Integrate SSO/SAML or OIDC authentication in PowerBI on premise (ReportServer)?

[Anonymous]

Dear Community,

we are currently using an on-premises ReportServer, with PowerBI, and are exploring options to authenticate our users through a Single Sign-On (SSO) IdentityProvider. In our case, we are utilizing Okta, and we would like to use either SAML or OAuth (OIDC) as the authentication type.

We are seeking advice on how to achieve this. Would we need to create our own SecurityExtension, similar to the Custom Security Sample provided on this link: https://github.com/Microsoft/Reporting-Services/tree/master/CustomSecuritySample?

Is there anyone who has implemented this using OIDC or SAML? Are there alternative methods we could consider? Any guidance would be greatly appreciated.

Thank you!

[rohit1991]

Hi @Anonymous ,
Integrating SSO (SAML/OIDC) with Power BI Report Server (On-Premises)

Power BI Report Server does not natively support SAML or OIDC authentication, but you can integrate SSO using Custom Security Extensions.

Approach 1: Custom Security Extension (Recommended)

• Power BI Report Server supports Forms Authentication via Custom Security Extensions.
• Microsoft provides a Custom Security Sample:
  GitHub: Reporting Services Custom Security
• Modify this extension to authenticate with Okta via SAML or OIDC.

Steps:

1. Download & Modify Custom Security Sample

   • Implement authentication logic for SAML or OIDC (OAuth 2.0) with Okta.
   • Use Okta SDK or API to verify tokens.

2. Deploy the Security Extension

   • Register it in RSReportServer.config and RSSrvPolicy.config.

3. Enable Form Authentication

   • Modify authentication settings in the configuration files.

Approach 2: Reverse Proxy with SSO

If modifying the Report Server is not an option, use a reverse proxy with SSO support, such as:

• Azure AD App Proxy (if using Azure AD)
• NGINX or Apache configured with OIDC authentication
• Okta Access Gateway

These proxies authenticate users before they access Report Server.

Alternative: Windows Integrated Authentication

If your Okta setup supports Active Directory Federation (ADFS), you can:

• Sync users with AD
• Use Kerberos / NTLM for seamless login

However, this requires Hybrid AD or AD Connect.

[David_U]

 Has another found a solution to this? I'm looking for the same solution.

[ballebone]

I have a huge need for an OIDC Auth Module for SSRS/PowerBi Reports Custom Module. The Sample is not super accessible for a person of my experience level. Anyone have a better example or lead to success?