Kerberos for SSRS made Simple Kathi Kellenberger @auntkathi http://www.auntkathisql.com

Agenda Why do we need to configure Kerberos Delegation? Three tasks Configure SPNs App configuration Set delegation property DEMO!

Why??

Why??

Why?? Stored Credentials

Why?? Report Data Stored Credentials

Why?? Report Data

Why?? Report Data

Three Tasks: Configure SPNs Service Principal Names A property of the service account If local service account, use host name Setspn utility L = list the registration S = register an SPN D = delete an SPN SETSPN –S <service name>/<host> <domain>\<service account> SETSPN –S <service name>/<host>:<port> <domain>\<service account>

Three Tasks: Configure SPNs SQL Server Instance MSSQLSvc/sql1.mydomain.local MSSQLSvc/sql1.mydomain.local:1433 MSSQLSvc/sql1.mydomain.local:inst2 MSSQLSvc/sql1.mydomain.local:49200 SSRS Instance http/SSRS.mydomain.local

Three Tasks: App Configuration RSReportServer.config file Restart services <AuthenticationTypes> <RSWindowsNTLM /> </AuthenticationTypes> <RSWindowsNegotiate />

Three Tasks: Set Delegation Property SSRS Account, NOT SQL Account AD Users and Computers Delegation tab shows up only with spn Uncheck “Account is sensitive and cannot be delegated”

Let’s Do It! DEM O

What Next? SharePoint Integrated Mode Managed Service Accounts Trusted Domains Clustering and Availability Groups Check out my Pluralsight course!

Who am I? Trainer Author Database Consultant Teammate at Linchpin People Kathi.Kellenberger@linchpinpeople.com www.auntkathisql.com