I finally got Kerberos delegation working to display a double-hop report on our SPF 2010 test server.
The report displays fine, gets the data.
The problems are:
1) I had only Windows authentication enabled for the Default Web Site and the SharePoint - 80 site -- additionally enabling asp.net impersonation for the authenticated user worked within the SPF server per se but not on any clients, which then refuse to let me see the reports, giving this error message:
-
An error has occurred during report processing. (rsProcessingAborted)
-
Cannot create a connection to data source 'EMPOWERDATA'. (rsErrorOpeningConnection)
-
Login failed for user 'NT AUTHORITY\ANONYMOUS LOGON'.
If I turn off asp.net impersonation the reports work but it's very clear by using Report Builder's ability to show the 'logged-in' user on the report that it's the sp_serviceapps account logged in and using the report when we really should see the existing domain user?? This is how the delegation is configured btw, this account has the spn and then the 2nd hop is to the SQL server containing the report data.
I need to know how Impersonation should be configured -- I had it to 'authenticated user' -- should it be to a specific user??
-
My understanding is that 'authenticated user' is whoever is the Windows user using the SharePoint site, am I incorrect?? Or do we need to find/use some other way to set permissions etc. for viewing reports??
Thank you, Tom
-
Login failed for user 'NT AUTHORITY\ANONYMOUS LOGON'.
-
Cannot create a connection to data source 'EMPOWERDATA'. (rsErrorOpeningConnection)