Re: Excel Services error and Kerberos
- From: FranckS <FranckS@xxxxxxxxxxxxxxxxxxxxxxxxx>
- Date: Fri, 5 Jan 2007 07:18:00 -0800
Thanks but in that case, the same account towards SSAS will be used whatever
the user is requesting the Excel file.
In the meantime, I got it work with SSO!
Thanks to MSFT support, I found the mistake in my configuration: when
configuring SSO in MOSS, you must make sure the account used to run the SSP
(SharedServices running Excel Services) is either the exact same account as
the SSO admin account (defined in "manage server settings for SSO" page) or,
if both SSP and SSO admin accounts are different, these must be members of
the same group (eg MySSOAdmins).
To check the Application Pool identity configured for the Shared Services
Provider you have Excel Services configured at:
a) Please go to "SharePoint Central Admin"
b) Select the "Application Management" tab in the horizontal navigation
c) In the group "Office SharePoint Server Shared Services" click at the link
"Create or configure this farm's shared services"
d) Move the mouse cursor over the name of your Shared Services Provider
until the "Drop Down Arrow" gets displayed
e) Click at the now visible "Drop Down Arrow" and select "Edit Properties"
f) Have a look at the "SSP Service Credentials"
-> Write the Account Name configured here down
g) Click at the "Cancel" button in the upper right corner of the page
h) Select the "Operations" tab in the horizontal navigation
i) In the group "Security Configuration" click at the link "Manage settings
for single sign-on"
j) Click at "Manage server settings"
k) Have a look at the "Single Sign-On Administrator Account"
-> Compare the Account Name / User Group configured here with the User
Account from step f
Please ensure the User in f is member of the Group in k or use in both cases
the same account!
Hope it helps
--
Franck
"madhur" wrote:
Hi.
I have been able set up this on a 2 box without Kerberos and SSO after
lot of struggle.
The key is your .odc connection. The authentication settings in .odc
should be set as None and credentials should be provided in Shared
Services->Edit Excel Services SEttings.
The same credentials provided through Windows Authentication(NTLM)
doesnt seem to work
:(
Hope that would help
Regards
Madhur
http://madhurahuja.blogspot.com
FranckS wrote:
Hi Roxana,
If you succeed in making "Excel Services + OLAP" work with SSO on a 2-box
environment without having the "Data Refresh Failed" message, could you
please reply to this post. I've been trying to make it work for days now but
without success! It works on a single box environment but not when SQL Server
is on a separate box! However, I followed the steps described in the latest
TechNet article
(http://technet2.microsoft.com/Office/f/?en-us/library/7e6ce086-57b6-4ef2-8117-e725de18f2401033.mspx).
I'm using NTLM (never tried Kerberos but it seems as painful as NTLM since it
appears not working).
I've opened a call at MSFT but still waiting for a solution...
Thanks
--
Franck
"RoxanaGoidaci" wrote:
Seems we are all on the wrong track with this. In order to make all
this work, the idea is to use SSO authentication. Otherwise we'll get
into some "known and unsolved" bugs for now...
Hello Mike,
Have you found the solution, I have this problem too for a couple of
days. Please post the solution when you find it.
Thanks.
Roxana Goidaci
Tim Dot NoSpam wrote:
Hey MIke.
There are a couple of other newgroup threads surrounding this whole issue;
two of which I posted not too long ago. I've heard nothing definitive from
MS people, but everything I've read seems to point to configuring the single
sign-on provider.
Sorry, I realize this isn't much help.
-Tim
"Mike L" <MikeL@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote in message
news:BA6201B2-9B6F-42FD-9F50-8758777C3DCB@xxxxxxxxxxxxxxxx
I am activating Kerberos to try to get past the error that is preventing my
MOSS 2007 installations from displaying any external data in Excel
Services.
There are at least 4 web applications (virtual IIS sites) active
Sharepoint Central Administration
Office Server Web Services
Personal Sites
Sharepoint Portal A
(Sharepoint portal B...)
Each of these has a different URL with a port number for access
(http://SERVERNB:PORT/) or a fully qualified domain name FQDN
(http://SERVERFQDN:PORT)
Each of these has a different Application Pool by recomendation and the
Identity das been set to the same domain user DOMAIN\USER.
So I created the SPNs with the command
SETSPN -A HTTP/SERVERNB:PORT DOMAIN\USER and
SETSPN -A HTTP/SERVERFQDN:PORT DOMAIN\USER
for all of the sites that could be involved.
I also set the Authentication method to Kerberosfor each of the web
applications using the Application Administration. I had to edit the
metadata with "Negotiate,NTLM" manually for the Office Server Web Services
site.
I then added the SPN's for the SSAS 2005 access using
SETSPN -A MSOLAPSvc.3/SERVERNB:INSTANCE DOMAIN\USER and
SETSPN -A MSOLAPSvc.3/SERVERFQDN:INSTANCE DOMAIN\USER
I then restested the Excel Services access to Remote data and still got
the
same error:
"Excel Services cannot use credential delegation when it is configured to
use a trusted subsystem"
So my attempt to reimpliment with Excel Services my current BI product
based
upon OWC is still dead in the water.
Anyone got past this error with MOSS 2007?
--
Mike L
- Prev by Date: Site Directory New Categories Not Appearing
- Next by Date: Re: Sharepoint Alerts
- Previous by thread: Site Directory New Categories Not Appearing
- Next by thread: Discussion board complaints
- Index(es):
Relevant Pages
|
