Kerberos for SSRS Made Simple Kathi Kellenberger Kerberos for SSRS Made Simple

Kathi Kellenberger Consultant http://auntkathisql.com @auntkathi

Agenda Why do we need to configure Kerberos Delegation? Three tasks Configure SPNs Set delegation property App configuration

Why??

Why??

Why?? Stored Credentials

Why?? Report Data Stored Credentials

Why?? Report Data

Why?? Report Data

Task 1: Configure SPNs Service Principal Names A property of the service account If local service account, use host name Setspn utility L = list the registration S = register an SPN D = delete an SPN SETSPN –S <service name>/<host> <domain>\<service account> SETSPN –S <service name>/<host>:<port> <domain>\<service account>

Tasks 1: Configure SPNs SQL Server Instance SSRS Instance Setspn –S MSSQLSvc/sql1.mydomain.local mydomain\sqlservice Setspn –S MSSQLSvc/sql1.mydomain.local:1433 mydomain\sqlservice Setspn -S MSSQLSvc/sql1.mydomain.local:inst2 mydomain\sqlservice Setspn –S MSSQLSvc/sql1.mydomain.local:49200 mydomain\sqlservice SSRS Instance Setspn –S http/SSRS.mydomain.local mydomain\ssrsservice

Tasks 2: Set Delegation Property SSRS Account, NOT SQL Account AD Users and Computers Delegation tab shows up only with spn configured Uncheck “Account is sensitive and cannot be delegated”

Tasks 3: App Configuration RSReportServer.config file Restart services <AuthenticationTypes> <RSWindowsNTLM /> </AuthenticationTypes> <RSWindowsNegotiate />

What’s Next? SharePoint Integrated Mode Managed Service Accounts Trusted Domains Clustering and Availability Groups Check out my Pluralsight course! kathik@kellenbergerconsultingllc.com Registry key for Kerberos troubleshooting [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\Kerberos\Parameters] "LogLevel"=dword:00000001