December 19, 2007 at 9:53 am
Has anyone had the following error message after installing SSRS 2005?
Logon failure: the user has not been granted the requested logon type at this computer. (Exception from HRESULT: 0x80070569)
I've searched quite a few places and I've followed all the solutions suggested but I still cannot solve the problem. The user that runs both the RS and SQL Server services has permission to log onto both the web server and the database server.
Any suggestions would be greatly appreciated.
December 26, 2007 at 10:49 am
Hi Ben,
Can you provide the following details.
What edition of RS 2005 installation do you have?
Is you ReportServer database local or remote? I am assuming it is Remote based on your post.
It may also happen that the logon credentials that you are using are not being passed through to the database server. This is typically the case when a user is able to logon independently to 2 different computers(servers) but is not able to access one through the other.
Example: Login to a web application and execute a database query through impersonation.
In this case, try to use Basic authentication if your network is not setup for Kerberos.
To set your Reporting Services environment in Basic Authentication mode, go to IIS and select Basic Authentication in the Directory Security tab for both Reports and ReportServer virtual directories under the default website.
December 27, 2007 at 2:11 am
Sarit,
Thanks for you reply. I've installed RS 2005 Standard edition and yes, you're correct, I'm running the RS on a different server to where the database is stored. I did try your suggestion to switch both directories to basic authentication but that didn't work. I'm still getting the exact same problem. 🙁
December 28, 2007 at 6:32 am
If RS web site and data reside on different servers, you need to set up Kerberos. This will allow the credentials to be passed from machine to machine.
A domain admin is needed to setup the endpoints.
Greg E
December 28, 2007 at 7:08 am
Greg,
I have checked and Kerberos is setup on our network.
December 28, 2007 at 7:40 am
Kerberos can be setup on the network, but endpoints for the services and machines are a separate setup.
Did you verify that the machines involved are allowed to delegate?
And that all the endpoints are setup?
There's a utility called setspn that is very helpful (think it's part of the W2003 resource kit) to verify what's setup.
You will need to make sure IIS, SQL, and Analysis services if you are using it, all are setup
I'm out of the toffice today, so I might not be able to reply right away.
A good clue that not all is right - you will see an event in the security log on the SQL server where IIS is using Network Service to try and access data.
I run the IIS Application pool for RS under a separate domain user account rather than network service.
Greg E
December 28, 2007 at 8:01 am
Greg,
Thanks for your help. I can't do anything about setting up the end points etc until the new year as the network administrator isn't back until then. But I did check the security log on the SQL server when I tried to view a report and got the error, no new security log events were created on the SQL server?!
I checked the config of the application pool that the 2 RS sites run under and it was running under the network service account. I changed it to a domain account that is a member of the administrators group on the web server and now when I try to access either of the RS websites I get prompted for my windows logon details and after 3 times (although I'm entering my details correctly) I get a "you are not authorised to view this page" message.
December 28, 2007 at 8:32 am
Please do a search for kerberos and sql server on microsoft's site and review some of the setup.
This might be a good start.
http://support.microsoft.com/?kbid=319723
There are a number of steps, and it requires a domain admin to set the endpoints.
Get familiar with setspn. It can list the setup for the computers involved - what services / ports, as well as the domain account being used.
The domain account will need to be setup to delegate in AD, as well as the servers.
I always do a reboot after making the changes to make sure they take.
I'm sure after reading the documentation, you'll see some missing pieces.
Note - there are some differences in the endpoints and setup options based on W2000/W2003, and SQL 2000 vs SQL 2005
Greg E
January 1, 2008 at 4:38 pm
Please try this.
Open the web.config file in the ReportServer directory.
After the tag, add the following.
Let us see if that works.
I don't think that it is required to install Kerberos in your case.
However, in general I agree with the other authors on their views on Kerberos.
January 2, 2008 at 1:39 am
Sarit,
For some reason I cannot see the tag you have posted. Could you post it again?
Thanks.
January 4, 2008 at 3:11 pm
< identity impersonate = "true" />
January 14, 2008 at 4:20 am
That tag is already in the config file. I've had the network admins check all the settings on both servers and everything seems correct. Does anyone have any other ideas?
January 14, 2008 at 9:32 am
Ben -
Take a look at the security logs on all the servers involved. You should see a failure, and it might not be on the server you expect. It could easily be on the database server.
If RS is running under a domain user, like when Kerberos is being used, is the error for the domain user account, or ASPNet account?
Thanks, Greg E
January 14, 2008 at 9:45 am
Ben -
Save this script as an .asp file (after changing the server - I'd use the Fully Qualified Name of your SQL Server) and host it on the same web server as your RS site.
Run in it's own application pool, under the domain user you are using for Kerberos. I usually just make this the default.asp page for my site.
Use your web browser from your client, and access the page.
Assuming you are admin on your SQL Server, if things are setup, it should return a list of db's on your server.
Hope this helps.
Greg E
Connections string is
<%
set rs = Server.CreateObject("ADODB.Recordset")
set cn = Server.CreateObject("ADODB.Connection")
cn.Open "Provider=SQLOLEDB.1;Integrated Security=SSPI;Persist Security Info=False;Initial Catalog=model;Data Source=***YourSQLServerHere***"
rs.open "MASTER..sp_helpdb",cn
Response.Write cstr(rs.Fields.Count) +"
"
while not rs.EOF
Response.Write cstr(rs(0))+"
"
rs.MoveNext
wend
rs.Close
cn.Close
set rs = nothing ' Frees memory reserved by the recordset.
set cn = nothing ' Frees memory reserved by the connection.
%>
Viewing 14 posts - 1 through 13 (of 13 total)
You must be logged in to reply to this topic. Login to reply