SSRS Security Problem

  • Having a problem rendering reports from a workstation web browser.

    Here's my setup:

    -W2K3 Server running SQL2K5 with SSRS(entire package)

    -W2K3 Server running SQL2K, SP4 as a datasource

    When I log on to the SSRS server (using my acct which has domain admin provs) and connect to the Report Manager website, I can render all of my test reports with zero problem.

    When I log on to my workstation with my same account, I get an error that it cannot connect to the datasource. I checked the SSRS logs and I see this error:

    ERROR: Data source 'AUSDB1 Northwind': An error has occurred. Details: Microsoft.ReportingServices.ReportProcessing.ReportProcessingException: Cannot create a connection to data source 'AUSDB1 Northwind'. ---> System.Data.SqlClient.SqlException: Login failed for user '(null)'. Reason: Not associated with a trusted SQL Server connection.

    I know this is related to IIS impersonating my account with the SQL server, but I can't pinpoint the problem.

    Obviously, I'm not a SQL admin, I'm a h/w systems engineer. Can anyone point me in the right direction. Possibly a model for the security structure in SSRS?

    Thanks,

    AJ

  • It sounds like you have a double hop issue. Here's what's going on when you run a report... You're connect to the SSRS server using Windows authentication. The report is likely configured to run using Windows integrated authentication (you can check the datasource to verify this). That means the web server is trying to make a connection on your behalf using Windows integrated security.

    However, both authentication protocols used in Active Directory, Kerberos and NTLM, do not allow double hops by default. NTLM doesn't allow them at all. Kerberos does, but you have to configure Kerberos delegation. Take a look at the following Microsoft KB article on what you need to do:

    How to use Kerberos authentication in SQL Server (319723)

    K. Brian Kelley
    @kbriankelley

Viewing 2 posts - 1 through 2 (of 2 total)

You must be logged in to reply to this topic. Login to reply