Assigning Built-In Roles

First, to use any method of authorization, you need to create some principals. As an example, you will use some Windows Groups: AdventureWorksSalesManagers and AdventureWorksSalesPeople. Go ahead and create these Windows groups on your Report Server, and place some users in them. The examples assume that the Adventure Works sample reports have been published to the Report Server and that there are two folders. There might be three folders if you have published the sample report model.

You can assign roles to an object either through the Report Manager website or through SQL Server Management Studio. The following sections cover steps to assign roles through the Report Manager.

Assigning Roles Through Report Manager

Role assignments can be done through either Report Manager or SQL Server Management Studio. Complete the following steps to assign roles through management studio:

1.	Navigate to the Adventure Works Sample Reports folder.
2.	Click the Properties tab. Then select Security from the left menu. The screen should resemble Figure 18.1. Figure 18.1. Item security on the Properties tab.
3.	Click the Edit Item Security button. A dialog box opens that looks similar to Figure 18.2. Click OK in this dialog box. Figure 18.2. Confirmation dialog box to break security inheritance.
4.	Click the New Role Assignment button, as shown in Figure 18.3. Figure 18.3. New Role Assignment button.
5.	Enter AdventureWorksSalesManagers in the Group or User Name text box, and select the Content Manager role, as shown in Figure 18.4. Figure 18.4. Granting AdventureWorksSalesManagers Content Manager roles.
6.	Click OK.

To revert back to the parent security, click the Revert to Parent Security button, as shown in Figure 18.5.

Figure 18.5. Revert to Parent Security button.

To modify an item's security, select a user or group by clicking the Edit check box next to the assigned principal under Security (on the left). This returns you to the role assignment screen, where roles can be added or removed.

To delete a role assignment, select the check boxes next to the principals to delete, and select the Delete button. Figure 18.6 illustrates how this can be done. A confirmation box appears asking users to confirm deletion of the item(s). Click OK.

Figure 18.6. How to delete a role assignment.

To give Adventure Works' sales managers some visibility into the inner workings of the Report Server, let's outline the steps required to give the group the System Users role.

1.	Click Site Settings.
2.	Under Security, select Configure Site-wide Security. Figure 18.7 shows the resulting screen. Figure 18.7. System Role Assignments screen.
3.	From here, it is very similar to setting item-level security. Select the New Role Assignment button.
4.	Enter AdventureWorksSalesManagers in the Group or User Name text box, and select the System User role, as shown in Figure 18.8. Figure 18.8. Adventure Works Sales Managers as System Users.
5.	Click OK.

Assigning Roles Through SQL Server Management Studio

Everything we have just done could just as easily have been done through SQL Server Management Studio. Complete the following steps to add item-level security through SQL Server Management Studio:

1.	Open SQL Server Management Studio.
2.	Click File and then Connect Object Explorer.
3.	Change the server type to Reporting Services.
4.	Click the Connect button.
5.	In Object Explorer, right-click on the Adventure Works Sample Reports folder under Home, and select Properties.
6.	Select the Permissions page.
7.	Click the Add Group or User button.
8.	Enter the name of the group in the text field, and click OK.
9.	Select the Content Manager role for the AdventureWorksSalesManagers group. The screen should look similar to Figure 18.9. Figure 18.9. Assigning permissions through SQL Server Management Studio.
10.	Click OK.

System-level roles can also be assigned with SQL Server Management Studio. The following steps grant the System User role to the AdventureWorksSalesManagers group:

1.	Open SQL Server Management Studio.
2.	Click File and then Connect Object Explorer.
3.	Change the server type to Reporting Services.
4.	Click the Connect button.
5.	In Object Explorer, right-click on the server name and select Properties.
6.	Select the Permissions page.
7.	Click the Add Group or User button.
8.	Enter the name of the group in the text field, and click OK.
9.	Select the System User role for the AdventureWorksSalesManagers group.
10.	Click OK.

To modify a role assignment, follow the steps to get to the appropriate property window. From the property window, select Permissions and update the lists of tasks . To delete a role assignment, select the role from the property window, and click the Remove button.