Embedded Images in SSRS Reports not Displaying - Permissions Issue

Question

I have a logo at the top of all my reports that I have as an embedded image.

These reports are displayed in an ASP.Net web app via the SSRS web service interface - all pretty standard stuff but the image doesn't render - I just get a broken link.

There are a number of possible solutions for this problem and I've tried a few things including setting UseSessionCookies to false in the ConfigurationInfo table.

What I've noticed is that the image displays fine when I change the anonymous account of the consuming web app from a least privileged service account to my own user account.

I do not understand why this and can't work out what special permissions are needed by my web app's service account to be able to view embedded images in reports.

Can anyone help?

Answer 1

Ok, problem solved. Kind of. The problem isn't limited to embedded images and occurs because I am not using the reporting services viewer.

To summarise:

1) when your web application is making the call to the report server it is fully authorized to do so. A SessionID is generated that is ONLY available to the web application account (i.e. the Service account under which the app runs).

2) the web app outputs the RAW HTML4.0 to the screen.

3) the browser receives the HTML and tries to retrieve the images referenced in the HTML.

4) the browser is running as your user account (e.g. domain\username1)

5) the report server receives a request that looks like:

6) now the SessionID listed in the URL is not associated with domain\username1, so report server claims it does not exist.

When you set the app domain to use the domain\username1 account, then the SessionID happens to be associated with your the account so suddently things 'work'. But the moment real users try the system they complain that the images are missing, since their domain\usernameN does not match the app pool account.

The solutions to this problem are as follows:

1) use the Report Viewer control. This will ensure that the URLs received by the Browser will point back to your web app and your web app identity will be used to retrieve them from the report server.

2) in your web app code, parse the HTML4.0 that you get back from the Render call, fetch and cache all the images, re-write the HTML4.0 links to point to the cached images stored by your web app and then send it to the browser (if this seems complicated... then use the Report Viewer control since it make the scenario work)

3) you can try to use the MHTML output format, this will produce a fully qualified report with images embedded in the since binary stream. The consequence of this is it is harder to embed it within an application page... but not insurmountable

I chose to use a variation on 2) because I don't want to use the report viewer. The logo I'm trying to display is already hosted in the calling web app so I just replace the src attribute of the img tag in the response returned from the SSRS report execution service with the url to this location.

I really don't want to use the report viewer as suggested as the best solution to this issue. Why SSRS has to use session information to return something as simple as a logo that is displayed on all reports is beyond me.... It has taken ages to get to the bottom of this and the solution isn't especially pretty....