Configuring Security for SSRS in SharePoint Mode (Part II)

This blog is part of Series : Comprehensive SharePoint 2013 Development Environment Installation and Configuration

Overview

This blog article discusses how to configure security for SSRS in SharePoint mode install and configure SSRS Service Application in SharePoint Mode (Which is this Part II) assuming you have followed the previous blog on how to Install and Configure SSRS in SharePoint Mode.

There is more to it when it comes to actually being to deploy and run the SSRS reports under the SharePoint hood that is relating to Security. Since the default security provide for SharePoint 2013 Web Applications is Windows provider for Claims. When an SSRS Reports needs to run on the SharePoint page, we have various options to configure the underlying SSRS Data Source(s) and security. In either case the authentication from SharePoint Farm (SSRS Service within the SP Farm) to the underlying data source will need to happen. Since the account in question is maintained as Claim within the context of SharePoint Farm, while the SSRS data  source(s) within the Windows network Server recognize Windows account principle, we will need to convert our Claim account to Windows account and send it across the server (Double hop) ( I think you get the gist and a hint at Kerberos!) .

We will need to ensure Claims to Windows Token Service (C2WTS) is running on SharePoint servers.

Then we will need to configure Constrained Delegation on the  C2WTS account.

Switch Reporting Service application to Kerberos

Switch our Web Application where the SSRS reports will be deployed to Kerberos

Configure necessary SPNs

My References:

http://technet.microsoft.com/en-us/video/Video/hh858469

http://blogs.technet.com/b/sharepoint_-_inside_the_lines/archive/2013/05/28/sharepoint-2013-with-ssrs-2012-and-constrained-delegation.aspx

Steps

Create or ensure following Service Accounts (Described under this blog “Service Accounts Preparation ”)

Register new Service accounts as Managed Service account within your SharePoint Farm

Provision Service account for SSRS Service

May be already done if followed the “Installing Reporting Services In SharePoint Mode (Part I) “.  From CA, Security>General Security>Configure service accounts

Provision Service account for Claims to Windows Token Service on all SharePoint Servers

C2WTS Service

Validate on the Windows Services on all SharePoint servers under the Services Console that now the Lon On As account is changed from Local System to our domain account

SSRS Security

On the APP1 Server (Where SSRS Service is running) update Authentication from Windows to Negotiate (Kerberos). Access the Report Server Configuration file by following below path:

Before

After

Get the SSRS Service account Access to the Web Applications.

Example for Portal Web App, from any SharePoint server, run SP PowerShell as administrator

On the Server where PerformancePoint will run the check for C2WTS Windows Service account

Ensure that C2WTS is in local admin

Configure Local Security Policy

Check Local Security Policy on the APP1 to ensure your CORP\SPC2WTS account is added:

Local Policy>User Rights Assignment

• Act as part of OS (SPC2WTSService)
• Impersonate a client after authentication
• Logon as service

Restart Windows Service C2WTS

Add the WSS_WPG Windows Group to the c2wtshost.exe.config file.  The file is located \Program Files\Windows Identity Foundation\v3.5\c2wtshost.exe.config

From your Local Groups

IIS Reset

Ensure SQL Server for Kerberos Delegation

Register SPN for SQL Server Service Account and the SSRS Service account

Setspn -S HTTP/portal corp\SPPortal
Setspn -S HTTP/portal.mydomain.com corp\SPPortal
Setspn -S MSSQLSvc/DC:1433 corp\sqlservice
Setspn -S MSSQLSvc/DC.corp.mydomain.com:1433 corp\sqlservice
Setspn -S SP/C2WTS corp\SPC2WTS
Setspn -S SP/SSRS corp\SPSSRS
Setspn -S SP/PPS corp\SPPerfPointUser
Setspn -S SP/Excel corp\SPExcelUser

Run ADUC to, ensure Advanced Feature

Check SQLService account Attribute for SPN

Configure Delegation for SPC2WTS

From the ADUC, access SPC2WTS account and switch to Delegation

Select SQL Server service with Port 1433 or whatever you have designated for your SQL Server.

Let's switch the Web Application Authentication to Kerberos

From CA>Manage Web Applications> Select your web app and chose Authentication providers

This completes the configuration. In the next blog lets create an example SSRS, Deploy to SharePoint and test.

Test Connection: Coming soon…