rholt (4/16/2008)
ok - i'm sort of understanding this, but would the fact that I have RS loaded & running on my PC constitute a 2nd hop or just a single hop to the SQL Server?Everything except the SQL & SP (which are both on the SQL Server) is on my personal PC. (i will be moving it off to a Reports Server probably within the week).
That would be one hop, and therefore Kerberos delegation wouldn't be needed. I thought you were saying that it worked fine on your box with BIDS, but was failing once you deployed it to your RS server... or do I have it wrong?
Jacob - this link didn't work: Configuring Authentication for Reporting Services
Sorry - those two links only seem to work if you copy-and-paste them into a new browser window. They will open your local BOL. Here's an online version of them:
http://msdn2.microsoft.com/en-us/library/ms160330.aspx
http://msdn2.microsoft.com/en-us/library/bb283249.aspx.
so... i think we're in agreement that since i eventually want others to be able to run these reports, an "Execution Account" is the way to go.
Not really - an execution account is not for that purpose. As Ben just mentioned it's only intended for things like subscription emails, external network access, etc. It will be used for your data source connections if you haven't provided valid credentials otherwise, but it's much better to use either passthrough Windows credentials from your users (and thus Keberos delegation is required), Windows credentials stored securely on the server or a native SQL login for your connection string in your data sources.
Regards,
Jacob