Sounds easy, right? That's what I thought until I whipped up a query for a new report.
If you are using the SMS Client Health Monitoring Tool, you know that the default configuration is that the data is stored in a separate SQL database named SMS_Healthmon. Microsoft provides a nifty Excel spreadsheet that queries the data to give you a view of what is going on. As great as that is, it would be infinitely more useful if the data was integrated into web reporting.
Just building the query isn't enough for this task because of the way web reporting accesses SQL. If you look at your SMS database, there is an application role named Webreport_approle. As this article reveals, an application role does not use the user's permissions to access the database. Those permissions are ignored and the data is accessed in the context of the application role. An application role is limited to the database it exists in, so how do we get around it?
Go to the database that will be queried in the web report and add a new user named 'guest' (you can start cringing now). It isn't tied to a Windows or SQL user account, so just enter guest as a user name with no login name. Of course, the user needs to be limited to read access to the tables it will be querying, so choose the permissions wisely. This obviously would be a bad idea for sensitive data.
Other creative solutions might include a scheduled DTS of data to a table in the SMS database, if policy allows it. Personally, for things like client health data, guest access is OK. Employee data would be a very different story.
If anyone knows any other way to access the data in another database, I would be happy to hear it! Leave a comment if you have a better solution.