Reports won't run from client computers but works fine from Report Server

Question

Reports won't run from client computers but works fine from Report Server

Steve Smith-163358

SSCommitted

Points: 1750
More actions
September 18, 2012 at 7:53 am

#262024

Hi,
I've written my first report in SSRS 2008R2.
It previews fine in Business Intelligence Dev Studio, and deploys without any problems.
If I open Internet Explorer on the Report Server itself, I can view the report without any problems.
The problem comes when I try to run the report in Internet Explorer on another machine.
I've enabled Remote Errors, and receive a 'Login Failed for user DOMAIN\DomainUser' error.
I've tried changing the security using a few different methods.
I've set Windows Authentication, and have tried specifying my own Windows Account in the Report.
But always with the same error.
If I set a different account in the Data Source to connect to the report, then that is the error that appears in the 'Login Failed for user' error message.
My domain account is able to run the query in SSMS, and works perfectly if I run the report on the Report Server.
From other forum posts I've read, it appears that it is to do with the fact that my Report Server is on a different server to the SQL Server hosting my data.
I've seen a number of 'potential' solutions, but nothing that I've understood or been able to follow.
Can you please give me some information on how to run a report, using Windows Authentication, when the Report Server is on a different Server to the SQL database.
Thanks for your help.

Viewing 11 posts - 1 through 10 (of 10 total)

You must be logged in to reply to this topic. Login to reply

GSquared SSC Guru Points: 260824 More actions · Answer 1

Does the report require the user to have Windows authentication, or does it run under the SSRS account? If the user-account, then what you're probably running into is what's called a double-hop error.

Windows authentication can only pass from one machine to one machine. It can't hop from client to SSRS to SQL. Kerberos is the way that's usually worked around.

You'll want to get with a Windows and network admin to work out how to implement a solution. Do you have one available, or are you stuck wearing that hat yourself? (Some DBAs are, of course.)

- Gus "GSquared", RSVP, OODA, MAP, NMVP, FAQ, SAT, SQL, DNA, RNA, UOI, IOU, AM, PM, AD, BC, BCE, USA, UN, CF, ROFL, LOL, ETC
Property of The Thread

"Nobody knows the age of the human race, but everyone agrees it's old enough to know better." - Anon

Steve Smith-163358 SSCommitted Points: 1750 More actions · Answer 2

Hi GSquared,

Thank you very much for your assistance with this.

I do have a network admin that I can liaise with, but any changes to the SSRS server will be down to me.

I've read about the different authentication options within the RSReportServer.config file.

Given that we'll have to be using Kerberos for authentication, would I be right in assuming that I need to change the AuthenticationTypes tab to RSWindowsKerberos as the first step of this?

Thanks for your help

GSquared SSC Guru Points: 260824 More actions · Answer 3

I'd have to get a network admin to answer that. I know just enough about Kerberos to know when it's being a problem, but not enough to solve it.

- Gus "GSquared", RSVP, OODA, MAP, NMVP, FAQ, SAT, SQL, DNA, RNA, UOI, IOU, AM, PM, AD, BC, BCE, USA, UN, CF, ROFL, LOL, ETC
Property of The Thread

"Nobody knows the age of the human race, but everyone agrees it's old enough to know better." - Anon

sql007 Say Hey Kid Points: 680 More actions · Answer 4

I had the same problem, gave the user the access to where the ssrs is installed as an admin(on the machine) and it worked fine.

DMarvez Ten Centuries Points: 1241 More actions · Answer 5

Hello,

When SSRS components are loaded on a server other than the DB server and you are using Windows authentication for the reports, you'll run into the 'Double Hop', 'Kerberos' issue.

Couple of things you'll need to resolve this.

Have your domain admin set the SPN's (Service Principal Name) for the domain users running both the SQL Server and SSRS services.

We make sure we inlcude the SQL Ports in our entries.

Once the SPN's have been set, you'll need to have them update AD to allow these same users delegation.

Under Delegation - Check off 'Trust this user for delegation for any service(Kerberos Only)'

Under Account - Confirm that the following option is not selected: Account is sensitive and cannot be delegated.

Update the RSReportServer.config file as such(Partial copy):

Our notes have a reboot of the servers afterwards.

Lot's of info in SSC and on-line regarding this and SPN's and delegation which should help you out.

DMarvez Ten Centuries Points: 1241 More actions · Answer 6

This appears to be an easier way to set SPN"s for the service account.

http://www.expta.com/2010/02/allowing-service-account-to-manage-its.html

abdonabil Grasshopper Points: 10 More actions · Answer 7

Please Every one

I'm very New In SSRS

and i really have this problem but i didn't understand any thing 🙁

Can any one help me and tell me in detail what to do

P.S. I Installed every thing and report works on my PC Without any experience and Knowledge !!:(

Thanks

Jayanth_Kurup SSC-Insane Points: 22967 More actions · Answer 8

Could you try this and let me know what happens

Create a SQL account and grant it permsisions on the database.

Modify the connection string in the datasoruce for the report to use the SQL Authenticated account.(choose the option where credentials are stored securely on the report server).

If you have user accounts that should be able to access the report from another system , grant them permissions within SSRS Report manager and on the indivigual reports.

Jayanth Kurup[/url]

abdonabil Grasshopper Points: 10 More actions · Answer 9

Thank you very much for reply

but the problem is that i can't even see the web page from the other PC

Jayanth_Kurup SSC-Insane Points: 22967 More actions · Answer 10

Have you checked the port number .The rport manager URl can be found in the reportig services configuation manager . If you look there will be a port number assigned to it. Make sure to copy paste the URL as it is into the remote machine browser.

Jayanth Kurup[/url]