0

Configuring Kerberos Delegation for Named Instances of SSAS with Active Directory and Additional Problems When Using Constrained...

By Ian MacDonald

Hi,

There is some additional documentation required for when customers want to access remote SSAS servers that are using a named instance. There is an additional issue where Constrained Delegation is concerned.

1. In order to access a named instance of SQLServer, an additional SPN has to be created of the form MSOLAPDisco.3/servernamedetails. This allows connection to the SQLServer Browser Service that will determine the port of the specified instance. The Browser service must be configured to be running (default is stopped). The MSOLAPSvc.3/Servernamedetails SPN requires the instance name to be added following a colon thus:

MSOLAPSvc.3/Servernamedetails:instancename

This is detailed in the Microsoft Technote: http://support.microsoft.com/kb/950599

2. If you are using constrained delegation in conjunction with Windows Server 2003, there is a bug in the Add Constrained Delegation dialogue that means the named instance SPN does not appear in the list valid SPNs for the account or machine. It seems the dialogue valiadates the SPNs before displaying them and incorrectly determines the named instance string as invalid. This is explained in MS Technote http://support.microsoft.com/kb/936628 together with a description of a workaround to the problem.

3. Pyramid cannot connect from a client machine to a named instance of analyses server.
In the case of a named instance and a non-default port you would need to set another SPN.
For more info try this article.

Reply Oldest first
  • Oldest first
  • Newest first
  • Active threads
  • Popular
Like Follow
  • 3 yrs agoLast active
  • 884Views
  • 1 Following