Applies to
ApexSQL Doc
Summary
This article provides information about minimum user permissions required for installing ApexSQL Doc and documenting SQL servers, SSIS packages, SSAS cubes, SSRS reports, Tableau server sites and SharePoint farms.
Description
Installation
In order to Install ApexSQL Doc, a Windows user account with administrator privileges is required
Requirements for creating SQL Server database documentation
Permissions required to generate a database documentation depend on the database objects within particular database and its granted permissions. Minimum user permissions require granted full access to the dbo user, matched with its default database role (dbo_owner) and schema (dbo), in order to document all objects within the particular database.
Required database level permissions:
- Connect
- Control
- View definition
Connecting to a SQL Server
In order to document SQL Server databases a connection to SQL Server needs to be established.
There are two ways to connect to SQL Server using ApexSQL Doc. The first method is using SQL Server authentication, where the server name needs to be specified along with a valid username and password with permission granted by the system owner, through guest IP address inclusion on the SQL Server. For documenting a database that is located on a remote server, additionally remote access needs to be configured. For more information how to configure remote access, please read this article
The second method of connecting to a SQL Server is using Windows authentication. For more information on how to connect to SQL Servers in another domain using Windows Authentication, refer to this article
Requirements for creating Integration services documentation
To document SSIS packages the corresponding version of Integrations Services must be installed locally. When documenting SSIS packages from SQL Server and especially from SSIS package store (SQL Server 2005 and higher), ApexSQL Doc needs to be run with Windows administrator privileges. Without those privileges, documenting SSIS packages is not possible and ApexSQL Doc displays information about Administrator privileges requirement:
If particular SSIS package files are encrypted, users must provide a SSIS package password to document these packages. The SSIS package password must be entered for each encrypted SSIS package in the main grid of ApexSQL Doc when the desired SSIS packages are selected for documentation:
If the credentials are not valid or entered, that particular SSIS package will not be included in generated documentation and the following message will be displayed, informing user that valid credentials must be entered:
Requirements for creating SSAS documentation
To document SQL Server Analysis Services databases either Tabular or Multidimensional, ApexSQL Doc must be installed on the same server as Analysis Services:
There are no special user permissions required to generate SSAS documentation in ApexSQL Doc, other than Windows administrator privileges.
Requirements for creating SSRS documentation
To generate SSRS documentation from Reporting Services Windows administrator privileges are required. However, for Native and SharePoint web servers, valid web service URL and report folder URL are required. If not, ApexSQL Doc will notify the user in order to enter them:
Requirements for creating Tableau server documentation
To document Tableau server sites from Tableau Online and Tableau Server, server administrator privileges are required. If not, ApexSQL Doc will notify the user in order to enter them:
Requirements for creating SharePoint farm documentation
To document from a SharePoint farm, ApexSQL Doc must be installed on the same server as the SharePoint farm. No additional user permissions are required.
Troubleshooting
Error messages (via GUI and CLI) related to insufficient permissions?
The following error message appears when trying to document databases from remote SQL Server without any permissions granted:
Cannot connect to <RemoteServerName>.
A network-related or instance-specific error occurred while establishing a connection to SQL Server. The server was not found or was not accessible. Verify that the instance name is correct and that SQL Server is configured to allow remote connections. (provider: Named Pipes Provider, error: 40 – Could not open a connection to SQL Server).
When trying to document databases from remote server via ApexSQL Doc CLI, the following return code is displayed:
ApexSQL Doc 2016, Copyright (C) 1999-2016 ApexSQL LLC
Failed connecting to <RemoteServerName>.
Trying to document SSIS packages from local SQL server or SSIS Package store without Windows Administrator privileges, will trigger the following message:
Access is denied. By default, only administrators have access to the Integration services service.
The following message is displayed when trying to document SSIS packages via ApexSQL Doc CLI, without Administrator privileges:
ApexSQL Doc 2016, Copyright (C) 1999-2016 ApexSQL LLC
Access is denied. By default, only administrators have access to the Integration services service.
Troubleshooting insufficient permissions
dbo permissions are minimum user requirements for documenting a database from a remote SQL Server. Without those, an instance of the remote SQL Server could still be visible in ApexSQL Doc, but only permissioned database objects will be included in the generated documentation. Before any attempt at documenting the database from remote SQL Server, with limited access, the user will be notified with following message:
Some objects might not be documented correctly or completely, because of the limited access rights to specific databases.
The minimum user permissions required for documenting SSRS in Native mode are My Reports and Content Manager user roles within Folder Security settings. If one or both of these user roles are not applied, the user will be warned about restricted access to the specific server and will not be able to create SSRS documentation in ApexSQL Doc:
Access to the <ReportingServiceItem> is restricted in Native mode of Reporting services service. Please provide valid credentials in order to document <ReportingServiceItem>.
