kerberos report server

7 Topics

Kerberos Authentication Help
Hello all- I'm trying to get Kerberos Authentication configured for Power BI Report Server and running into some issues. I am on September 2022 and we are using a Domain Service account. We are connectivity via HTTPs. I followed this article: https://learn.microsoft.com/en-us/power-bi/report-server/configure-kerberos-powerbi-reports#authentication-type-within-report-server-configuration I already made this change to the rsreportserver.config file: <AuthenticationTypes> <RSWindowsNegotiate/> <RSWindowsNTLM/> </AuthenticationTypes> These are the SPNs set for the domain service account: HTTP/powerbireports HTTP/powerbireports.fqdn HTTP/servername HTTP/servername.fqdn My question is- is there anything else I need to do since we have 2 HTTPs URLs configured? Am I missing a step? One of the URLs is the computer name and one is a custom URL. When I hit the URLs I'm still prompted for username and password. I'm running Fiddler and seeing an HTTPS 401 Unauthorized error. Also looks like it's still using NTLM. Appreciate the help! Hope it's as easy as mis-configured SPNs.
Solved
acp206
3 years ago Place Report Server
2KViews
0likes
2Comments
Login username and password prompt for Power BI report web portal URL and SSMS Reporting Services
Hi Team, Issue: Username and Password prompt for Power BI report webportal URL Issue: Using SSMS connect to Reporting Services URL endpoint Windows Authetication - errors. I installed Power BI Report Server on-premise build 15.0.1105.230 and SQL Server 2019 on the same VM. 1. Authentication type within Report Server config. <AuthenticationTypes> <RSWindowsNegotiate/> <RSWindowsNTLM/> </AuthenticationTypes> 2. SPNs for the report server service account for both the FQDN and NetBIOS using a virtual URL of RSSBX Setspn -a HTTP/RSSBX.co.com DOMAIN\RSService Setspn -a HTTP/RSSBX DOMAIN\RSService 3. SPNs for the SQL server service account for a instance name setspn -s MSSQLSvc/myhost.co.com DOMAIN\SQLServiceAccount setspn -s MSSQLSvc/myhost.co.com:instancename DOMAIN\SQLServiceAccount setspn -s MSSQLSvc/myhost:port DOMAIN\SQLServiceAccount setspn -s MSSQLSvc/myhost:instancename DOMAIN\SQLServiceAccount I've verified that the SPNs are setup properly. When I access the web portal from the Power BI Report Server VM itself or from a workstation using IE, Edge or Chrome browsers, it prompt for username/password. I use SSMS to connect to the Reporting Services with Windows Authentication, I get this error. I worked with Basic Authentication. Really appreciate any help!
Solved
nle
4 years ago Place Report Server
24KViews
0likes
6Comments
Issues Saving Report/Accessing Portal - Kerberos
Hello! We recently enabled Kerberos on our test report server (followed MS documentation and created SPNs and using a domain service account) and thought it was all setup correctly, but now we cannot save reports to the server or access the portal through Edge/IE. When attemtping to save we get a "Server is not reachable" error/banner at the bottom. When we try to log into the reports portal using Edge or IE, Windows Auth will prompt for user/password over and over again. The reports portal works just fine with Firefox or Chrome. And our Azure App Proxy appears to be working also (reason we enabled Kerberos). I tried turning on tracing on the PBI Desktop, but it does not seem to show anything useful. I'm not seeing anything when running looking at the network activity under the browser's developer tools (F12). Also, not seeing anything odd on the ISS or PBI Report Server logs. Any tips or where/what to look at? Many thanks!
Solved
ge5536
6 years ago Place Report Server
1.2KViews
0likes
3Comments
Login prompt when using Kerbeors authentication
I'm trying to implement Kerberos authentication with Power BI Report Server using the latest build. I have a distributed environment where I have 2 servers and a workstation. SQL Server Analysis server is on one Windows 2016 machine and Power BI Report server is on a separate Windows 2016 machine. Workstation is a Widnows 10 machine. I followed the steps outlined in this post from the Guy in the Cube: https://docs.microsoft.com/en-us/power-bi/report-server/configure-kerberos-powerbi-reports I have verified that the SPNs are setup properly. I'm using a Domain Account for running Power BI Report Server service and using the same domain account to run SQL Server Analysis Services service. I don't have any named instances. Everything is setup with default instances. I have 2 SPNs for the domain account being used to run the services. One HTTP SPN and one MSOLAPSvc.3 SPN. I have added <RSWindowsNegotiate/> tag to my rsreportserver.config file to enable Kerberos authentication. When i access the web portal from the Power BI Report Server machine itself, it works fine and i can see the reports. But when i try to access the web portal from a workstation, using the same user login as i used on the Power BI Report Server machine, it gives me a login window. I can't get past this login window no matter how many times i type in the correct user login and passwod. As soon as i remove <RSWindowsNegotiate/> tag from the rsreportserver.config file, i'm able to access the web portal from the workstation. I have tried IE, Edge and Chrome browsers. Same result. I have also checked the security on the browser and added the URL to trusted sites along with 'automatic logon with current user name and password' option. No success. Pretty much out of ideas. Any suggestion will be appreciated.
Solved
qaiserjaved
6 years ago Place Report Server
4.7KViews
1like
1Comment
Domain account rights
We are using the Power BI Report Server on premise. I'm looking for some documentation about which rights the service account (domain user) should have for using constrained delegation. Is it necessary to have set “impersonate a client after authentication”, “log on as a batch job” and “log on as a service”?
Anonymous
7 years ago Place Report Server
1.6KViews
0likes
2Comments
Kerberos with Report Server
Hello Community,　 I have created 3 servers on wich I have installed : PowerBI Report Server, SSAS and SQL Server.　 I have configured Kerberos.　 However, it is not working 　 We couldn't run the report because we couldn't connect to its data source. The report or data source might not be configured correctly. Please try again later or contact support. If you contact support, please provide these details.　 We couldn't connect to the Analysis Services server. The server forcibly closed the connection. To connect as the user viewing the report, your organization must have configured Kerberos constrained delegation.　 Request ID9115842d-13ca-19f4-da04-93a824f9e0b8　 TimeWed Feb 21 2018 17:12:06 GMT+0100 (Romance Standard Time)　 Version14.0.600.442　　 in log files :　 2018-02-21 17:12:06.1462|ERROR|10|PBI.Win.ReportingServicesHostTrace|type:Error;message:processing:Throwing Microsoft.ReportingServices.ReportProcessing.ReportProcessingException: , Microsoft.ReportingServices.ReportProcessing.ReportProcessingException: Cannot create a connection to data source 'EntityDataSource'. ---> Microsoft.AnalysisServices.AdomdClient.AdomdConnectionException: The connection either timed out or was lost. ---> System.IO.IOException: Unable to read data from the transport connection: An existing connection was forcibly closed by the remote host. ---> System.Net.Sockets.SocketException: An existing connection was forcibly closed by the remote host　 at System.Net.Sockets.Socket.Receive(Byte[] buffer, Int32 offset, Int32 size, SocketFlags socketFlags)　 at System.Net.Sockets.NetworkStream.Read(Byte[] buffer, Int32 offset, Int32 size)　 --- End of inner exception stack trace ---　 at System.Net.Sockets.NetworkStream.Read(Byte[] buffer, Int32 offset, Int32 size)　 at System.IO.BufferedStream.Read(Byte[] array, Int32 offset, Int32 count)　 at Microsoft.AnalysisServices.AdomdClient.DimeRecord.ForceRead(Stream stream, Byte[] buffer, Int32 length)　 at Microsoft.AnalysisServices.AdomdClient.DimeRecord.ReadHeader()　 at Microsoft.AnalysisServices.AdomdClient.DimeReader.ReadRecord()　 at Microsoft.AnalysisServices.AdomdClient.TcpStream.GetResponseDataType()　 --- End of inner exception stack trace ---　 at Microsoft.AnalysisServices.AdomdClient.XmlaClient.EndRequest(Boolean useBinaryXml)　 at Microsoft.AnalysisServices.AdomdClient.XmlaClient.SendMessage(Boolean endReceivalIfException, Boolean readSession, Boolean readNamespaceCompatibility)　 at Microsoft.AnalysisServices.AdomdClient.XmlaClient.SupportsProperty(String propName)　 at Microsoft.AnalysisServices.AdomdClient.XmlaClient.Connect(ConnectionInfo connectionInfo, Boolean beginSession)　 at Microsoft.AnalysisServices.AdomdClient.AdomdConnection.XmlaClientProvider.Connect(Boolean toIXMLA)　 at Microsoft.AnalysisServices.AdomdClient.AdomdConnection.ConnectToXMLA(Boolean createSession, Boolean isHTTP)　 at Microsoft.AnalysisServices.AdomdClient.AdomdConnection.Open()　 at Microsoft.ReportingServices.DataExtensions.AdomdExceptionHandler.Execute(String connectionString, Action action)　 at Microsoft.ReportingServices.Diagnostics.DataExtensionConnectionBase.<>c__DisplayClass6_0.<OpenConnection>b__0()　 --- End of inner exception stack trace ---;;| RequestID = 9115842d-13ca-19f4-da04-93a824f9e0b8 ClientSessionID = 3a233905-497b-a82c-314a-77608064f6ae 　 2018-02-21 17:12:06.1618|ERROR|10|PBI.Win.ProcessingError|ExceptionType:Microsoft.ReportingServices.ReportProcessing.ReportProcessingException;stackTrace: at Microsoft.ReportingServices.Diagnostics.DataExtensionConnectionBase.<>c__DisplayClass6_0.<OpenConnection>b__0()　 at Microsoft.ReportingServices.Diagnostics.Utilities.DefaultActivitiesFactory.CreateSyncActivityAndReportResult(RSActivityType activityType, Action action)　 at Microsoft.ReportingServices.Diagnostics.DataExtensionConnectionBase.<>c__DisplayClass5_0.<OpenDataSourceExtensionConnection>b__0()　 at Microsoft.ReportingServices.Diagnostics.DataExtensionConnectionBase.HandleImpersonation(IProcessingDataSource dataSource, DataSourceInfo dataSourceInfo, String datasetName, IDbConnection connection, Action afterImpersonationAction)　 at Microsoft.ReportingServices.Diagnostics.DataExtensionConnectionBase.OpenDataSourceExtensionConnection(IProcessingDataSource dataSourceObj, String connectString, DataSourceInfo dataSourceInfo, String datasetName)　 at Microsoft.PowerBI.ReportingServicesHost.LocalDataExtensionConnectionWrapper..ctor(DataSourceInfo dataSourceInfo, CreateDataExtensionInstance createExtensionCallback, UserContext threadUser, ExecutionType execType, IAdditionalToken additionalToken, IDbConnectionPool connectionPool, IDataProtection dataProtection)　 at Microsoft.PowerBI.ReportingServicesHost.LocalDataExtensionConnectionWrapper.<>c__DisplayClass7_0.<Open>b__0()　 at Microsoft.PowerBI.ReportServer.ExploreHost.WindowsUserIdentityConnectionImpersonator.ExecuteInContext[T](Func`1 func)　 at Microsoft.PowerBI.ReportingServicesHost.LocalReportProcessingHost.GetModelMetadata(DataSourceInfo dataSourceInfo, IDbConnectionPool connectionPool, String modelMetadataVersion, IConnectionUserImpersonator connectionUserImpersonator, ITelemetryService telemetryService)　 at Microsoft.PowerBI.ReportingServicesHost.DataShapingHelper.GetModelMetadata(IPowerViewEngine powerViewEngine, IDbConnectionPool connectionPool, DataSourceInfo dataSourceInfo, IASConnectionInfo asConnectionInfo, Boolean useMsolapForCsdl, IConnectionUserImpersonator connectionUserImpersonator, ITelemetryService telemetryService, String maxModelMetadataVersion);message:GetModelAsStream;| RequestID = 9115842d-13ca-19f4-da04-93a824f9e0b8 ClientSessionID = 3a233905-497b-a82c-314a-77608064f6ae 　 2018-02-21 17:12:06.1774|ERROR|4|Failure in conceptualschema| RequestID = 9115842d-13ca-19f4-da04-93a824f9e0b8 ClientSessionID = 3a233905-497b-a82c-314a-77608064f6ae Microsoft.PowerBI.ReportServer.ExploreHost.Error.RSExploreHostException: Cannot create a connection to data source 'EntityDataSource'. ---> Microsoft.ReportingServices.ReportProcessing.ReportProcessingException: Cannot create a connection to data source 'EntityDataSource'. ---> Microsoft.AnalysisServices.AdomdClient.AdomdConnectionException: The connection either timed out or was lost. ---> System.IO.IOException: Unable to read data from the transport connection: An existing connection was forcibly closed by the remote host. ---> System.Net.Sockets.SocketException: An existing connection was forcibly closed by the remote host　 at System.Net.Sockets.Socket.Receive(Byte[] buffer, Int32 offset, Int32 size, SocketFlags socketFlags)　 at System.Net.Sockets.NetworkStream.Read(Byte[] buffer, Int32 offset, Int32 size)　 --- End of inner exception stack trace ---　 at System.Net.Sockets.NetworkStream.Read(Byte[] buffer, Int32 offset, Int32 size)　 at System.IO.BufferedStream.Read(Byte[] array, Int32 offset, Int32 count)　 at Microsoft.AnalysisServices.AdomdClient.DimeRecord.ForceRead(Stream stream, Byte[] buffer, Int32 length)　 at Microsoft.AnalysisServices.AdomdClient.DimeRecord.ReadHeader()　 at Microsoft.AnalysisServices.AdomdClient.DimeReader.ReadRecord()　 at Microsoft.AnalysisServices.AdomdClient.TcpStream.GetResponseDataType()　 --- End of inner exception stack trace ---　 at Microsoft.AnalysisServices.AdomdClient.XmlaClient.EndRequest(Boolean useBinaryXml)　 at Microsoft.AnalysisServices.AdomdClient.XmlaClient.SendMessage(Boolean endReceivalIfException, Boolean readSession, Boolean readNamespaceCompatibility)　 at Microsoft.AnalysisServices.AdomdClient.XmlaClient.SupportsProperty(String propName)　 at Microsoft.AnalysisServices.AdomdClient.XmlaClient.Connect(ConnectionInfo connectionInfo, Boolean beginSession)　 at Microsoft.AnalysisServices.AdomdClient.AdomdConnection.XmlaClientProvider.Connect(Boolean toIXMLA)　 at Microsoft.AnalysisServices.AdomdClient.AdomdConnection.ConnectToXMLA(Boolean createSession, Boolean isHTTP)　 at Microsoft.AnalysisServices.AdomdClient.AdomdConnection.Open()　 at Microsoft.ReportingServices.DataExtensions.AdomdExceptionHandler.Execute(String connectionString, Action action)　 at Microsoft.ReportingServices.Diagnostics.DataExtensionConnectionBase.<>c__DisplayClass6_0.<OpenConnection>b__0()　 Any idea please?　 Regards,　
Arez2017
7 years ago Place Report Server
4KViews
0likes
5Comments
Refresh report in import mode as the user viewing the report
Dear all We are currently setting up an on premise Power BI environment within our company. Most of the data used in the Power BI Reports are in MS SQL Server or SSAS. Our customers use direct query mode or live connection mode to connect to these data sources. We use integrated security by checking the "as the user viewing the report" option on the data source. With the proper constrained delegation settings, all works fine. Due to the limitations of the direct query mode (single data source only) our users are forced to use the import mode to combine data form different sources. When those reports are published to the server, we do not have the option anymore to configure the data sources to use integrated security (there is no checkbox for “as the user viewing the report”). It seems that the only option is to input windows credentials (username & password) to refresh those type of reports. Since our users do not have a windows password anymore (smartcard) the fun starts. Is there any way to configure the data sources in import mode to use integrated security (constrained delegation) to access the data sources? Thx for your support debugair
debugair
8 years ago Place Report Server
1.4KViews
7likes
0Comments