SQL 2008 R2 Reporting Services Double Hop SPN setup

Posted on 2011-10-19
Last Modified: 2012-05-12
I'm a system admin and know just a little about SQL.  We just setup a SQL 2008 R2 reporting server that will connect to other SQL 2005/2008 databases to pull from.  I understand the concept of the "double hop slash kerberos" issue that exists, but I'm not 100% sure how to configure it.

Some articles say that you need to do the setspn command for the service accounts AND also change the attribute on the computer account.  Others say just the service account or just the computer account.  Also, do I need to do this for the service accounts just on the reporting server?  Or do I  need to also do this for the database servers that the reporting server will connect to?  My guess is that I just need to do this on the reporting server since that is the only server doing delegation or impersonation.

So my guess as to what I should do it this:

•setspn -a MSSQLSvc/SQL01:1433 acme\SqlReportingServices
•setspn -a MSSQLSvc/ acme\SqlReportingServices
•setspn -a http/RPTS01 acme\SqlReportingServices
setspn -a http/ acme\SqlReportingServices

Do I also need to set the computer account to "Trust this computer for delegation to any service"?  I've read that if you do it by machine you can't do load balancing, but we aren't doing that anyway.  
Question by:jpletcher1
    LVL 25

    Expert Comment

    You need to do it for data server. And yes you need to do setspn add. It is essential for this.
    Regarding Trust this computer for delegation to any service option, I am not aware of. I will talk with other folks, if someone else has any idea regarding it.

    Author Comment

    So it needs to be done both on the reporting server and and on the other database servers?  These articles make it sound like just the reporting server needs it..
    LVL 25

    Accepted Solution

    From the first link itself its clear that you require it in dataserver:

    Domain Functional Level is "Windows 2003".
    SQL Reporting Services and SQL Server (the database engine) are installed to different machines.
    Your domain is "".
    The account running SQL Reporting Services is "acme\SQLReportingServices" (it does not matter which account SQL Server is running under).
    SQL Reporting Services should NOT be run under a system account ("Local System" or "Network Service").
    Your SQL Server machine name is <b> "SQL01". </b>
    Your SQL Reporting Services machine name is <b> "RPTS01". </b>
    The SQL Server instance holding the database is running on the default port (1433).

    so the add spn you are doing is for the SQL01 not RPTS01

    Author Comment

    I'm sorry, you are correct.  Thanks for pointing that out.  

    If someone could verify if setting the computer account as well is necessary, and if so, is that on just the reporting service server or the database server or both?  Thanks!

    Author Closing Comment

    Thanks for the help.

    Featured Post

    How to run any project with ease

    Manage projects of all sizes how you want. Great for personal to-do lists, project milestones, team priorities and launch plans.
    - Combine task lists, docs, spreadsheets, and chat in one
    - View and edit from mobile/offline
    - Cut down on emails

    Join & Write a Comment

    Introduction: When running hybrid database environments, you often need to query some data from a remote db of any type, while being connected to your MS SQL Server database. Problems start when you try to combine that with some "user input" pass…
    How to use Variables  and Custom code in SSRS report and Assembly reference to use compile shared code in SSRS. Its big question for all who are working with SSRS. It is easy to create assembly and refer in SSRS report, still there are some steps…
    This video discusses moving either the default database or any database to a new volume.
    Polish reports in Access so they look terrific. Take yourself to another level. Equations, Back Color, Alternate Back Color. Write easy VBA Code. Tighten space to use less pages. Launch report from a menu, considering criteria only when it is filled…

    728 members asked questions and received personalized solutions in the past 7 days.

    Join the community of 500,000 technology professionals and ask your questions.

    Join & Ask a Question

    Need Help in Real-Time?

    Connect with top rated Experts

    22 Experts available now in Live!

    Get 1:1 Help Now