The request failed with HTTP status 401: Unauthorized

The request failed with HTTP status 401: Unauthorized
Rating
Saving...Sign in to Rate!                      Overall by 1 users Validation
0/0
(yes/no)
View Workarounds
0
workarounds
View
--------------------------------------------------------------------------------
Type Bug ID 323214
Status Resolved (Fixed) Access Restriction Public
Opened By mivchik Blocking Issue No
Opened 1/21/2008 Submission Language English
Resolved 2/8/2008 9:38:41 AM  

--------------------------------------------------------------------------------

DescriptionRSReportServer.config file stores settings that are used by Report Manager, the Report Server Web service, and background processing.
This file contains Autentification area which specifies one or more authentication types accepted by the report server.
Some our reports need access to external data sources with credentials of user who runs the report, so we need Kerberos authentication - RSWindowsKerberos .
We modified Autentification area in RSReportServer.config file

<Authentication>
     <AuthenticationTypes>
         <RSWindowsKerberos/>
         <RSWindowsNTLM/>
     </AuthenticationTypes>
     <EnableAuthPersistence>true</EnableAuthPersistence>
</Authentication>

When administrator opens report manager site he gets message “The request failed with HTTP status 401: Unauthorized”.
The same behavior is noticed with only <RSWindowsKerberos/> parameter without RSWindowsNTLM.

With <RSWindowsNegotiate/> parameter administrator gets enter login/password window and after entering them he is prompted again for them.

With only <RSWindowsNTLM/> everything works fine:
<Authentication>
     <AuthenticationTypes>
         <RSWindowsNTLM/>
     </AuthenticationTypes>
     <EnableAuthPersistence>true</EnableAuthPersistence>
</Authentication>

In the same network Domain is situated Reporting Server 2005. It works fine with Kerberos and allows double-hop authentication to external data sources.
CommentsMost likely the problem is that the RS service is running as a domain account and an SPN must be registered for that account. The easiest workaround is to run RS as NetworkService. If you must use a domain account, then note that if IIS is running on the same machine then RS must use the same account as IIS. If you do not need IIS on the same machine, then you should use the setspn.exe utility to register a SPN (requires domain administrator privileges). The syntax for setspn is:

setspn –A http/MyHostName MyDomain/MyRSAccount
setspn –A http/MyHostName.Mydomain.Mycorp.com MyDomain/MyRSAccount

Hope this helps,
Albert
Posted by Microsoft on 1/24/2008 at 9:29 AM
We have modified setup to disable Negotiate authetication when a domain account is chosen as the service account. You can re-enable Negotiate by editing the RSReportServer.config file once a SPN has been configured.

This change will appear in a future CTP.

Thanks,
Albert
Posted by Microsoft on 2/11/2008 at 11:36 AMProduct LanguageEnglishVersionSQL Server 2008 November CTPCategoryReporting ServicesOperating SystemWin2003 Enterprise Server (SP2)Operating System LanguageUS EnglishSteps to ReproduceLook the descriptionActual ResultsWhen administrator opens report manager site he gets message “The request failed with HTTP status 401: Unauthorized”. Expected Resultsopens report manager site without errorsPlatform X64This entry is for the SQL Server 2008 February CTP Bug Bash Contest (read Official Rules here)!File Attachments0 attachments Attached Files: