Configure Security Portal to authenticate access to reports#

The Critical Manufacturing MES installation can configure the Security Portal to authenticate access to SQL Server Reporting Services reports. This page describes how the Security Portal connects to the report server.

Report Server Access#

During the installation, DevOps Center asks for the address and an account of SQL Server Reporting Services: Web Portal URL, Web Service URL, Username, and Password. The Security Portal Forward Auth service requests the reports from the report server with this account on behalf of every user, so the account must have access to all the reports that users can open. To configure report permissions in SQL Server Reporting Services, see Analytics Security.

When a user opens a report, the request is routed to the Forward Auth service, which:

1. Checks with the MES Host whether the user has access to the requested report.
2. Returns 403 Forbidden if the user doesn't have access.
3. Otherwise, requests the report from the report server with the configured account and returns it to the user.

Supporting files of the report page, such as stylesheets and icons, are forwarded without the access check.

Integration with Report Folder functionality#

When the Security Portal checks with the MES Host whether the user has access to a report, the MES Host takes into account the configuration of the Report Folders of the system, which allows users with certain Roles to access the reports inside specific report folders.

Because only one user is used to perform the HTTP requests to the report server, the security access features of SQL Server Reporting Services cannot be used to control what reports each specific user can access. Those access controls need to implemented as Roles in the Critical Manufacturing MES and then the Report Folders can be configured to allow only users with a certain Role to access the reports that are inside them.

For more information, see Report Folders.

Sequence Flow#

The following diagram shows how a report request is authenticated, both when the user has access to the report and when they don't.

sequenceDiagram
    participant User as Browser
    participant Traefik
    participant FA as Forward Auth
    participant Host as MES Host
    participant SSRS as SQL Server Reporting Services

    User->>Traefik: Open report
    Traefik->>FA: Route request to the report fetch endpoint
    FA->>Host: Check user access to the report
    alt User has access
        Host-->>FA: Access granted
        FA->>SSRS: Request report with the configured account
        SSRS-->>FA: Report
        FA-->>User: 200 OK with the report
    else User doesn't have access
        Host-->>FA: Access denied
        FA-->>User: 403 Forbidden
    end