topic Re: Kerberos on Report Server in Report Server

Kerberos on Report Server

DaveW — Thu, 28 Jun 2018 21:51:43 GMT

I have 2 servers, 1st with SQL as the data source and a 2nd server with PBI Report Server

I've got it working for the data source to work with "as the user viewing the report" from the outside the server

However when I'm logged onto Server2 and try to access the PBI reports through the server browser, I get the error:

We couldn't connect to the Analysis Services server. The server forcibly closed the connection. To connect as the user viewing the report, your organization must have configured Kerberos contrained delegation.

My configuration

Domain: NH\ DNS: Server2 > http://Vector

SQL Server: Server1 service account: nh\Server1.service

SPN: MSSQLSvc/ Server1.nh.local:1433

SPN: MSSQLSvc/ Server1:1433

SPN: MSOLAPDisco.3/ Server1.nh.local

SPN: MSOLAPDisco.3/ Server1

PBI Report Server: Server2 service account: nh\Server2.services

SPN: http/vector/reports

SPN: http/vector

SPN: http/ Server2.nh.local

Just wondering if I'm missing an SPN for Server2. Delegation is set, but maybe not in the right directions

Re: Kerberos on Report Server

Anonymous — Fri, 29 Jun 2018 08:50:38 GMT

I assume you've watched all the vids and read all the blogs.

I know we have to register the SPNs with both NetBIOS names and also Fully Qualified DOmain names as the traffic seems to pick these at random. So you may need 2 sets on your SSRS server one as machinename eg (XXX-SSSRS-V100) one as FQDname xxx-ssrs-v100.mycmpany.com or if you are using an internal DNS entry you would use that instead of the FQDname

Re: Kerberos on Report Server

DaveW — Tue, 03 Jul 2018 06:16:37 GMT

Thanks for that, yes I've watched all the videos, very helpful as this is quite complex.

I think that is the key, to have 2 sets on the Report Server. I'll work on it in the next couple of days