SSRS-PBRS integration preflight checks

To ensure successful metadata ingestion and lineage generation, complete the following preflight checks.

In your SQL Server Reporting Services and Power BI Report Server environments

The lineage harvester (deprecated) uses REST API version 2.0 to ingest SQL Server Reporting Services (SSRS) and Power BI Report Server (PBRS) metadata. You need at least the minimum permissions in SSRS-PBRS to enable the lineage harvester (deprecated) to access the SSRS-PBRS metadata and ingest it in Data Catalog.

Important There are known limitations to the metadata returned by the API when integrating PBRS. For example, Power BI reports in PBRS are ingested as Power BI Report assets in Data Catalog, but there is no technical lineage for the reports.

We recommend that you use SQL Server 2019 Reporting Services or newer. We can't guarantee that older versions will work.

Minimum roles and permissions

The following item-level roles in SSRS provide the required access to content in SSRS-PBRS. With any of the following item-level roles, you can harvest the metadata, ingest the corresponding SSRS assets in Data Catalog and view the lineage between those assets:

• Content Manager
• Publisher
• Report Builder: Only the content contained in your paginated reports.
• My Reports: Only the content in the My Reports folders that you own.

Recommended roles

The Content Manager role is often used with the System Administrator role. The System Administrator role includes tasks that are useful for a Report Server administrator who has overall responsibility for a Report Server, but not necessarily for the content within it. For users who require access to both site-wide operations and items stored on the Report Server, create a second role assignment on the Home folder that includes the Content Manager role. Together, the two role definitions provide a complete set of tasks for users who require full access to all items on a Report Server.

In your CPSH environment

Lineage enablement

• Technical lineage via Edge is enabled in your CPSH environment.

Edge

• You created and installed an Edge site.
  
  Important If you're using a Collibra Cloud site, go the Collibra Cloud site documentation to check if your data source is supported.
• The Edge site status must be Healthy.

Network and proxy configuration

• Edge can connect to all Collibra Data Lineage service instances in your geographic location.
• Optionally, you've connected to a proxy server.
• Optionally, use a custom certificate to allow the Edge capability to connect to your data source. In this case, you've saved the certificate as "ca.pem" in the same directory as the Edge site installer. If you've saved the certificate in another directory, use the --ca argument in the Edge site installation command.

CPSH permissions

You can connect to Collibra Data Lineage by using the basic or OAuth authentication method. The following permissions are required only if you use the basic authentication method. 

• A global role with the following global permissions:
  • Data Stewardship Manager
  • Manage all resources
  • System administration
  • Technical lineage
• A resource role with the following resource permissions on the community level in which you created the domain:
  • Asset > Add
  • Attribute > Add
  • Domain > Add
  • Attachment > Add

To create a new target domain for asset ingestion:

• You have a resource role with the Domain > Add resource permission.

To create an SSRS-PBRS connection:

• You have a global role with the Product Rights > System administration global permission.
• You have a global role that has the Manage Edge sites global permission.
• You have a global role that has the Manage connections and capabilities global permission.
• A resource role with Configure external systemresource permission, for example Owner.
You have added a vault to your Edge site.
If your data source connection requires a file from your vault, the file must be encoded into Base64 and stored as a regular secret in your vault.

To connect to Collibra Data Lineage service instances via OAuth authentication:

• You have a global role with the Product Rights > System administration global permission.
• You have a global role that has the Manage Edge sites global permission.
• You have a global role that has the Manage connections and capabilities global permission.

To add an Edge capability:

• You have a global role with the Product Rights > System administration global permission.
• You have a global role that has the Manage connections and capabilities global permission, for example, Edge integration engineer.

To synchronize technical lineage:

• A global role that has the following global permission:
  • Catalog, for example Catalog Author
  • View Edge connections and capabilities
• A resource role with Configure external system resource permission, for example Owner.
• Data source-specific permissions.