December 18, 2008
by RSinteract
Let me start by apologising for the lack of a post in the last week or so, I have been really busy with the new, improved version of RSinteract (sneak preview in the next couple of weeks, watch this space).
One of the issues we have experienced time and again with RSinteract is a scenario where the ReportServer/Database or Analysis services is on a different machine from RSinteract as demonstrated in the following diagram. The problem manifests itself as an authentication issue when Reporting Services tries to retreive information from the Database or Analysis server because Active Directory credentials expire after the first hop, in this case from RSinteract to Reporting Services.

Microsoft are calling this the “Double Hop” problem. The reason for Reporting Services’ and Analysis Services’ lack of integration out of the box is “in the interest of security”. Active Directory uses Kerberos under the hood which can be configured to pass credentials between web apps or not. To get this working with RSinteract or indeed any ASP.NET application you need to correctly configure Kerberos delegation.
I’m having trouble tracking down the steps for Reporting Services, the link I had has gone dead since I began writing this post
So here’s the steps to configure your Analysis Services (from Business Intelligence and Agile Development Blog):
- Download and install the SetSPN utility (Either from the Windows Resource kit, or from http://www.microsoft.com/downloads/details.aspx?FamilyID=5fd831fd-ab77-46a3-9cfe-ff01d29e5c46&DisplayLang=en)
- SETSPN is used to configure a “Service Principal Name”, which is required by Kerberos
- Create a Service Principal Name (SPN) for the Analysis Services Instance (on the AS server)
- (If AS is running as a domain account) setspn.exe –A MSOLAPSvc.3/
- Configure Active Directory Settings
- All users that are connecting to Analysis Services through the intermediate host need to be allowed to use Kerberos Delegation (“Account is sensitive and cannot be delegated” must be unchecked)
- The “Account is trusted for delegation” setting must be checked for each user and each service account used in the process.
- The “Trust computer for delegation” setting must be checked for each computer used in the process
- Configure IIS Settings for the Virtual Directory hosting the application (or SharePoint site)
- The Authentication must be set to “Integrated Windows Authentication” or “Basic Authentication”
- The application protection level must be set to “High (Isolated)”
- The impersonation level for COM+ must be set to “Delegate”
- The COM+ application identity must be set to an account where “Account is trusted for delegation” is checked.
- Connection strings must include SSPI=Kerberos
- Connection strings CANNOT use IP Addresses
Here’s some more information pertaining to the bug:
I’ll update this post as soon as I find the information for configuring SSRS.