PBI Gateway > SSAS: "The Following system error occurred: The user name or password is incorrect. "

[Riktastic]

Hi PBI community,

I'm in a struggle with getting the PBI Gateway to source data from a SSAS Tabular instance to a PBI Service report.

The situation:

- SSAS, the gateway and the connection are using the same service user (DOMAIN\svc_PowerBiGatewayUs). All three are working just fine. SSAS starts and works fine after changing the service in "Services". The gateway also runs fine and is able to return data from a SQL Server-database.

- The service user is just a normal Active Directory user which resides in the same domain as all the other users,
- The same service user can open a SQL Server-database on the same system,

- The user mapping seems correct. UPN (Riktastic@domain.com) are mapped to Win2000-domain logins. (DOMAIN\Riktastic),

What I think is remarkeable: The "SQL Server Profiler" returns only 1 error, in which it reports that the username/password of the service user is incorrect:

Error The following system error occurred: The user name or password is incorrect. 12 svc_PowerBiGatewayUs 2023-11-01 11:59:53.000 2023-11-01 11:59:53.000 0 103 DOMAIN

I have installed many gateway before, but have never encountered this exact situation. Whenever I received the  "The Following system error occurred: The user name or password is incorrect. "-error it was because the Gateway was being executed as a local user, which was unable to impersonate a domain user.

Is there someone who has been in the same situation a I have? 

Kind regards,

Riktastic

[Amrselim8889]

Hello Mr. @Riktastic @lbendlin ,

kinldy note i need you help here,

i beleive i have the same situation here, which is 

1. i have power bi service.

2. i have on prime analaysis services.

3. i have gateway.

i open the power bi desktop with Genena\amr.selim and log on the Analsysis server , which is fine, after i finish i publish to the service and then create the gate way use my username and password ((Genena\amr.selim , password)) the gateway is online and test connection is succsedded, i know that i must map users UPN then i mapped the my user on power bi service to my user on analsysis on premises so ("bi_powerbi" with be "Genena\amr.selim") but still not working and even i added the gatway user to the analysis service properties security as a user adminstrator "NT SERVICE\PBIEgwService"  but still not working, any help please....

i read something about make sure the user running the gateway service is allowed to impersonate users at your SSAS.

how is this done, i already used map user name effectiveusername and then mapping but still not working.

[lbendlin]

The gateway connection user must be cube admin.

[Amrselim8889]

Dear Mr. @lbendlin 

Dear Mr. @Riktastic 

Thank you for your reply,

Please check below image, i have NT SERVICE\PBIEgwService account run the gateway, and i put this account in the analysis service by go to analysis server right click properties and then in the security add this account, as well i have the bi@*****.com in the power bi service cloud so i created a UPN map to replace the whole text of bi@*****.com to be NT SERVICE\PBIEgwService so the analysis service allow this account to read the cube.

please help because i don't know what else to do?!!......

Thank you.

[lbendlin]

Leave the gateway service account out of this discussion. Make sure the connection account is cube admin.

[Amrselim8889]

Dear Mr. @lbendlin 

What do you mean with connection account?!

i have  bi@*****.com power bi cloud account and i mapped it in UPN with amr.selim account wich is included on the analysis server properties as above.

[lbendlin]

When you create a gateway connection to your SAS source you need to specify an account that has DISCOVER privileges on the cube - which pretty much always means that account must be cube admin.

[Amrselim8889]

Dear Mr. @lbendlin 

kindly note when i created the gateway i used the same account that i log on the analysis service is account as above is putted in the analysis service properties as admin, it's windows auth.. as in the below image (amr.selim) as well i created UPN mapp to replace my BI@***.com to amr.selim ....

amr.selim is an admin account... what i'm missing here?!!!!

[lbendlin]

Is your connection user a cube admin or not?

[Amrselim8889]

Dear Mr @lbendlin 

i right clicked on the server then choose properties then choose secuirty then add the user name in the adminstrators, then i go to database expand it then go to cube expand it then go to roles expand it and right clicked to create new role and then add the user with full control,

i don't know what i'm missing here....

[lbendlin]

Needs to be done at cube level.

If you have a Pro license you can open a Pro ticket at https://admin.powerplatform.microsoft.com/newsupportticket/powerbi

[Riktastic]

Hi Amrselim, make sure that the user which runs the gateway and which runse the tabilar model is a domain user. Check this by opening the Services-application.

[Riktastic · Accepted solution]

I've solved this issue by adding the service user to the "Builtin\Windows Authorization Access Group". 

To sum everything up:

- I had to run SSAS as the service user,
- I had to run the On-premise gateway as the service user,

- Make the service user a SSAS server administrator,

- Add the service user to the "Builtin\Windows Authorization Access Group",

- Fill in the correct user mapping while configuring the Power BI Service connection,

- Make sure the TGGAU-property was set properly: https://learn.microsoft.com/en-us/power-bi/connect-data/service-gateway-onprem-tshoot#error-we-encou... 

[lbendlin]

Just to clarify - your SSAS Tabular instance is on-premise?  Does the gateway connection user have Discover permissions on the cube?

[Riktastic]

Hi @lbendlin , I have given the user server administrator rights. I think that these rights also assign the Discover permission.
https://learn.microsoft.com/en-us/analysis-services/instances/grant-server-admin-rights-to-an-analys...

PS: It is a On-premise installation.

[lbendlin]

sounds about right (although I don't know if there is a difference between server admin and cube admin).

If you have a Pro license you can open a Pro ticket at https://admin.powerplatform.microsoft.com/newsupportticket/powerbi - otherwise you can raise an issue at https://community.fabric.microsoft.com/t5/Issues/idb-p/Issues .

[Riktastic]

Hi @lbendlin thanks for helping me. This issue is quite complex. It migth be a Active Directory policy or a bug in the Gateway software that is bothering me.

P.S.: cube admin is for a SSAS cube, server admin is for a tabularmodel

[lbendlin]

The ticket is the quickest way to get answers.

[Riktastic]

Thanks for helping me!