In our environment we use an ASP.NET web portal for the provision of reports which are all created in Reporting Services 2005. The security with respect to whom the records may opened and who should select the parameters provided in this portal using the NTUserName of users (Active Directory). The portal compares these NTUsername with an Employee table that is more information about the user, for example, function and cost center.
Who should select what?
To determine who is allowed to select (parameters) will again consider the NTUserName of the user. Using stored procedures will now report on the parameterbox portal filled with values.
This seems to work fine until you drill through reports to work. Suppose I have a report (A) make a link to a click-through report (B). A sends to B along a number of parameters to only show the data that is relevant.
Once I export to Excel A to B hyperlinks remain intact. I can click on the link from Excel and come clean on a report from B. The problem now is that all parameters are shown in the url. The user can now change the url a bit of skill and information to see that his eyes were not intended.
For this problem are several possible solution:
1) In the query of your report you do something related to security with a security table
2) On the database (not recommended)
3) encryption to send in the link
In our case we opted for solution 3. I'll spare the details why we have chosen.
Explanation using a simple example
A report has one parameter: Current Year
Report B has a parameter Parameters and Current Year SecurityPmt / SecurityPmt2
Purpose: Suppose the user adjusts the year in the URL then the report does not show dates.
The hyperlink of A-> B configure it through parameter mapping:
Current Year Left Side, Right: = Parameters! GeselecteerdeJaar.Value
SecurityPmt Left Side, Right: = Parameters! GeselecteerdeJaar.Value * 2
We therefore say that the SecurityPmt in Report B * 2 is the selected years. Suppose we choose 2008 as the year 4016 he will send along as a security parameter.
Then we need a control to Report B.
We propose a default value for SecurityPmt2
= IIF (Parameters! SecurityPmt.Value / 2 = Parameters! GeselecteerdeJaar.Value, 1.0).
We say here: Part 2, the security parameter. The result should be equal to the chosen year. If this is true then I get a value, otherwise I am value 0.
Finally, we put a security on the data by region to adjust the visibility:
= IIF (Parameters! SecurityPmt2.Value = 1, False, True)
If the value v / d is a parameter must NOT be INVISIBLE. If it is 0.
This is a good method to apply additional security when sending parameters. The example I give in * 2 is of course not enough. Find a beautiful formula for not to guess and send it along.
Tags 
