2

I am trying to enable Kerberos for MS SQL Server Reporting Services. I am fairly familiar with Windows security and how it works. However, I am new to Scale Out Deployment and Clustering of Windows Servers. I know I need to add SPNs that direct towards both SSRS web service (using a domain account) and to the database engine. I am a little confused on exactly how the SPNs should be structured. I have looked in Stack Overflow and other resources and most reference a standard deployment without scale-out/clustering.

My questions are:

  • Do I structure the SPNs to point to the node, the cluster, both?
  • How do I structure the SPNs for each?
  • Do I need to include ports?

I ran the Microsoft Kerberos Configuration Manager and the Reporting Services SPN shows "Unauthorized". I don't know what this means and I can't find documentation on the tool.

Kerberos Tool Result

Here are the details of my setup:

Domain: clearwd (not my actual domain)

Server OS: Windows Server 2016

Cluster: DEV-CLUSTER

Node 1: DEV-SQL1

Node 2: DEV-SQL2

Role: DEV-CLUSTER1 (SQL Server / MSSQLSERVER)

SQL Server Version: 2016 Enterprise

SQL Server Name: DEV-CLUSTER1

SQL Server Port: 1433

SSRS Service Account: ssrsuser.clearwd.com OR clearwd\ssrsuser

SSRS Mode: Native

SSRS Report Server Web Service URL: http://DEV-SQL01:80/ReportServer

SSRS Web Portal URL: http://DEV-SQL01:80/Reports

Let me know if any other information is needed.

References:

https://www.itprotoday.com/sql-server/implement-kerberos-delegation-ssrs-0

https://docs.microsoft.com/en-us/sql/reporting-services/report-server/register-a-service-principal-name-spn-for-a-report-server?view=sql-server-2017

https://docs.microsoft.com/en-us/sql/reporting-services/install-windows/configure-report-server-urls-ssrs-configuration-manager?view=sql-server-2017

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.