Display cube in asp.net

Thread view:

Enable EMail Alerts

Start New Thread

Thread rating:

Andres Salvador - 29 Jun 2009 10:26 GMT

Hello,

I have developed a olap cube and a asp.net page (visual studio 2008). This
asp.net page show the cube with a third-party control.

If I execute it in my develop environment (that has sql server and iis in
the same server) it works, but in production environment I have two different
servers, one for sql server 2005 and other with iis server (in the same
domain).

When the asp.net page tries to show the cube data of the other server throws
this exception (in spanish):
- Se ha detectado un error en el nivel de transporte. (error in transport
layer)
- El nodo ha cerrado la conexión antes de tiempo. (the node has closed the
connection before than expected)
And in the stack I see:
- Couldn't connect to the Analysis Services.

I think that the problem is about permissions, because I see in the sql
server profiler that the page try to connect to sql server with the user
anonymous, because it connect throught asp.net.

Thanks.

Reply to this Message

John - 30 Jun 2009 14:07 GMT

On Jun 29, 5:26 am, Andres Salvador
<AndresSalva...@discussions.microsoft.com> wrote:

> Hello,
>
[quoted text clipped - 20 lines]
>
> Thanks.

Good morning Andres -
It has been a while since I worked with AS, but if I remember
correctly here's some ideas that may be causing you a problem:
1) Analysis services cannot accept anonymous connections. Must be an
authenticated user.
2) If you are allowing anonymous connections to your web site / forms
based authentication, you should use .net impersonation (via the
web.config) when connecting to AS.
3) If your IIS app is on a different physical / virtual machine than
your AS, you may need to install Kerberos to avoid the "double hop"
issue. this has to due with passing credentials from the client
request to the web machine, then the web machine to the AS machine.
If you are using anonymous access on your web machine, and you
use .net impersonation, this probably isn't necessary.

I believe #2 will probably do it for you. please let me know how it
goes, and I will help as much as I can.

John

Reply to this Message

Reeves - 02 Jul 2009 16:10 GMT

Andres,

How do you want your users to connect to SSAS, as it seems right now your
site is connecting via anonymous access?

So the question is will this site be external or internal web site, and/or
will you have users connect under one account or do you want the users to get
their credentials passed through.

The reason it works on your box as compared to multiple boxes is the double
hop issue.

See this for a better understanding:
http://www.adopenstatic.com/cs/blogs/ken/archive/2006/10/19/512.aspx

Reeves

> Hello,
>
[quoted text clipped - 20 lines]
>
> Thanks.

Reply to this Message

Andres Salvador - 02 Jul 2009 18:01 GMT

Thanks for your response Reeves,

The computers are in the same network domain, if I make a trace in the sql
server computer, i can see that the iis computer try to connect with the user
anonymous and deny the access. I configure in the surface of the sql server
analysis services to allow anonymous access but deny access too.

Its possible to allow access to anonymous connections to analysis services?
If I try to configure the virtual directory to basic authentication and try
to connect to the web page introducing the name and password of a valid user
for the analysis services, it seems to try to connect with anonymous user.
Its possible to access with iis with a other user which isn't then anonymous?

Thancks.

> Andres,
>
[quoted text clipped - 37 lines]
> >
> > Thanks.

Reply to this Message

Reeves - 02 Jul 2009 22:54 GMT

Andres,

IIS is going to connect with the App Pool (I think this one) or the account
set for the anonymous account of the website.

Go here to see what how the accounts are set:

App Pool:
1. Open Internet Information Services Manager
2. Click on Server
3. Open Application Pools Folder
4. Right Click on Application Pool used for website and select Properties
5. Select Identity Tab (bet you have Predefined selected with Network Service)

Anonymous:
1. Open Internet Information Services Manager
2. Click on Server
3. Open Web Sites Folder
4. Right Click on website and select Properties
5. Select Directory Security Tab
6. Click Edit Button for Authentication and access control

If you want the user to pass through you need to uncheck the anonymous user
and set integrated security, and with that delegation will need to be set.

Reeves

> Thanks for your response Reeves,
>
[quoted text clipped - 52 lines]
> > >
> > > Thanks.

Reply to this Message