Report Server Admin Security issue

[Anonymous]

I have posted this in the Ideas section as well incase it is a bug, but i want to ask it here as well. If that is no allowed, ill remove this one.

I am running an instance of Power Bi Report server on a server here with the following versions.

• Report server - Version 1.4.7024.16477 (January 2019) 
• Sql Server 2017

I have found a scenario where if i remove a user's System Adminstrator access, they are still able to access the "Site Settings" section oif the portal, and from there, can see all the sections, General, Branding Schedules and Security sections. Most of the pages take steps to secure itself against this, for example even though the user can see Branding, it protects itself against the users by hiding all the buttons.

For the Security section how ever, these users are able to access the page, and interact with it as if they had the System Adminstrator role.

I have checked the Reporting Database for the dbo.UserRolePolicies table and it reflects what is shown through the UI, so the non-admin users in the Portal also do not show as an Admin in the database.

Is there some system config issues i am missing or is the a bug with security in the portal itself?

[d_gosbell]

Was the user already logged in when you removed them from the admin group? A lot of the pages in the PBIRS portal are cached. If I had the portal open as a test admin user, then removed that user from the admin role I could still see site settings, but as soon as I refreshed my browser page this option dissappeared (with the May 2019 release). I could get to the General and Branding pages by typing in the URL, but could not make any changes. My hope is that any attempt to save changes should be blocked on the server.

As soon as I attempt to directly access the security page with a non-admin using the May 2019 release I get the dialog on the right 

[sheetalshettiga]

hello all,

Even though i do not assign any role to particular user of same domain in security they can login and view my reports in report server .How can I deal with such situation in security role.please help me with this.

[Anonymous]

Thanks for the reply. I tried your scenario in the version im running i am able to use the url to navigate to branding and general admin pages. It looks like this was resolved in the may release