[Webinar] Streamline your web hosting managementRegister Today

x
  • Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 7233
  • Last Modified:

SQL Reporting Services login prompt on remote access to ReportManager

I have SQL 2005 Reporing Services installed with IIS on a machine running Windows Server 2003. The Reporting Services db is on another machine. If I browse to http://srsserver/reports from the srsserver itself it displays the report manager. If I browse to the same url from any other machine on the domain I am prompted for login credentials. And I am ultimatedly denied access regardless of the user I try to login as. Is there some setting for remote access that I have configured improperly? Can someone help me figure out what's going on here? Thanks.
0
Paracom_Inc
Asked:
Paracom_Inc
  • 7
  • 5
  • 3
  • +3
4 Solutions
 
zx10rCommented:
Is your IIS Security setup to use Integrated Windows Authentication.

Also, have you assigned permissions to domain logins on the report server?
0
 
rickchildCommented:
Ensure that the comain account you are using has been given Content Manager permissions to the root folder in ReportManager.  You could do this manually, or by making the user a member of local admins on the target machine.

Also your reporting services installation should be running as a Domain Service account if it is set up with the default of Local System Account or "NTAuthority\NetworkService".

You can change this in the Reporting Services Configuration in "Windows Service Identity" (Not in Admin Tools -> Services as the key encryption won't like that.)  Be sure to back up your key before making any changes.
0
 
rickchildCommented:
Any chance of a screen shot of the login, just so I can see if it looks like a SSRS prompt or something else?
0
Get your problem seen by more experts

Be seen. Boost your question’s priority for more expert views and faster solutions

 
jgvCommented:
Just came across these links provided by dbaSQL in another thread. Both deal with configuring security for reporting services and may help with your situation.

Configuring Authentication for Reporting Services
http://msdn.microsoft.com/en-us/library/bb283249.aspx

Configuring Report Server Virtual Directories
http://technet.microsoft.com/en-us/library/ms159261.aspx
0
 
Paracom_IncAuthor Commented:
I am using Integrated Windows Authentication. I am logged on to my workstation using my domain user account. I am a member of the BUILTIN\Administrators group for the report server. Just to be sure, I made my domain user account a member of the Content Manager role using the Report Manager (from the report server itself). The Reports and ReportServer applications in IIS on the report server are configured to use an application pool that uses a domain administrator as its identity. The SQL Server Reporting Services service uses this same domain administrator account.

The attached file shows the login prompt I am receiving and also the 401 error page I get after the login fails.
login.doc
0
 
Paracom_IncAuthor Commented:
I reviewed the links in jgv's post, but found nothing that resolved the problem. Incidentally, If I try to deploy reports to the report server from another machine I am also prompted to login, though this time it is a Reporting Services Login dialog. I am unable to successfully login under these circumstances either. Any ideas?
0
 
rickchildCommented:
Might be worth a cross post to another Zone, as from the screenshot it looks more of an IIS authentication issue?
0
 
jgvCommented:
In IIS, make sure that you have Anonymous access enabled on the web site hosting reporting services. Below the web site, both ReportServer and Reports should have Anonymous access unchecked and Integrated Windows authentication checked.

By any chance, have you renamed the IIS server since installing SSRS?
0
 
zx10rCommented:
What options are checked in  IIS Authentication Method window under Directory security?

And is realm and domain box filled out?
0
 
Paracom_IncAuthor Commented:
The web site hosting reporting services has Anonymous access enabled. The ReportServer and Reports virtual directories have Anonymous access unchecked and Integrated Windows authentication checked. Only Integrated Windows authentication is checked for the host web site and the virtual directories. The Default domain and realm textboxes are grayed out and empty. I have not renamed the server since installing SRSS.
0
 
zx10rCommented:
Anonymous access should NOT be checked! Integrated authentication and digest authentication should be checked. Also since you are in the domain, realm box should be equal to that of your domain.
0
 
jgvCommented:
This is a forum thread with a number of suggestions on dealing with a login prompt during report deployment. It's a long shot but you may find something useful....not sure what else to suggest.
http://forums.microsoft.com/technet/showpost.aspx?pageindex=1&siteid=17&postid=1675815&sb=0&d=1&at=7&ft=11&tf=0&pageid=0
0
 
Paracom_IncAuthor Commented:
zx10r,
Do I really need digest authentication? The report server and the machine I'm trying to reach it from are not only in the same domain, they are on the same lan with no firewall between them. I'd prefer not to have to have passwords passed in clear text?
0
 
Paracom_IncAuthor Commented:
I have noticed that if I leave the app pool identity set to Network Service it works properly and I don't get prompted for credentials. Perhaps the domain user that I am using as the app pool identity needs different permissions. Is there someplace that lists the permissions required for the identity of an app pool in which reporting services is running?
0
 
zx10rCommented:
You can get rid of digest authentication if you want. See if that eliminated the login prompt.
0
 
Paracom_IncAuthor Commented:
I was never using digest authentication. I was just asking if you thought it was necessary. Thanks.
0
 
zx10rCommented:
You can get rid of it. Are you still having problems?
0
 
Paracom_IncAuthor Commented:
Yes. I am not using digest authentication and I'm still having the same problem.
0
 
dcoluzziCommented:
I had the same problems you did and I found this on the M$ site:

http://technet.microsoft.com/en-us/library/ms180127.aspx

This basically explains that you either have to set the identity to the Network Service account or you have to manually set the correct SPN on the domain account.  Instructions for manually setting the SPN are here:

http://technet.microsoft.com/en-us/library/ms180127.aspx

"Note that if you use a domain service account and your domain is configured for Kerberos authentication, you might encounter HTTP 401 access denied errors if you did not create a Service Principal Name (SPN) that registers the domain account for the Web site. Be sure that the domain account that you register is the same one used for the application pool. For more information, see Configuring Constrained Delegation for Kerberos (IIS 6.0) on the Microsoft TechNet Web site."

Hope this helps.

0
 
furqan_trakkerCommented:
Stand on Installation Server where you have access reporting services 2005 then come to properties
and add role

domain\accountname

click on required check boxes

when you will use again from remote then give same domain user id and password

0

Featured Post

Free Tool: Path Explorer

An intuitive utility to help find the CSS path to UI elements on a webpage. These paths are used frequently in a variety of front-end development and QA automation tasks.

One of a set of tools we're offering as a way of saying thank you for being a part of the community.

  • 7
  • 5
  • 3
  • +3
Tackle projects and never again get stuck behind a technical roadblock.
Join Now