Analysis Services Double Hop Authentication

Recently we had a problem with Analysis Services double hop authentication. Thanks to the uber DBA guy here we were able to find a solution.
 
Thought I would share his write up (he spent a lot of time searching out a solution).
 
 
———————————————————————————————————————————-

 

As you know we have run into a problem with querying Analysis Services from another computer (our desktops for example) after connecting to a secondary server.

 

After working on this case with MS, we have an understanding of the problem and we have a solution.

The problem is the desktops not requesting Kerberos tickets from the domain controller. This is a bug in Kerberos dll and is fixed with a hotfix by Microsoft.

 

Solution:

1)     A Kerberos hotfix must be installed in our desktops.

Kerberos Hotfix canbe installed from (hotfix for IA64, x64, Win2003 also exist)

 

2)     The linked server from secondary server to target server (cubes) must be defined with Fully Qualified domain name.

 

I would like to specify a couple of more points here, since they are prerequisites for this double hop authentication to work.

 

1)     We need to define the servers with "Trust this computer for delegation to any service (Kerberos only)" in Active Directory as opposed to “Do not trust this computer for delegation”.

2)     We need to register the OLAP service with SPN as follows for the target server

a.     Setspn.exe -A MSOLAPSvc.3/CUBESSERVER USER\svc_db

b.    Setspn.exe -A MSOLAPSvc.3/CUBESSERVER USER\svc_db

 

Advertisements
This entry was posted in Uncategorized. Bookmark the permalink.

3 Responses to Analysis Services Double Hop Authentication

  1. Unknown says:

    Where can the hotfix be installed from? There is no link/location/hot fix ID in the article.

  2. Anthony Mallgren says:

    The hotfix can be downloaded from the site Jesse gave. Look for "Hotfix Download Available" in the upper left hand corner.

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s