SQL Clone
SQLServerCentral is supported by Redgate
 
Log in  ::  Register  ::  Not logged in
 
 
 


Reports won't run from client computers but works fine from Report Server


Reports won't run from client computers but works fine from Report Server

Author
Message
Steve Smith-163358
Steve Smith-163358
SSC-Addicted
SSC-Addicted (410 reputation)SSC-Addicted (410 reputation)SSC-Addicted (410 reputation)SSC-Addicted (410 reputation)SSC-Addicted (410 reputation)SSC-Addicted (410 reputation)SSC-Addicted (410 reputation)SSC-Addicted (410 reputation)

Group: General Forum Members
Points: 410 Visits: 301
Hi,

I've written my first report in SSRS 2008R2.
It previews fine in Business Intelligence Dev Studio, and deploys without any problems.
If I open Internet Explorer on the Report Server itself, I can view the report without any problems.

The problem comes when I try to run the report in Internet Explorer on another machine.
I've enabled Remote Errors, and receive a 'Login Failed for user DOMAIN\DomainUser' error.

I've tried changing the security using a few different methods.
I've set Windows Authentication, and have tried specifying my own Windows Account in the Report.
But always with the same error.
If I set a different account in the Data Source to connect to the report, then that is the error that appears in the 'Login Failed for user' error message.


My domain account is able to run the query in SSMS, and works perfectly if I run the report on the Report Server.



From other forum posts I've read, it appears that it is to do with the fact that my Report Server is on a different server to the SQL Server hosting my data.
I've seen a number of 'potential' solutions, but nothing that I've understood or been able to follow.



Can you please give me some information on how to run a report, using Windows Authentication, when the Report Server is on a different Server to the SQL database.


Thanks for your help.
GSquared
GSquared
SSC Guru
SSC Guru (56K reputation)SSC Guru (56K reputation)SSC Guru (56K reputation)SSC Guru (56K reputation)SSC Guru (56K reputation)SSC Guru (56K reputation)SSC Guru (56K reputation)SSC Guru (56K reputation)

Group: General Forum Members
Points: 56581 Visits: 9730
Does the report require the user to have Windows authentication, or does it run under the SSRS account? If the user-account, then what you're probably running into is what's called a double-hop error.

Windows authentication can only pass from one machine to one machine. It can't hop from client to SSRS to SQL. Kerberos is the way that's usually worked around.

You'll want to get with a Windows and network admin to work out how to implement a solution. Do you have one available, or are you stuck wearing that hat yourself? (Some DBAs are, of course.)

- Gus "GSquared", RSVP, OODA, MAP, NMVP, FAQ, SAT, SQL, DNA, RNA, UOI, IOU, AM, PM, AD, BC, BCE, USA, UN, CF, ROFL, LOL, ETC
Property of The Thread

"Nobody knows the age of the human race, but everyone agrees it's old enough to know better." - Anon
Steve Smith-163358
Steve Smith-163358
SSC-Addicted
SSC-Addicted (410 reputation)SSC-Addicted (410 reputation)SSC-Addicted (410 reputation)SSC-Addicted (410 reputation)SSC-Addicted (410 reputation)SSC-Addicted (410 reputation)SSC-Addicted (410 reputation)SSC-Addicted (410 reputation)

Group: General Forum Members
Points: 410 Visits: 301
Hi GSquared,

Thank you very much for your assistance with this.

I do have a network admin that I can liaise with, but any changes to the SSRS server will be down to me.
I've read about the different authentication options within the RSReportServer.config file.

Given that we'll have to be using Kerberos for authentication, would I be right in assuming that I need to change the AuthenticationTypes tab to RSWindowsKerberos as the first step of this?


Thanks for your help
GSquared
GSquared
SSC Guru
SSC Guru (56K reputation)SSC Guru (56K reputation)SSC Guru (56K reputation)SSC Guru (56K reputation)SSC Guru (56K reputation)SSC Guru (56K reputation)SSC Guru (56K reputation)SSC Guru (56K reputation)

Group: General Forum Members
Points: 56581 Visits: 9730
I'd have to get a network admin to answer that. I know just enough about Kerberos to know when it's being a problem, but not enough to solve it.

- Gus "GSquared", RSVP, OODA, MAP, NMVP, FAQ, SAT, SQL, DNA, RNA, UOI, IOU, AM, PM, AD, BC, BCE, USA, UN, CF, ROFL, LOL, ETC
Property of The Thread

"Nobody knows the age of the human race, but everyone agrees it's old enough to know better." - Anon
sql007
 sql007
SSC-Enthusiastic
SSC-Enthusiastic (186 reputation)SSC-Enthusiastic (186 reputation)SSC-Enthusiastic (186 reputation)SSC-Enthusiastic (186 reputation)SSC-Enthusiastic (186 reputation)SSC-Enthusiastic (186 reputation)SSC-Enthusiastic (186 reputation)SSC-Enthusiastic (186 reputation)

Group: General Forum Members
Points: 186 Visits: 234
I had the same problem, gave the user the access to where the ssrs is installed as an admin(on the machine) and it worked fine.
DMarvez
DMarvez
Old Hand
Old Hand (305 reputation)Old Hand (305 reputation)Old Hand (305 reputation)Old Hand (305 reputation)Old Hand (305 reputation)Old Hand (305 reputation)Old Hand (305 reputation)Old Hand (305 reputation)

Group: General Forum Members
Points: 305 Visits: 313
Hello,

When SSRS components are loaded on a server other than the DB server and you are using Windows authentication for the reports, you'll run into the 'Double Hop', 'Kerberos' issue.


Couple of things you'll need to resolve this.

Have your domain admin set the SPN's (Service Principal Name) for the domain users running both the SQL Server and SSRS services.

We make sure we inlcude the SQL Ports in our entries.


Once the SPN's have been set, you'll need to have them update AD to allow these same users delegation.

Under Delegation - Check off 'Trust this user for delegation for any service(Kerberos Only)'
Under Account - Confirm that the following option is not selected: Account is sensitive and cannot be delegated.


Update the RSReportServer.config file as such(Partial copy):

<AuthenticationTypes>
<RSWindowsNegotiate />
<RSWindowsNTLM />


Our notes have a reboot of the servers afterwards.

Lot's of info in SSC and on-line regarding this and SPN's and delegation which should help you out.
DMarvez
DMarvez
Old Hand
Old Hand (305 reputation)Old Hand (305 reputation)Old Hand (305 reputation)Old Hand (305 reputation)Old Hand (305 reputation)Old Hand (305 reputation)Old Hand (305 reputation)Old Hand (305 reputation)

Group: General Forum Members
Points: 305 Visits: 313
This appears to be an easier way to set SPN"s for the service account.

http://www.expta.com/2010/02/allowing-service-account-to-manage-its.html
abdonabil
abdonabil
Forum Newbie
Forum Newbie (2 reputation)Forum Newbie (2 reputation)Forum Newbie (2 reputation)Forum Newbie (2 reputation)Forum Newbie (2 reputation)Forum Newbie (2 reputation)Forum Newbie (2 reputation)Forum Newbie (2 reputation)

Group: General Forum Members
Points: 2 Visits: 5
Please Every one
I'm very New In SSRS
and i really have this problem but i didn't understand any thing Sad

Can any one help me and tell me in detail what to do
P.S. I Installed every thing and report works on my PC Without any experience and Knowledge !!Sad

Thanks
Jayanth_Kurup
Jayanth_Kurup
SSCertifiable
SSCertifiable (5.5K reputation)SSCertifiable (5.5K reputation)SSCertifiable (5.5K reputation)SSCertifiable (5.5K reputation)SSCertifiable (5.5K reputation)SSCertifiable (5.5K reputation)SSCertifiable (5.5K reputation)SSCertifiable (5.5K reputation)

Group: General Forum Members
Points: 5521 Visits: 1351
Could you try this and let me know what happens
Create a SQL account and grant it permsisions on the database.
Modify the connection string in the datasoruce for the report to use the SQL Authenticated account.(choose the option where credentials are stored securely on the report server).
If you have user accounts that should be able to access the report from another system , grant them permissions within SSRS Report manager and on the indivigual reports.

Jayanth Kurup
abdonabil
abdonabil
Forum Newbie
Forum Newbie (2 reputation)Forum Newbie (2 reputation)Forum Newbie (2 reputation)Forum Newbie (2 reputation)Forum Newbie (2 reputation)Forum Newbie (2 reputation)Forum Newbie (2 reputation)Forum Newbie (2 reputation)

Group: General Forum Members
Points: 2 Visits: 5
Thank you very much for reply

but the problem is that i can't even see the web page from the other PC
Go


Permissions

You can't post new topics.
You can't post topic replies.
You can't post new polls.
You can't post replies to polls.
You can't edit your own topics.
You can't delete your own topics.
You can't edit other topics.
You can't delete other topics.
You can't edit your own posts.
You can't edit other posts.
You can't delete your own posts.
You can't delete other posts.
You can't post events.
You can't edit your own events.
You can't edit other events.
You can't delete your own events.
You can't delete other events.
You can't send private messages.
You can't send emails.
You can read topics.
You can't vote in polls.
You can't upload attachments.
You can download attachments.
You can't post HTML code.
You can't edit HTML code.
You can't post IFCode.
You can't post JavaScript.
You can post emoticons.
You can't post or upload images.

Select a forum

































































































































































SQLServerCentral


Search