Click here to monitor SSC
SQLServerCentral is supported by Red Gate Software Ltd.
 
Log in  ::  Register  ::  Not logged in
 
 
 
        
Home       Members    Calendar    Who's On


Add to briefcase 12»»

Reports won't run from client computers but works fine from Report Server Expand / Collapse
Author
Message
Posted Tuesday, September 18, 2012 7:53 AM
SSC Rookie

SSC RookieSSC RookieSSC RookieSSC RookieSSC RookieSSC RookieSSC RookieSSC Rookie

Group: General Forum Members
Last Login: Thursday, August 21, 2014 11:23 AM
Points: 26, Visits: 206
Hi,

I've written my first report in SSRS 2008R2.
It previews fine in Business Intelligence Dev Studio, and deploys without any problems.
If I open Internet Explorer on the Report Server itself, I can view the report without any problems.

The problem comes when I try to run the report in Internet Explorer on another machine.
I've enabled Remote Errors, and receive a 'Login Failed for user DOMAIN\DomainUser' error.

I've tried changing the security using a few different methods.
I've set Windows Authentication, and have tried specifying my own Windows Account in the Report.
But always with the same error.
If I set a different account in the Data Source to connect to the report, then that is the error that appears in the 'Login Failed for user' error message.


My domain account is able to run the query in SSMS, and works perfectly if I run the report on the Report Server.



From other forum posts I've read, it appears that it is to do with the fact that my Report Server is on a different server to the SQL Server hosting my data.
I've seen a number of 'potential' solutions, but nothing that I've understood or been able to follow.



Can you please give me some information on how to run a report, using Windows Authentication, when the Report Server is on a different Server to the SQL database.


Thanks for your help.
Post #1360801
Posted Tuesday, September 18, 2012 8:03 AM


SSCoach

SSCoachSSCoachSSCoachSSCoachSSCoachSSCoachSSCoachSSCoachSSCoachSSCoachSSCoach

Group: General Forum Members
Last Login: Friday, June 27, 2014 12:43 PM
Points: 15,444, Visits: 9,596
Does the report require the user to have Windows authentication, or does it run under the SSRS account? If the user-account, then what you're probably running into is what's called a double-hop error.

Windows authentication can only pass from one machine to one machine. It can't hop from client to SSRS to SQL. Kerberos is the way that's usually worked around.

You'll want to get with a Windows and network admin to work out how to implement a solution. Do you have one available, or are you stuck wearing that hat yourself? (Some DBAs are, of course.)


- Gus "GSquared", RSVP, OODA, MAP, NMVP, FAQ, SAT, SQL, DNA, RNA, UOI, IOU, AM, PM, AD, BC, BCE, USA, UN, CF, ROFL, LOL, ETC
Property of The Thread

"Nobody knows the age of the human race, but everyone agrees it's old enough to know better." - Anon
Post #1360806
Posted Wednesday, September 19, 2012 6:21 AM
SSC Rookie

SSC RookieSSC RookieSSC RookieSSC RookieSSC RookieSSC RookieSSC RookieSSC Rookie

Group: General Forum Members
Last Login: Thursday, August 21, 2014 11:23 AM
Points: 26, Visits: 206
Hi GSquared,

Thank you very much for your assistance with this.

I do have a network admin that I can liaise with, but any changes to the SSRS server will be down to me.
I've read about the different authentication options within the RSReportServer.config file.

Given that we'll have to be using Kerberos for authentication, would I be right in assuming that I need to change the AuthenticationTypes tab to RSWindowsKerberos as the first step of this?


Thanks for your help
Post #1361283
Posted Friday, September 21, 2012 11:47 AM


SSCoach

SSCoachSSCoachSSCoachSSCoachSSCoachSSCoachSSCoachSSCoachSSCoachSSCoachSSCoach

Group: General Forum Members
Last Login: Friday, June 27, 2014 12:43 PM
Points: 15,444, Visits: 9,596
I'd have to get a network admin to answer that. I know just enough about Kerberos to know when it's being a problem, but not enough to solve it.

- Gus "GSquared", RSVP, OODA, MAP, NMVP, FAQ, SAT, SQL, DNA, RNA, UOI, IOU, AM, PM, AD, BC, BCE, USA, UN, CF, ROFL, LOL, ETC
Property of The Thread

"Nobody knows the age of the human race, but everyone agrees it's old enough to know better." - Anon
Post #1362877
Posted Friday, September 21, 2012 3:03 PM
SSC Journeyman

SSC JourneymanSSC JourneymanSSC JourneymanSSC JourneymanSSC JourneymanSSC JourneymanSSC JourneymanSSC Journeyman

Group: General Forum Members
Last Login: Wednesday, August 27, 2014 9:39 AM
Points: 83, Visits: 210
I had the same problem, gave the user the access to where the ssrs is installed as an admin(on the machine) and it worked fine.
Post #1363007
Posted Tuesday, October 23, 2012 7:56 AM
SSC Rookie

SSC RookieSSC RookieSSC RookieSSC RookieSSC RookieSSC RookieSSC RookieSSC Rookie

Group: General Forum Members
Last Login: Today @ 12:13 PM
Points: 41, Visits: 313
Hello,

When SSRS components are loaded on a server other than the DB server and you are using Windows authentication for the reports, you'll run into the 'Double Hop', 'Kerberos' issue.


Couple of things you'll need to resolve this.

Have your domain admin set the SPN's (Service Principal Name) for the domain users running both the SQL Server and SSRS services.

We make sure we inlcude the SQL Ports in our entries.


Once the SPN's have been set, you'll need to have them update AD to allow these same users delegation.

Under Delegation - Check off 'Trust this user for delegation for any service(Kerberos Only)'
Under Account - Confirm that the following option is not selected: Account is sensitive and cannot be delegated.


Update the RSReportServer.config file as such(Partial copy):

<AuthenticationTypes>
<RSWindowsNegotiate />
<RSWindowsNTLM />


Our notes have a reboot of the servers afterwards.

Lot's of info in SSC and on-line regarding this and SPN's and delegation which should help you out.




Post #1376063
Posted Wednesday, October 24, 2012 12:05 PM
SSC Rookie

SSC RookieSSC RookieSSC RookieSSC RookieSSC RookieSSC RookieSSC RookieSSC Rookie

Group: General Forum Members
Last Login: Today @ 12:13 PM
Points: 41, Visits: 313
This appears to be an easier way to set SPN"s for the service account.

http://www.expta.com/2010/02/allowing-service-account-to-manage-its.html
Post #1376615
Posted Saturday, January 19, 2013 4:50 AM
Forum Newbie

Forum NewbieForum NewbieForum NewbieForum NewbieForum NewbieForum NewbieForum NewbieForum Newbie

Group: General Forum Members
Last Login: Saturday, February 16, 2013 2:33 AM
Points: 2, Visits: 5
Please Every one
I'm very New In SSRS
and i really have this problem but i didn't understand any thing

Can any one help me and tell me in detail what to do
P.S. I Installed every thing and report works on my PC Without any experience and Knowledge !!

Thanks

Post #1409185
Posted Saturday, January 19, 2013 5:04 AM


SSCommitted

SSCommittedSSCommittedSSCommittedSSCommittedSSCommittedSSCommittedSSCommittedSSCommitted

Group: General Forum Members
Last Login: Thursday, June 12, 2014 2:04 PM
Points: 1,789, Visits: 1,014
Could you try this and let me know what happens
Create a SQL account and grant it permsisions on the database.
Modify the connection string in the datasoruce for the report to use the SQL Authenticated account.(choose the option where credentials are stored securely on the report server).
If you have user accounts that should be able to access the report from another system , grant them permissions within SSRS Report manager and on the indivigual reports.



Jayanth Kurup
Post #1409187
Posted Saturday, January 19, 2013 5:57 AM
Forum Newbie

Forum NewbieForum NewbieForum NewbieForum NewbieForum NewbieForum NewbieForum NewbieForum Newbie

Group: General Forum Members
Last Login: Saturday, February 16, 2013 2:33 AM
Points: 2, Visits: 5
Thank you very much for reply

but the problem is that i can't even see the web page from the other PC
Post #1409193
« Prev Topic | Next Topic »

Add to briefcase 12»»

Permissions Expand / Collapse