{"action":"created","issue":{"url":"https://api.github.com/repos/Microsoft/ReportingServicesTools/issues/177","repository_url":"https://api.github.com/repos/Microsoft/ReportingServicesTools","labels_url":"https://api.github.com/repos/Microsoft/ReportingServicesTools/issues/177/labels{/name}","comments_url":"https://api.github.com/repos/Microsoft/ReportingServicesTools/issues/177/comments","events_url":"https://api.github.com/repos/Microsoft/ReportingServicesTools/issues/177/events","html_url":"https://github.com/Microsoft/ReportingServicesTools/issues/177","id":332894683,"node_id":"MDU6SXNzdWUzMzI4OTQ2ODM=","number":177,"title":"Get-RsCatalogItemRole fails when -Identity has no policy; cryptic stack trace ","user":{"login":"jzabroski","id":447485,"node_id":"MDQ6VXNlcjQ0NzQ4NQ==","avatar_url":"https://avatars2.githubusercontent.com/u/447485?v=4","gravatar_id":"","url":"https://api.github.com/users/jzabroski","html_url":"https://github.com/jzabroski","followers_url":"https://api.github.com/users/jzabroski/followers","following_url":"https://api.github.com/users/jzabroski/following{/other_user}","gists_url":"https://api.github.com/users/jzabroski/gists{/gist_id}","starred_url":"https://api.github.com/users/jzabroski/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jzabroski/subscriptions","organizations_url":"https://api.github.com/users/jzabroski/orgs","repos_url":"https://api.github.com/users/jzabroski/repos","events_url":"https://api.github.com/users/jzabroski/events{/privacy}","received_events_url":"https://api.github.com/users/jzabroski/received_events","type":"User","site_admin":false},"labels":[{"id":457684646,"node_id":"MDU6TGFiZWw0NTc2ODQ2NDY=","url":"https://api.github.com/repos/Microsoft/ReportingServicesTools/labels/bug","name":"bug","color":"ee0701","default":true}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":4,"created_at":"2018-06-15T19:49:04Z","updated_at":"2018-08-31T15:33:45Z","closed_at":null,"author_association":"CONTRIBUTOR","body":"# Error message\r\nGet-RsCatalogItemRole : Cannot bind argument to parameter 'Policy' because it  is null. \r\n\r\n\r\n# Analysis\r\nThe problem appears to be here:\r\n\r\nhttps://github.com/Microsoft/ReportingServicesTools/blob/a7836d807f6f4ee169d7d45787cd92be587b1cbf/ReportingServicesTools/Functions/Security/Get-RsCatalogItemRole.ps1#L97-L102\r\n\r\n# Suggested Improvement\r\nI suggest the following logic, which will allow the default policy (root folder) when the Credential is an administrator:\r\n\r\n```\r\n        # Filter Polices by Identity\r\n        if($Identity) {\r\n            $parentPolicyTmp = $parentPolicy | Where-Object { $_.GroupUserName -eq $Identity }\r\n            if ($parentPolicyTmp -ne $null)\r\n            {\r\n                $parentPolicy = $parentPolicyTmp\r\n            }\r\n        }\r\n\r\n        $parentType = $Proxy.GetItemType($Path)\r\n```\r\n"},"comment":{"url":"https://api.github.com/repos/Microsoft/ReportingServicesTools/issues/comments/417701870","html_url":"https://github.com/Microsoft/ReportingServicesTools/issues/177#issuecomment-417701870","issue_url":"https://api.github.com/repos/Microsoft/ReportingServicesTools/issues/177","id":417701870,"node_id":"MDEyOklzc3VlQ29tbWVudDQxNzcwMTg3MA==","user":{"login":"jzabroski","id":447485,"node_id":"MDQ6VXNlcjQ0NzQ4NQ==","avatar_url":"https://avatars2.githubusercontent.com/u/447485?v=4","gravatar_id":"","url":"https://api.github.com/users/jzabroski","html_url":"https://github.com/jzabroski","followers_url":"https://api.github.com/users/jzabroski/followers","following_url":"https://api.github.com/users/jzabroski/following{/other_user}","gists_url":"https://api.github.com/users/jzabroski/gists{/gist_id}","starred_url":"https://api.github.com/users/jzabroski/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jzabroski/subscriptions","organizations_url":"https://api.github.com/users/jzabroski/orgs","repos_url":"https://api.github.com/users/jzabroski/repos","events_url":"https://api.github.com/users/jzabroski/events{/privacy}","received_events_url":"https://api.github.com/users/jzabroski/received_events","type":"User","site_admin":false},"created_at":"2018-08-31T15:33:45Z","updated_at":"2018-08-31T15:33:45Z","author_association":"CONTRIBUTOR","body":"I agree, @jtarquino  and his team did a fantastic job building this tool. The clever use of PowerShell to add SOAP types dynamically, to abstract away which version of the API we talk to, is simply ingenius.  I've participated in a lot of bad PowerShell projects, since PowerShell is so easy to write bad code in, but I've gotten a lot of value out of this project.\r\n\r\nI think what I will try to do is first reproduce the issue.\r\n\r\nAlso, I agree, the real reason this is even a problem is that the default way SSRS does permissions is rather bad.  For example, how I lay out my projects is each project is a top-level folder in the final deployment. But then, how do you avoid having different departments see each other's reports?  Well, with the default model, out of the box, you only get the following roles:\r\n\r\n\r\n| Role | Description |\r\n| ----- | ------------ |\r\n| Browser | May view folders, reports and subscribe to reports. |\r\n| Content Manager | May manage content in the Report Server. This includes folders, reports and resources. |\r\n| My Reports | May publish reports and linked reports; manage folders, reports and resources in a users My Reports folder. |\r\n| Publisher | May publish reports and linked reports to the Report Server. |\r\n| Report Builder | May view report definitions. |\r\n\r\nSo, the first thing I do in a new SSRS deployment is add a new role:\r\n| Role | Description |\r\n| Folder Browser | May view folders, but cannot view folder contents. Useful if users have Browser role in multiple folders, so that at the top-level they can see all of the folders then can Browse to. |\r\n\r\nUNFORTUNATELY, SSRS API does not provide a way to add new Roles.  You have to use SQL to do this:\r\n\r\n```sql\r\nUSE SqlReport_dev\r\n\r\nSET NOCOUNT ON\r\n\r\nCREATE TABLE #Roles (\r\n\tRoleName NVARCHAR(260) NOT NULL,\r\n\t[Description] NVARCHAR(512) NULL,\r\n\tTaskMask NVARCHAR(32) NOT NULL\r\n)\r\n\t\r\n\r\nINSERT INTO #Roles\r\nEXEC dbo.GetRoles @RoleFlags = 0 -- tinyint\r\n\r\nIF NOT EXISTS (\r\n\tSELECT NULL FROM #Roles WHERE RoleName = 'Folder Browser'\r\n)\r\nBEGIN\r\n\tEXEC dbo.CreateRole\r\n\t\t@RoleID='290C8111-820E-4A37-9ABF-CB3B09153C52',\r\n\t\t@RoleName=N'Folder Browser',\r\n\t\t@Description=N'Allow ability to browse folders',\r\n\t\t@TaskMask=N'0000001000000000',\r\n\t\t@RoleFlags=0\r\nEND\r\n\r\nDROP TABLE #Roles\r\n```\r\n\r\nNote: I purposefully hard-code the RoleID GUID so that it is consistent across environments, so that the likelihood of an issue occurring in production due to variances in RoleIDs is unlikely."}}
{"actor":{"display_login":"jzabroski"}}