AMO: No mapping between account names and security IDs was done for local users

Hi,

Analysis Services 2005 and SQL Server 2005

Using AMO I'm trying to add a local user to an Analysis Services database Role that I created but I keep getting the error "No mapping between account names and security IDs was done". I can add the user to the Role with no problem using SQL Server Management studio, but if I try to add the user using AMO I get that error.

The local user that I'm trying to add belongs to both the local User and Administrator groups. I've added a logon for this local user to the corresponding SQL Server database that the Analysis Services database datasource points to, but still no luck.

Am I missing something? I've been doing this for the last three months with network users without a problem so this is completely frustrating me. Especially the fact that I can add them using the SQL Server Management Studio GUI.

Here's the basic code that I'm doing. Pretty straightforward.

private bool AddUserToAnalysisServicesRole(Role role)

{

string user = @."pdxvincentm02\testuser";

RoleMember rm = new RoleMember(user);

role.Members.Add(new RoleMember(user)); // e.g. redmond\johndoe

role.Update(); // << KABOOM!!! No mapping between ......

Help. Thanks

I have not had a chance to try this in C# yet, but I did a quick test in powershell using the following pattern and it worked.

role.Members.add("pdxvincentm02\testuser")

role.Update()

It's possible that the role.Members.Add() function has another overload that works a bit differently. But another though also occurred to me. Where is this code being executed from? Is it possibly running under an account that does not have permission to verify the account? (eg. is it running from an ASP.NET app running as local system?)

AMO Security Scripting Problem

Hi!

I have a little program that creates roles for a catalog and cubes. The roles is created fine and all the read permissions on the different cubes as well. Also adding different users to the roles is no problem.

Then when i look in BIDS( open analysis services database) everything looks exactly as it should. However, the different roles does not work for the users that are added through the script. But, if i manually add a user to one of the created roles, it works for that user. Anybody who knows what is going on?

The roles both have users and user groups in them.

You say "However, the different roles does not work for the users that are added through the script."

What script you are talking about? How do you generate the script? What doesnt work exactly?

Edward.
--
This posting is provided "AS IS" with no warranties, and confers no rights.

|||If you 'script' a role, the script just contains the names of the role members, NOT the permissions. Those permissions are stored in the cubes and dimensions themselves. So be carefull by changing permissions with scripts. It was not clear from your description if you just wanted o add users, or you created new roles as well. In the latter case, this can be an explanation, in the former case, you must have bumped onto another problem as well.|||

Hi!

This is basically what i do.

Role role = _oDb.Roles.Add(_sRoleID);

role.Members.Add(new RoleMember("domain\user");

role.Update();

Cube cube = _oDb.Cubes.FindByName(sCube);

if (cube != null)
{
CubePermission cubeperm = cube.CubePermissions.Add(_sRoleID);
cubeperm.Read = ReadAccess.Allowed;
cubeperm.ReadSourceData = ReadSourceDataAccess.Allowed;
cubeperm.Update();
}

So it′s not any advanced type of security, just read or not read a cube. If i then look at this role, by opening it with BIDS(opening the cube online, not a project), it looks fine. All the users are there and the read permissions and so on. But the users can′t access the cubes. If i then delete a user from a created role, and then add it again by hand, they can access the cube. So the role works, but it is like it does not like the programmatically added user names, even though they are exactly the same as when i add it by hand. And i don′t think it is all that different from this bol entry

http://msdn2.microsoft.com/en-us/library/ms345081.aspx

However, i just saw something in that entry that i missed. And it was the DatabasePermission which i don′t do anything with. It might be that, i will check. But that has Role as input so the deleting and adding a user by hand on a role should not affect that or BIDS does that under the covers or something?

|||

Full of shame and have a appointment whith the eye doctor.

It was the databasepermission that was missing. Thanks!

Am I being role happy?

I'm working on the security portion of this vb app. In the application the
user is presented with a list of commands that can be executed on a piece of
data.

My client wants to be able to block certain users from seeing certain
commands on their screen.

The commands are loaded into a listview from a table.

I've created a role for each combination of command/province(A user may be
able to execute a command on an Ontario piece of data but not a Quebec
piece).

I just modified the query that loads the list box so that it includes an
IS_Member with the command/province combination.

The roles were easy to create(sql query to create the sp_addrole commands).
And the query modifications were easy as well. Is_Member barely affects
query times(very fast).

I've also created roles that contain these roles so a user only has to be
added to one role to get access to large groups of commands.

I may have one problem though. I've created hundreds of roles on the
server. Is that a problem? Can anyone tell me if there's a better way of
doing this?

Thanks in advance.
J
P.S. The application has just under 500 users and is going to hit 1000 in a
couple of years.Me (me@.here.com) writes:
> I've created a role for each combination of command/province(A user may be
> able to execute a command on an Ontario piece of data but not a Quebec
> piece).
> I just modified the query that loads the list box so that it includes an
> IS_Member with the command/province combination.
> The roles were easy to create(sql query to create the sp_addrole
> commands).
> And the query modifications were easy as well. Is_Member barely affects
> query times(very fast).
> I've also created roles that contain these roles so a user only has to be
> added to one role to get access to large groups of commands.
> I may have one problem though. I've created hundreds of roles on the
> server. Is that a problem? Can anyone tell me if there's a better way of
> doing this?

The one thing that I don't really like this design is that you use
SQL Server's own mechanisms to control data access within the
application. I would prefer to have my own authorization tables.
This design can confuse a DBA who thinks roles are for control access
to tables and T-SQL commands.

Then again, if it ain't broke...

--
Erland Sommarskog, SQL Server MVP, sommar@.algonet.se

Books Online for SQL Server SP3 at
http://www.microsoft.com/sql/techin.../2000/books.asp