SSRS Forms Authentication - How To Pass Cookie Credentials To Report Server

Question

I am currently attempting to render the SSRS report in my web application using forms authentication.

My SSRS Report Version is 2016.

Initially I was under the impression that NetworkCredentials would work, and after encountering errors, I found that we are required to use FormsAuthentication, with passing the cookie as a means of authenticating the user.

I have done the necessary settings on the config files in the Reporting Server by following the guide from the link below:-

https://github.com/Microsoft/Reporting-Services/tree/master/CustomSecuritySample2016

The reporting services works as intended on the localhost/ReportServer and on the SSRS Portal, localhost/Reports. I am also able to access said server remotely.

Below is the code I used to obtain the authenticated cookie.

MyReportingService rsClient = new MyReportingService();
rsClient.Url = "http://xxx.xxx.xxx.xxx/reportserver/ReportService2010.asmx";
try
{
     rsClient.LogonUser("user", "password", "");
     Cookie myAuthCookie = rsClient.AuthCookie;
     HttpCookie cookie = new HttpCookie(myAuthCookie.Name, myAuthCookie.Value);
     Response.Cookies.Add(cookie);
}

Which supposedly would then be used to authenticate the user.

Cookie authCookie = new Cookie(cookie2.Name, cookie2.Value);

authCookie.Domain = "DomainName";

rvSiteMapping.ServerReport.ReportServerCredentials = new MyReportServerCredentials(authCookie);

rvSiteMapping.ServerReport.Cookies.Add(authCookie);

And in my forms authentication within the IReportsServerCredentials Class:-

public bool GetFormsCredentials(out Cookie authCookie,
            out string user, out string password, out string authority)
        {
            authCookie = m_authCookie;
            user = password = authority = null;
            return true;  // Use forms credentials to authenticate.
        }

The issue I am experiencing is when the application is passing the credentials to the report server. I believe I must be doing this part incorrectly because while my application does get the cookie, when it authenticates the credentials provided by the cookie, I receive the text/html error:-

Object moved to <a href="/ReportServer/logon.aspx?ReturnUrl=%2fReportserver%2fReportExecution2005.asmx" />

This error is in response to setting a default generic Identity in the event that the HttpContext.Current.User = null.

if (HttpContext.Current != null
                 && HttpContext.Current.User != null)
{
     userIdentity = HttpContext.Current.User.Identity;
}
else
{
     userIdentity = new GenericIdentity("AnonymousUser");
}

I have tried googling the answer but most of the results are for windows authentication and the few that are related to forms authentication are very similar to the code I referred to.

score 2 · Accepted Answer · answered Jul 25 '19 at 08:03

The underlying cause of the issue was under my nose the whole time.

The domain name should refer to the web domain and not the active directory domain.

authCookie.Domain = "DomainName";

The cookie is now able to authenticate the user as intended.

Hopefully this helps anyone who happens to make the same mistake.

SSRS Forms Authentication - How To Pass Cookie Credentials To Report Server

1 Answers1