SSRS security issues when using IP address

  • I have an issue that I am hoping someone can help with...

    We run SSRS 2012 in our production environment, and for our test environment we use a snapshot of our production environment that is reachable via a bridge server. Once you remote into the bridge server you can access an entire copy of the production environment, the only difference is the IP addresses. So for example if our SQL server in production is IP address AA.BB.CC.DD then in the copy it's AA.ZZ.CC.DD.

    Just to be sure we're hitting against the test copy, we like to use the IP address of the reporting services website; so basically instead of using http://<SQL Server Name>/Reports we're using http://AA.ZZ.CC.DD/Reports - that way if the network folks forgot to remap the IP's in the test environment, we're not accidentally connecting to production.

    My issue is this... whenever I use the IP address instead of the server name in the URL, IE is asking for my username and password; further, for some people (but not all) even after they've entered their credentials, it's not allowing them to perform various functions that they normally have in production. If they use the name, everything works fine.

    Was just wondering if anyone has seen this before, and, if so, knows of a workaround. It's not a huge problem, more of an annoyance.

  • It sounds like an IIS or certificate issue.

    I vaguely remember seeing this before, but other then the above conjecture, I couldn't tell you where to start. My encounter with the problem was so long ago.

    Brandie Tarvin, MCITP Database AdministratorLiveJournal Blog: http://brandietarvin.livejournal.com/[/url]On LinkedIn!, Google+, and Twitter.Freelance Writer: ShadowrunLatchkeys: Nevermore, Latchkeys: The Bootleg War, and Latchkeys: Roscoes in the Night are now available on Nook and Kindle.

  • Well, it's at least a place to start looking 😀

  • SSRS separated from IIS on SQL Server 2008 - generally just goes through http.sys now.

    When you say Bridge server - is this a vendor specific bridge server? Or is this something like a jump server?

    Sue

  • Sue_H (10/4/2016)


    SSRS separated from IIS on SQL Server 2008 - generally just goes through http.sys now.

    I did not know that. Thank you for that information.

    Brandie Tarvin, MCITP Database AdministratorLiveJournal Blog: http://brandietarvin.livejournal.com/[/url]On LinkedIn!, Google+, and Twitter.Freelance Writer: ShadowrunLatchkeys: Nevermore, Latchkeys: The Bootleg War, and Latchkeys: Roscoes in the Night are now available on Nook and Kindle.

  • Sue_H (10/4/2016)


    SSRS separated from IIS on SQL Server 2008 - generally just goes through http.sys now.

    When you say Bridge server - is this a vendor specific bridge server? Or is this something like a jump server?

    Sue

    The bridge server is basically just a terminal server that, based on firewall settings, has the ability to see both production and test environments. We change the IP mappings so that when you connect so a server via name, you're connecting to the test sub-net instead of the production sub-net.

    To make matters more interesting, we're now seeing the same behavior in production. It didn't used to, but now if I connect to SSRS via the IP it asks for credentials. Strange... :hehe:

  • cphite (10/5/2016)


    Sue_H (10/4/2016)


    SSRS separated from IIS on SQL Server 2008 - generally just goes through http.sys now.

    When you say Bridge server - is this a vendor specific bridge server? Or is this something like a jump server?

    Sue

    The bridge server is basically just a terminal server that, based on firewall settings, has the ability to see both production and test environments. We change the IP mappings so that when you connect so a server via name, you're connecting to the test sub-net instead of the production sub-net.

    To make matters more interesting, we're now seeing the same behavior in production. It didn't used to, but now if I connect to SSRS via the IP it asks for credentials. Strange... :hehe:

    Thanks for the clarification. That's more of what I know of being a jump server. And it sounds like the configuration of that piece is more the problem. Pretty much all of what you are seeing can be due to "networking" issues. You probably want to talk with the network/server group to work out the issues. In some cases, you may need to use the server name due to how they have the forwarding setup. Not sure though, you'd need to check with whoever configures your bridge server.

    Sue

Viewing 7 posts - 1 through 6 (of 6 total)

You must be logged in to reply to this topic. Login to reply