Resource-Based Kerberos Constrained Delegation trouble

[AlxLoo]

Hi,

We use Power BI Report Server 1.10.7737.32652 in conjunction with SQL 2019. Products are deployed on different servers (Windows Server 2016 and Wibdows Server 2019). A domain service account is used to start the PowerBIReportServer service, and the gMSA domain account is used to start SQL services. Resource-based Kerberos Constrained Delegation (RBKCD) is configured between these accounts. In the rsreportserver.config file, the authentication type is set to RSWindowsKerberos. Users with Windows authentication have been created on the SQL server to access the required database. When we try to open a report in an Internet browser (DirectQuery connection type), we get the error "We couldn't connect to the Analysis Services server. Make sure you've entered the connection string correctly.".

In the logs of the SQL server we see attempts to connect as an anonymous user (Login failed for user 'NT AUTHORITY\ANONYMOUS LOGON').

Perhaps someone faced a similar problem?

[V-pazhen-msft]

@AlxLoo 
Have you checked the official doc in order to configure Kerberos:
Configure Kerberos to use Power BI reports - Power BI | Microsoft Docs

Paul Zheng _ Community Support Team
If this post helps, please Accept it as the solution to help the other members find it more quickly.

[AlxLoo]

Hi,

We tested the classic Kerberos constrained delegation on SPNs according to provided official doc and still did not work. The error is the same. Perhaps the problem is that delegation is being configured between the service account and the gMSA account?

[AlxLoo]

Hi,

We haven't tried the classic Kerberos constrained delegation with SPNs. We'll check it out the other day. It is strange that Resource Based Kerberos Constrained Delegation does not work.