AppPool Permission Issue with Accessing Report Server

Question

I have a SQL Server 2008 R2 Report Server running on a Windows 7 machine as well as an ASP.NET application. The ASP.NET application makes requests to the Report Server to di

Answer 1

In IIS Application Pool Change ApplicationPoolIdentity TO LocalSystem and it will be fixed.

By default ApplicationPoolIdentity DO NOT have access to Report Service i.e. SSRS reports

If you haven’t change the Identity account for your application, then when running the report in the application, it will use the default Identity account “ApplicationPoolIdentity” to access to report server. By default, the default do not have the permission to access report server. So in your scenario, this error due to the default Identity account “ApplicationPoolIdentity” in the Application Pool doesn’t have the permission to access the Report Server.

For more information Link:

https://social.msdn.microsoft.com/Forums/sqlserver/en-US/9593f5a8-09e7-4299-9cf1-5251dd375c38/the-permissions-granted-to-user-iis-apppoolaspnet-v40-are-insufficient-for-performing-this?forum=sqlreportingservices

Answer 2

Almost the same situation here except IIS and Report Server running on Windows Server 2008 R2. I used to have the asp.net application running with it's own application pool and everything worked. When I changed the application to the DefaultAppPool (due to a different problem), I got the permissions problem. I changed the Identity of the DefaultAppPool from ApplicationPoolIdentity to LocalSystem (in IIS, Advanced Settings) and it worked again.

Answer 3

I don't want to set my application pool to LocalSystem as I believe this is bad practice.

For Microsoft recommendations (don't use LocalSystem, use ApplicationPoolIdentity), see here: https://technet.microsoft.com/en-us/library/jj635855.aspx#AppPools.

For justification, see here: https://stackoverflow.com/a/510225/44169

I was experiencing the error described. I had added my app pool identity to my Report Server folder permissions, but this was being overridden by the security settings of a subfolder. I fixed this by selecting the subfolder and clicking "Revert to Parent Security Settings".

Answer 4

Finally figure it out. My Reporting Services were configured to a local account while my Application Pool for IIS was configured to ApplicationPoolIdentity. I changed my Application Pool to LocalSystem and it fixed it. Hopefully this information will be useful to others as I wasted several hours figuring this out.

Answer 5

As Michal Drozdowicz said, create the AppPool user as a browser role. The part that is missing is

1. The name of the user (at least on Windows 2012 is 'IIS APPPOOL\pool name' This is the exact name that will appear on the error page. Do not put the quotes around the user name when entered in the permission dialog.
2. The browser role must be created at the main folder. Of course, if you need the permission at a sub-folder, ensure that the sub-folder is still inheriting permissions or set it manually

Answer 6

Another solution as mreyeros put it in the comment is to give the Browser permission to the IIS APPPOOL\DefaultAppPool user in Report Manager.

To do that you should open the Report Manager website (http:///Reports) in Home folder click Folder Settings -> Security, click New Role Assignment and input the IIS APPPOOL\DefaultAppPool as name, select permissions from the list.