DataSource via Parameter + Security

Question

My question relates more to the security of its implementation than just technical questions.

I have developed all the reports and are on Reporting Server. They are used by application using the ReportViewer Control in ASP.NET.

Given that these reports may have different DataSources, I created a parameter to the DataSource in the report and send connectionString application as parameter to the report.

So far everything is fine, however, this is where my question arises. Since I spend a ConnectionString that has a user and password for parameter, I will not have here a security flaw?

I would like an opinion from you, and if anyone has a better way to implement, tell me.

Answer 1

Maybe Expression-Based Connection Strings will help here?

The docs have a pretty clear example, i.e. a connection string similar to:

="data source=" & Parameters!ServerName.Value & ";initial catalog=AdventureWorks

These allow you to still pass a parameter to define the Data Source, but it also allows you to store credentials separately so that way you don't necessarily have to pass any security details when calling the report.

Added after comment:

Here's an example report with an Expression-based Connection String.

You can see the Connection String uses a parameter to determine exactly where it's connecting; this can be updated as you require.

The credentials are stored in the Data Source; you can store the credentials (see the above screenshot) or you can choose any other option that suits, e.g. Windows Integrated Security.

So it might not suit you perfectly but this is the inbuilt SSRS functionality for this sort of configurable Data Source requirement.

Second edit:

In the above example, Parameters!ServerName.Value is indeed a report parameter, you would just create it like any another. Depending on how your reports are being launched, you could make it a hidden parameter and handle the actual value sent in code; it's just a question of implementation and really up to you.

For Expression-based connection strings, the Data Source must be stored in the report, and its Connection String is determined at run time.

So you can build whatever you need, based on one or more parameters - it's just a string value you're constructing so you can make it whatever you want to suit your purpose; you can point it to whatever server/database combination required. Please clarify if this doesn't answer your question.