Thanks for posting back. The convoluted mess of combinations of what is and isn't supported with the extended protection levels is in this document - you could try to figure out which pieces come into play in your environment. Seems that your connection needed to support extended protection levels and using the allow setting supports it but doesn't require it :
Extended Protection for Authentication with Reporting Services

Sue