Setting up SSRS with a Domain user as an application pool account

Configuring Kerberos is an advanced task and should only be performed by an appropriately trained professional. The steps and configurations given in this help file are to be used as a guide - your system may require additional configuration due to different hardware and software compatibilities.

Perform the steps below to configure SSRS for a Domain user application pool account:

Create a HTTP SPN for the NetBIOS and FQDN under the Application pool account name (Use either SetSPN or ADSI Edit)

Secondly update the following node in the C:\Program Files\Microsoft SQL Server\MSRS10.MSSQLSERVER\Reporting Services\ReportServer\rsreportserver.config:

Copy Existing Code
<AuthenticationTypes> <RSWindowsNegotiate /> </AuthenticationTypes>

The changes to the code are below:

Copy Changes Required
<AuthenticationTypes> <RSWindowsNegotiate /> <RSWindowsKerberos /> <RSWindowsNTLM /> </AuthenticationTypes>

Verify that the following have been set in the following location:

C:\Program Files\Microsoft SQL Server\MSRS10.MSSQLSERVER\Reporting Services\ReportServer\web.config

Copy Changes Required
<configuration> <system.web> <authentication mode="Windows" /> <identity impersonate="true" />

Additional Resources

For additional information see the following resource: How to: Configure Windows Authentication in Reporting Services

While infrastructure changes are required by K2, each environment is different and has its peculiarities which must be taken into account. Modifying the infrastructure could have unforeseen results if the changes are not appropriately understood or managed. Given the broad spectrum of underlying infrastructure utilized, it is recommended that a panel or committee with appropriate skill in each area concerned be assembled to outline the underlying infrastructure changes and gauge the impact of the required changes.