SSRS SQL Reporting Double Hop (aka Negotiate / SPNego / Kerberos/ SSO) ANONYMOUS LOGON Issues

#DoubleHop #ANONYMOUSLOGON #Kerberos
This video is here to save your time and hair before you need to put them all out :). Feel free to speed up the video or jump to a section you're interested.
Clients e.g. PCs --- "SQL Server A (Hop 1)" with SSRS ---- "SQL Server B (Hop 2)" contains DBs where your SSRS data sources are pointing to.
If your SSRS setup similar to above. you're likely running into a common SQL Database and/or Reporting Service Double Hop (aka Negotiate / SPNego / Kerberos/ SSO) issue which Developers/Programmers and IT Admins are facing, the common error will be "NT AUTHORITY\ANONYMOUS LOGON" and solution is straight forward but the catch is not every Application/Command/Script support it. Some may require 3rd party add-ons/modules if they don't have native support. PowerShell and Browsers support it natively and have no issues with it. Enter credentials for each data source is the workaround for applications/scripts which don't support it.
************ [ Browsers' Integrated Authentication ] ************
HKLM\Software\Policies\Google\Chrome
Name: AuthNegotiateDelegateWhitelist
Type: REG_SZ (String Value)
Data: *.DOMAIN_NAME;[SSRS_HOST_NAME_1];[SSRS_HOST_NAME_X]
HKLM\SOFTWARE\Policies\Microsoft\Edge
Name: AuthNegotiateDelegateAllowlist
Type: REG_SZ (String Value)
Data: *.DOMAIN_NAME;[SSRS_HOST_NAME_1];[SSRS_HOST_NAME_X]
************ [ +++++++++++++-----------+++++++++++++ ] ************
Please feel free to reach out for questions. I may even able to help you remotely for a reasonable reimbursements. Cheers
If you think this is helpful or would like to support his channel. Buy me a coffee ☕ via the link below, ta~
☕ Coffee: www.buymeacoffee.com/beancurd
Tools to make this video
OBS Studio: obsproject.com/
Shotcut: shotcut.org Gain/Volume +18.5dB
Canva: www.canva.com/

[@citizenearth3324]

Awesome

[@wilsoncheng1722]

Thanks

[@sabina1262]

Is it possible to set the kerberos authentication if you dont use domain service account? in our case we use OS virtual accounts for the MSSQL and SSRS.

[@wilsoncheng1722]

It's not possible with virtual accounts which are not trusted by the domain controller and you won't get Kerberos Ticket which is required to be passed to another SQL server for authentication.