Configuration with Kerberos?

[Cookistador]

Hello eveeryone,

For a few days, I'm trying to configure my gateway with Kerberos

We followed the official microsft documentation
https://learn.microsoft.com/en-us/power-bi/connect-data/service-gateway-sso-kerberos

With the two followings options:

Option A: Run the gateway Windows service as a domain account with SPN

Option A: Standard Kerberos constrained delegation

But the issue is, Power BI did not delegate, the service account has been added in a group which has access to the sql server, if I let the account in the group everyone has access to the report (The rights are not delegated) and if I removed the account from this group, no one has access to the report...

In the data gateway configuration, I selected USE SSO via Kerberos for DirectQuery queries, but it is changed nothing

And if I test the single sign on (SSO) in power BI Services with an user who has access to the database via it returns:

The on-premise data gatewau service account failed to impersonnater the user

DW_GWPipeline_Gateway_ImpersonationError

Any idea of what I could try ?

Many thanks for your help 🙂

[Anonymous · Accepted solution]

Hi @Cookistador ,

You also need settings in SQL -Server. You may have Kerberos configured in your environment, but it may not be configured for constrained delegation. For Kerberos constrained delegation to work properly, several items need to be configured. This includes the Service Principal Name (SPN) and the delegation settings on the service account. To configure the SPN and delegation settings, you need to be a domain administrator.

More details can be found at the following link:

Configure Kerberos to use Power BI reports - Power BI | Microsoft Learn

Solved: Error: the on-premises data gateway's service acco... - Microsoft Fabric Community

Best Regards,

Clara Gong

If this post helps, then please consider Accept it as the solution to help the other members find it more quickly.