1. Querying Active Directory From SSRS
To Customize The User Experience And Secure Reports

2. Introduction Wes Springob (No relation to Mr. Squarepants)
BI Consultant at New York Life
Originally from Pittsburgh, now New Port Richey
Wife Ashley, Portrait Photographer
Wes Springob, (No Relation To Mr. Squarepants) BI
Originally from Pittsburgh, now New Port Richey
Wife Ashley, Portrait Photographer
Background
Do you know why speakers poll their audiences at the beginning of a presentation?
Stated purpose is to tailor the discussion to the audience level.
Truth is to determine exactly how much we can BS our way through it.
So who knows what? LDAP, SSRS, T-SQL, Linked Servers?

3. Disclosure: Extensive use of SSRS Proficient T-SQL Developer
LDAP novice
0 AD administration experience
Recently exploring reporting of data sources that aren’t SQL Server
Have been wanting to work with AD Data in SSRS for years, but only recently have had the opportunity.
The names have been changed to protect the innocent = No live demo of Active Directory

4. Use Case
Why would you need to secure a report with AD? Doesn’t the Report Server do that for you?
Short answer, yes it does:
SSRS determines if you can run, subscribe to or edit a report.
It does a great job and we don’t want to alter or circumvent that security in any way.

5. We can do more
Find out additional information about a user for use within the report
Securely extend additional data based on the user ID of the logged in user’s security group memberships.
User Story

6. System of record
Many database systems store a user’s Active Directory ID. But they also store a lot more, unfortunately, to “support” the application. Where in most cases, we should be going back to query AD to ensure we are using the most current values.

7. Tools A SQL Server with SSRS installed Management Studio
Visual Studio, BIDS or Report Builder to create RDL’s
Active Directory Explorer
Aids in writing LDAP queries
Free tool, downloadable from Technet
Any domain account typically has sufficient, Read Only, rights to query AD

8. Approaches Linked Servers / T-SQL
CLR / System.DirectoryServices Namespace
Custom Code in the RDL / System.DirectoryServices Namespace
Query AD Directly as a Data source From within the RDL / T-SQL
Linked Server
Most flexible, easiest solution for T-SQL developer
Easily configured & maintained
Through procs, functions & views you can quickly create a relational representation of you AD hierarchy
CLR
Difficult to set up, code and maintain
Extends the greatest flexibility
Must be registered on the SQL Server, strongly named…
.Net code, feels more like filtering
Custom Code in RDL
Requires SSRS Server configuration to allow the System.DirectoryServices Namespace to be accessed, and a reference to be created within the RDL
Similar to CLR in complexity and utility
Query AD Directly as a Data Source from within an RDL
Easily configured data source.
No support from the development environment’s SQL parser. (if you write perfectly, it works. If not, good luck debugging in VS/BIDS/Report Builder)
Better off editing with a linked server in MS and copying the query to your RDL
The method I believe has the most utility to be used in the most environments, is to query directly from the RDL and will server as our example in a couple min.

9. What is LDAP? Lightweight Directory Access Protocol
“is an open, vendor-neutral, industry standard application protocol for accessing and maintaining distributed directory information services over an Internet Protocol (IP) network.” -- Wikipedia
Used to query or filter Active Directory from T-SQL or .Net code.
Neither AD or LDAP are RDBMS
AD is Optimized for fast reads
AD is Optimized for fast reads, because it is queried at run time and only returns a limited number of results, typically.

10. Active Directory Explorer
Definitions:
dn = Distinguished Name
dc = domain component
ou = organizational unit
cn = common name
sn = surname (last name)
givenName = (First Name)

11. Linked Servers
From Management Studio, you will need to use the OLE DB Provider for Microsoft Directory Services
Use the ADsDSOObject Provider string
Ad the Data source, which is your AD server

12. OpenQuery
From Management Studio, write a test query of Active Directory using OPENQUERY and the information we gathered in AD Explorer
Error messages aren’t great, but far better than VS parser.
All quotes are single quotes
We could stop right here
Create a series of Stored procedures, views and functions to create a relational set of data representing our Active Directory entries and use it in any system that can access this SQL server
OR, your company might not like you to use linked servers
In which case you will probably only be able to use linked servers for development purposes.

13. Creating the report

14. Creating the AD data source
Using an existing report project, add a new shared datasource to your AD server
Give it a meaningful name because it likely won’t be the only data source for your report
Use the OLE DB option for your connection type
The connection string is just that simple, provider = ADsDSOObject and Data Source = your AD server name

15. Creating the dataset
Using the Data Source you just created, create an embedded dataset using the text query type.
You will need to use the expression builder because the Parser does not interpret LDAP queries
This means query designer is disabled
You won’t be able to use parameters
You will need to fill in your fields manually
You need to be accurate in your typing, including case.

16. Creating the Query Expression
Translate your OPENQUERY to the Query Expression dialog
Don’t confuse single & double quotes
Work in the Built-in Field “UserID”, stripping out your domain from the string

17. Preview
Use the results of the embedded dataset within the body of the report to complete your “Hello, Wes!” example.
Often, for development purposes, you will need to create a Parameter to simulate the value from the Built in Value from User!UserID (to simulate other users)

18. Solving the Use Case

19. Queries?

20. Additional LDAP Queries

21. Resources: Active Directory Explorer Download:
This Slide Deck: