User-based Security for Telerik Reporting

[Eric Flamm]

Does Telerik Reporting for ASP.Net offer a built-in way to control access to reports based on either the user name or user role (using ASP.Net membership)? Is there a best practice for managing data access? I'm not sure that SQL Server security will be of much use, since the connection will typically be made with a service account for ASP.Net, rather than the individual user's account.

[Elian]

Hello Eric,

Telerik Reporting is an embedded engine for visualizing data and the security depends entirely on the application that hosts it. 

Greetings,
Elian
the Telerik team

[Bryan Hughes]

There are several ways you can do that.  It depends if you want to only give access to report by user/role, or if the reports data is different based on User/Role.

If it is limiting access then just put the  page with report viewer in folder and limit access based on role.  If it is data returned then pass in Current Users ID in the report parameters and create functions in SQL that will get users role. Then use IF ELSE and ELSE IF in stored procedure to run query based on role.

You could get more complicated with custom properties and functions in your report class, but I prefer to keep simple as possible.
Bryan

[Rupesh]

I need to display column dynamically based on role.

Can you guide me how can I make through the application only?

[Silviya]

Hi Rupesh,

It is possible to change the report definition at run-time, based on the user role. This could be done for example with a custom report resolver (check How To: Implement a Custom Report Resolver help article).
Hints on how to change report definition dynamically could be found in Changing the connection string dynamically according to runtime data KB article.

To simplify the task, you can make the required customization to the report at design-time. Reports have a powerful expression engine that allows to modify the data and appearance of the report dynamically. 
Flexibility in the layout can be achieved by showing/hiding items/section via conditional formatting and bindings, and filtering data. Flexibility in retrieving data can be achieved by using parameterized data-retrieval methods. The method's arguments can be mapped to report parameters, for example Using Parameters with the SqlDataSource component.

Regards,
Silviya
Progress Telerik