Integrated security double-hop Windows Server 2008 / SSRS / SSAS
- From: Rockabilly Jim <RockabillyJim@xxxxxxxxxxxxxxxxxxxxxxxxx>
- Date: Fri, 24 Apr 2009 04:28:01 -0700
I have a BI application set up on two servers. Both are running Windows
Server 2008. One server hosts the Analysis Services instance (SSAS 2008 -
10.0.1600.22), the other the Report Server (SSRS 2008 - 10.0.1600). My
reports use Integrated Security.
The reports execute fine from Visual Studio (on my dev machine) during
development. I can query the cube from the SSMS on the report server. But the
reports on the Report Server cannot access the data when the security on the
data source is set to Integrated Security. If I change the security to
"Credentials stored securely in the report server" (and provide the same
username and password with which I'm trying to access the reports using
Integrated Security) it works fine.
I believe I've run into the problem dicussed on the CSS SQL Server Engineers
blog here: http://blogs.msdn.com/psssql/ (see the post about a third of the
way down entitled "Updated Errors may occur after configuring Analysis
Services to use Kerberos authentication on Advanced Encryption Standard Aware
Operating Systems"). My architecture and the errors I'm receiving match
exactly those in the post.
The post goes on to say that a patch will be released to fix this and then
details several interim workarounds but only two are suitable for a
double-hop scenario. One is to install an older operating system on one of
the servers (not really an option for me) and the other is to modify the SSAS
config file so that the RequiredProtectionLevel for DataProtection and
AdministrativeDataProtection are set to 0.
I have attempted to apply the latter workaround (and re-started the SSAS
service and added ";Protection Level=Connect" to the connection string in the
client) but it doesn't work.
Two questions:
I didn't explicitly enable Kerberos authentication on Analysis Services. Is
it enabled by default in SSAS 2008? How can I check whether it's enabled?
Is there a workaround that will work for an architecture that includes a
double-hop that doesn't involve re-building the server with Windows Server
2003?
.
- Prev by Date: Change Dimemension and Dimension Member Names
- Next by Date: Re: Restore of AS2005 cube into AS2008 - very slow queries
- Previous by thread: Change Dimemension and Dimension Member Names
- Next by thread: Help with Calculating Average in Cube
- Index(es):
Relevant Pages
|
