1. Kerberos for SSRS made Simple
Kathi Kellenberger
@auntkathi

2. Agenda Why do we need to configure Kerberos Delegation? Three tasks
Configure SPNs
App configuration
Set delegation property
DEMO!

3. Why??

4. Why??

5. Why??
Stored Credentials

6. Why??
Report
Data
Stored Credentials

7. Why??
Report
Data

8. Why??
Report
Data

9. Three Tasks: Configure SPNs
Service Principal Names
A property of the service account
If local service account, use host name
Setspn utility
L = list the registration
S = register an SPN
D = delete an SPN
SETSPN –S <service name>/<host> <domain>\<service account>
SETSPN –S <service name>/<host>:<port> <domain>\<service account>

10. Three Tasks: Configure SPNs
SQL Server Instance
MSSQLSvc/sql1.mydomain.local
MSSQLSvc/sql1.mydomain.local:1433
MSSQLSvc/sql1.mydomain.local:inst2
MSSQLSvc/sql1.mydomain.local:49200
SSRS Instance
http/SSRS.mydomain.local

11. Three Tasks: App Configuration
RSReportServer.config file
Restart services
<AuthenticationTypes>
<RSWindowsNTLM />
</AuthenticationTypes>
<RSWindowsNegotiate />

12. Three Tasks: Set Delegation Property
SSRS Account, NOT SQL Account
AD Users and Computers
Delegation tab shows up only with spn
Uncheck “Account is sensitive and cannot be delegated”

13. Let’s Do It!
DEM O

14. What Next? SharePoint Integrated Mode Managed Service Accounts
Trusted Domains
Clustering and Availability Groups
Check out my Pluralsight course!

15. Who am I? Trainer Author Database Consultant
Teammate at Linchpin People