can a male Ginkgo Biloba tree bear one fruit?
• How to create a cicular hole pattern with geometry nodes (flange hole pattern)?
• Huge Bounds on Forecast Interval for ARIMA model
• Why do key signatures switch from flats to sharps at a certain mode brightness?
• Check subtype relation in a simple type system
• What are some options for adding a sound equality operator (or avoiding it) in a type system with subtyping?
• How important is it to avoid a duplicate name?
• Problems adjusting color in tikzpicture
• Why does \input\contents not work, \input\jobname.toc does ? Self constructed tableofcontents
• Why does Lollar Special T bridge pickup sound hotter while DC resistance read high?
• Building Skyscrapers
• What is this mysterious bar in my hotel shower?
• Get drive's path using its name
• What is this usage of んじゃない? is it imperative negative?
• An empty program that does nothing in C++ needs a heap of 204KB but not in C
• Does logic "come before" mathematics?
• Framework for explaining the notion "implementing according to a specification"?
• Collect[f[a x + b y + c x], x] does not work. How to collect terms inside a function?
• Passport picture with hair but I’m bald now
• How to efficiently select elements with the minimum value from a large list?
• Why is the deletion ungrammatical in "I like the girl [who is] the prettiest in my class" but grammatical in other sentences?
• Why is the First Law of Motion a physical law?
• Open source license more viral than GPL/AGPL