Forum Discussion
Configuration with Kerberos?
Hello eveeryone,
For a few days, I'm trying to configure my gateway with Kerberos
We followed the official microsft documentation
https://learn.microsoft.com/en-us/power-bi/connect-data/service-gateway-sso-kerberos
With the two followings options:
Option A: Run the gateway Windows service as a domain account with SPN
Option A: Standard Kerberos constrained delegation
But the issue is, Power BI did not delegate, the service account has been added in a group which has access to the sql server, if I let the account in the group everyone has access to the report (The rights are not delegated) and if I removed the account from this group, no one has access to the report...
In the data gateway configuration, I selected USE SSO via Kerberos for DirectQuery queries, but it is changed nothing
And if I test the single sign on (SSO) in power BI Services with an user who has access to the database via it returns:
The on-premise data gatewau service account failed to impersonnater the user
DW_GWPipeline_Gateway_ImpersonationError
Any idea of what I could try ?
Many thanks for your help 🙂
Hi Cookistador ,
You also need settings in SQL -Server. You may have Kerberos configured in your environment, but it may not be configured for constrained delegation. For Kerberos constrained delegation to work properly, several items need to be configured. This includes the Service Principal Name (SPN) and the delegation settings on the service account. To configure the SPN and delegation settings, you need to be a domain administrator.
More details can be found at the following link:
Configure Kerberos to use Power BI reports - Power BI | Microsoft Learn
Solved: Error: the on-premises data gateway's service acco... - Microsoft Fabric Community
Best Regards,
Clara Gong
If this post helps, then please consider Accept it as the solution to help the other members find it more quickly.
1 Reply
Hi Cookistador ,
You also need settings in SQL -Server. You may have Kerberos configured in your environment, but it may not be configured for constrained delegation. For Kerberos constrained delegation to work properly, several items need to be configured. This includes the Service Principal Name (SPN) and the delegation settings on the service account. To configure the SPN and delegation settings, you need to be a domain administrator.
More details can be found at the following link:
Configure Kerberos to use Power BI reports - Power BI | Microsoft Learn
Solved: Error: the on-premises data gateway's service acco... - Microsoft Fabric Community
Best Regards,
Clara Gong
If this post helps, then please consider Accept it as the solution to help the other members find it more quickly.