WhitePaper: PerformancePoint in an extranet environment

Great read for when you are stuck in the airport: Publishing PerformancePoint Server in Extranet Scenarios.

This is actually a very detailed document outlining many of the aspects around establishing an extranet deployment, particularly a secure one.

Important Note: We have run across a bug in Server 2008's implementation of Kerberos. This issue will cause a fatal flaw to your implementation with SSAS in the scenario– Dan English provides a greater level of detail in his post earlier this year. Just as a recap, you will run into errors in accessing SSAS where the MDX will get truncated in the Kerberos ticket that gets passed to the SSAS service. The only way around this at the moment is to have the front end servers be Server 2003, or CTP versions of Server 2008 R2.

Note that there is no "official" fix for this at the moment, though one is expected as a cumulative update in August.

July 30, 2009 15:06 by Sid
E-mail | Permalink | Comments (5) | Comment RSS

PerformancePoint, Security and Account Access

I was assisting a client clean up an installation of PerformancePoint. They thought they had followed all of the steps, but were perplexed by an error they were getting after deploying the dashboards to SharePoint. Given what was at the bottom of the error, and how few people realized this slight difference in authenticating accounts, I figured it was worth a quick post.

To start, the error received was:

"You do not have permission to see this data. (Domain\UserAccount). Contact the administrator for more details."

My client was perplexed. They had developed the dashboard in Dashboard Designer and previewed it with success on the Monitoring server preview site. This person was an admin of Monitoring server and a site collection admin in SharePoint. The question to me then was – what was going on?

To help explain, below is a diagram of a sample diagram of a PerformancePoint deployment on a farm, which is exactly what this client has in their environment:

The big "gotcha" here for him is based on the usage of NTLM as the authentication method and a lack of understanding on where deployed dashboards actually render and load.

In a non-Kerberos implementation, deployed dashboards will connect to data sources under the identity of the SharePoint service, which was the bit of understanding this user was missing – his perception was that SharePoint rendered output from the Monitoring web service, and thus authentication still happened from the Monitoring Web Service – once this perception was corrected, we added the SharePoint account as a reader on the cube for his dashboards and life went back to normal.

July 21, 2009 12:04 by sid
E-mail | Permalink | Comments (8) | Comment RSS

Installing SSRS for SharePoint, the fun way

I figured the search engines would do a good job of delivering the answers to these questions, but as I have seen this theme reoccur many times over the past few weeks in the MSDN forums, I am going to write out the steps for everyone (if nothing else, at least I'll just be pasting a link to this versus copying the steps all over again in forum responses).

For many people installing the SSRS plug in for SharePoint/WSS (both SSRS 2005, but more likely 2008), you can get these annoying errors (this error can be found in Root:\Users\YourLogin\AppData\Local\Temp and will be prefixed with RS_SP):

For some of you, this error may become a common nuisance when installing the SSRS plug in for MOSS/WSS 3.0 for both SSRS 2005 and 2008:

******* User does not have permission to add feature to site collection: http://<SharePoint URL here>:36076.

This can be particularly frustrating if you are logged in to the box under the farm admin account and have local admin privileges.

To work around this error, follow these steps:

1. Double check that you have a site collection set up on the farm, not just the web app

2. Log into the server you are installing the Reporting Services plug in to with credentials that are the farm admin for the MOSS install

3. Run the CMD tool with Administrator privileges (also called elevated permission)

4. Navigate to where you have the sharepointrs.msi and type sharepointrs.msi SKIPCA=1

5. Navigate to your Temp% directory to find the unpacked rsCustomAction.exe file

6. In the CMD tool, execute rsCustomAction.exe /i

7. After the install, you will probably need to navigate to Central Administration > Site Actions > Site Settings and under the heading Site Collection Administration click Site Collection Features.

8. From there, click activate on Report Server Integration Feature

9. The settings for SSRS will now have their sub section on the Application Management tab in Central Admin

References:

• http://technet.microsoft.com/en-us/library/aa905871.aspx

July 7, 2009 13:09 by Sid
E-mail | Permalink | Comments (16) | Comment RSS