Business Intelligencia and the Authentication mountain
- From: "Nick Large" <nlarge@xxxxxxxxxxxxxxxxx>
- Date: Tue, 23 Dec 2008 15:22:22 -0600
Hi Newsgroup
I am having difficulty working out the best method of bringing my BI
solution into production. I have created the AS project, associated SSIS
and SSRS projects and am quite happy with the results. However, I need
assurance that I do not have to associate any of these applications with my
login. I do not want a situation where my password changes due to company
policy and the whole project comes crumbling down like a ton of bricks. So
I set out to redo all my connections to either use Sql login's or (worst
case scenario) a new ADS nt-login. I say worst case scenario because the
process connected to instating a new ADS user in this company is not
dissimilar to recreating the great wall of china (re:SOX/Sarbanes).
Problem 1: Should I create a new domain user in order for the dba to install
analysis services on the production server? Just in case the server is
non-responsive when the dba is forced to change their winnt-login?
Problem 2: In my AS2005 project i have a datasource that points to the data
in the datamart. this ds uses the "use the service account" option because
I could not use "Use the crudentials of the current user" option because
that would link the dba's login to the connection which would expire when
his password expires. This works OK for now, fingers crossed, but is this a
good method of doing this or will I get issues somewhere down the path or at
time that it comes to move to production, are there any security issues
surrounding this? Do I need to do some additional preparation before using
this account for this purpose or can I rely on it *working* when I am
rushing around trying to get the system into production?
Problem 3: What do I use as the connection in my ETL process at the point
where it processes the cube? I am currently using the "Analysis Services
Processing Task". This works fine if I use my winnt login, but as I
described, I cannot do so. I use the "Create a connection to a computer
running Analysis services, and set the level to Impersonate. This appears
to impersonate the current user (which would be me). What should I do here?
I don't know if using the second option "Create a connection to an analysis
service project in this solution" is going to work when I move to production
as I would be using different wizards, one for AS and one for SSIS so when
it is in production there is a chance that ssis would be pointing to
development if I use this option, correct? This is a real unknown because I
also cannot see any option to log into the server as sql server. very
confusing.
Problem 4: My SSRS solution has a datasource for the analysis cubes. The
datasource logs in as me. My other options are *Use Windows Authentication
*Use a specific user name and password (Domain login) *prompt for
crudentials (not even considered as it would have a bad effect on the
reports if the user had to log in every time they refresh a report) -or- *No
crudentials (how would this work???) - i think this would be a security
risk, right?
I think that is pretty much it.
Is there a way for me to do all this with either a service account (without
having to change any existing service account passwords), that is, by
creating a new user on the server outside of the domain (local), or by using
sql login? Or is Microsoft forcing me to set up new domain login's?
Thanks for any help.
Nick.
.
- Prev by Date: test
- Next by Date: Can SSAS uses more than 3GB momery in 32 bit box?
- Previous by thread: test
- Next by thread: Can SSAS uses more than 3GB momery in 32 bit box?
- Index(es):
Relevant Pages
|
