Power BI Report Server - API error

andyw324 · ‎06-05-2019

I am having issues with allowing certain "Power Users" access to the Power BI Report Server APIs via URLs. For example when such users try to access https://.../reports/api/v2.0/CatalogItems they receive the following error:

{
  "error":{
    "code":"1251","message":"An error occurred when invoking the authorization extension."
  }
}

And the Power BI Report Server logs return the following error (RSPortal_###.log):

OData exception occurred: Microsoft.ReportingServices.Diagnostics.Utilities.AuthorizationExtensionException: An error occurred when invoking the authorization extension.
... stack trace...

Sending response. Response code <Domain\Username> 500...

Our setup use Windows Authentication with RSWindowsNegotiate and RSWindowsNTLM enabled and no custom extensions. When said users are added to the "Administrators" local group on the server hosting Power BI Report Server, the error goes away.

We are currently on the August 2018 version of Power BI Report Server sitting on top of SQL Server 2016 (13.0.4224.16).

I'm reluctant to add these "Power Users" to the local Administrators group for obvious reasons but this seems to be the only workaround I can see.

Strange thing is that the users were able to access the URL fine yesterday and all of a sudden are not able to access today. Also, there have been no reported changes to AD group / user security policies.

Any suggestions to what may be the cause of the issue and of any better work arounds would be most welcome.

Thanks

Andrew

kg2140 · ‎08-07-2023

Were you able to resolve this? We are now facing this issue and can't find real solution. But the adding as an admin to the server does fix the issue.

andyw324 · ‎07-25-2019

Has anyone else encountered this or shed any light on what may be the cause? The service account does already have delegated authority to pass down credentials so not sure what is the root cause.

Is there any way to explicity allow / deny access to the PBIRS / SSRS API?