I am trying to enable Kerberos for MS SQL Server Reporting Services. I am fairly familiar with Windows security and how it works. However, I am new to Scale Out Deployment and Clustering of Windows Servers. I know I need to add SPNs that direct towards both SSRS web service (using a domain account) and to the database engine. I am a little confused on exactly how the SPNs should be structured. I have looked in Stack Overflow and other resources and most reference a standard deployment without scale-out/clustering.
My questions are:
- Do I structure the SPNs to point to the node, the cluster, both?
- How do I structure the SPNs for each?
- Do I need to include ports?
I ran the Microsoft Kerberos Configuration Manager and the Reporting Services SPN shows "Unauthorized". I don't know what this means and I can't find documentation on the tool.
Here are the details of my setup:
Domain: clearwd (not my actual domain)
Server OS: Windows Server 2016
Node 1: DEV-SQL1
Node 2: DEV-SQL2
Role: DEV-CLUSTER1 (SQL Server / MSSQLSERVER)
SQL Server Version: 2016 Enterprise
SQL Server Name: DEV-CLUSTER1
SQL Server Port: 1433
SSRS Service Account: ssrsuser.clearwd.com OR clearwd\ssrsuser
SSRS Mode: Native
SSRS Report Server Web Service URL: http://DEV-SQL01:80/ReportServer
SSRS Web Portal URL: http://DEV-SQL01:80/Reports
Let me know if any other information is needed.