SSMS, SSIS & Kerberos

• shelton.wade

  SSC Enthusiast

  Points: 188

  More actions

  July 25, 2018 at 9:21 am

  #358856

  We have a SQL 2014 Failover Cluster comprised of the cluster host (running MSSQLServer, Browser, Agent, and Full Text Daemon), and two nodes.  One of those nodes holds the primary role and runs SQL Server Integration Services, and the other runs SSRS.

  My devs here have never used SSIS, and I'm trying to get them started.  We've run into an issue, though.  When we connect to SSIS and attempt to expand the Stored Packages --> MSDB node, we get an error message.  

  

  When the devs log into the server running SSIS through remote desktop, they can access the node with no issues.  Because the issue only occurs when they attempt to use SSMS from their local machines, this looks like a two-hop auth issue to me.  Reading here, it appears that SSIS does support multi-hop kerberos auth in 2014, though you have to trust the account for delegation (which I have).  I've also gone through DCOM config and verified that the users in question have launch rights.  I've also changed the account on the service to run under a domain user.

  I'm stuck, and not sure what to look at next.  The only thing I did notice is that the user that SSIS is running under has no SPN set on the node... but I have no idea what service would be associated with that SPN, if one is required.

  Anyone have any pointers?