September 28, 2007 at 7:05 am
I am using linked server to connect to our production database in order to retrieve some records for a report. I am using SQL 2005 Reporting service. The report displays on the host server but when access the report frrom another machine I receive this error:
An error has occurred during report processing.
Query execution failed for data set 'GVRPTconn'.
For more information about this error navigate to the report server on the local server machine, or enable remote errors
Where do I look to correct this error?
September 28, 2007 at 7:30 am
You probably have a security issue. Since you are not getting the error from a local browser and you are using a linked server, you most likely are getting a Kerberos error from your NT authentication.
When using NT authentication, your login token will only be good for a couple of jumps from server-to-server. This was done by MS to prevent worm attacks from going all over your network with a single NT token.
You can either configure your SQL server as a Kerberos server to it issues the token (which can jump as many times as you let it), or change your linked server to use SQL authentication.
The easiest way to test my theory is to change the linked server to use SQL authentication. If this works, you can either leave it that way, or get your network configuration set up correctly to work with the linked server configuration you want.
September 28, 2007 at 5:00 pm
Thanks for the response.
While surfing the Net to find answers to this question, I did find out that it is a Security Account Delegation issue. One site gave this query
Select auth_scheme
From sys.dm_exec_connection
Where session_id = @@spid
Running the query from client to linked server result is Kerberos. Same query from Linked Server to production the result is NTLM. So from client to linked server it is ok , bu t the second jump is not working. How do I go about setting the linked server to Kerberos?
September 29, 2007 at 7:05 am
If you have a network admin around, this is the time to discuss it with them. This gets into configuration of your NT domain or Active Directory.
October 5, 2007 at 4:43 am
Make sure the service account you are using to run Reporting Services server has SPNs setup correctly and is enabled for "deligation". Also you will need to setup SPNs on the service account that's running your SQL service
SPN e.g.
HTTP/hostname:port #
HTTP/hostname.internal.domain.com
Hope this help
Murad Akram
Viewing 5 posts - 1 through 4 (of 4 total)
You must be logged in to reply to this topic. Login to reply