1. Kerberos for SSRS Made Simple
Kathi Kellenberger
Kerberos for SSRS Made Simple

2. Kathi Kellenberger Consultant http://auntkathisql.com @auntkathi

3. Agenda Why do we need to configure Kerberos Delegation? Three tasks
Configure SPNs
Set delegation property
App configuration

4. Why??

5. Why??

6. Why??
Stored Credentials

7. Why??
Report
Data
Stored Credentials

8. Why??
Report
Data

9. Why??
Report
Data

10. Task 1: Configure SPNs Service Principal Names
A property of the service account
If local service account, use host name
Setspn utility
L = list the registration
S = register an SPN
D = delete an SPN
SETSPN –S <service name>/<host> <domain>\<service account>
SETSPN –S <service name>/<host>:<port> <domain>\<service account>

11. Tasks 1: Configure SPNs SQL Server Instance SSRS Instance
Setspn –S MSSQLSvc/sql1.mydomain.local mydomain\sqlservice
Setspn –S MSSQLSvc/sql1.mydomain.local:1433 mydomain\sqlservice
Setspn -S MSSQLSvc/sql1.mydomain.local:inst2 mydomain\sqlservice
Setspn –S MSSQLSvc/sql1.mydomain.local:49200 mydomain\sqlservice
SSRS Instance
Setspn –S http/SSRS.mydomain.local mydomain\ssrsservice

12. Tasks 2: Set Delegation Property
SSRS Account, NOT SQL Account
AD Users and Computers
Delegation tab shows up only with spn configured
Uncheck “Account is sensitive and cannot be delegated”

13. Tasks 3: App Configuration
RSReportServer.config file
Restart services
<AuthenticationTypes>
<RSWindowsNTLM />
</AuthenticationTypes>
<RSWindowsNegotiate />

15. What’s Next? SharePoint Integrated Mode Managed Service Accounts
Trusted Domains
Clustering and Availability Groups
Check out my Pluralsight course!
Registry key for Kerberos troubleshooting
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\Kerberos\Parameters]
"LogLevel"=dword: