We are doing a POC to to use ALWAYS ON Encryption in our org. One critical part we are checking is whether existing RDLs would work fine with minimal changes in Always On encrypted Tables.
This is what I tried and confirmed so far:
Everything is done on my local laptop using my domain based login.
Created a sample table that has a couple of nvarchar column.
Inserted records into this new table.
Encrypted one of the column from SSMS using Deterministic encryption. After creating encryption, I could see that keys are available in my laptop's 'Local Computer Certificates--> Personal)
Created RDL to show all columns in this table, used following setting in Datasource connection-column encryption setting=enabled.
Generated the report from my local VS dev env. Everything works fine here. Columns which are encrypted in the back end DB are shown in plain text.
****************************************************************
Now I upload this working RDL to my local reporting services from ReportManager.
The data-source is embedded and it has all connection settings I used while developing the RDL.
When I generate the report now, columns are rendered blank in the report.
****************************************************************
Tried multiple things but nothing seemed to be working for me to fix this..
I then changed the service account used for running SSRS services on my laptop. It was NTService earlier. I changed it to my domain based log in account.
Generated the report after the service account is changed for SSRS services, it all works fine now. Columns encrypted in the DB are shown in plain text now.
*****************************************************************
Question:
Does SSRS require the service account running the reportingservices to be the same user who is creating Encryption Keys and Certificates from SSMS.
If the user who is creating the key from SSMS (usually it is a DBA) different from ssrs service user, can't it decrypt columns?