Answered by:
Cross Forest Authentication Issues with SQL Reporting

Question
-
I setup CRM 4.0 in one domain with a domain service account. SQL Reporting is located on the same machine using the same account. SQL is on a different machine. These are in the same single domain forest which has a two way trust relation with another domain of a separate single domain forest. Both domains are W2k3 Native Mode.
The CRM application allows access to users in both domains. The reports are generated with accounts in the first domain where CRM and SQL Reports is located but not for users in the other domain. The report's window displays "The report cannot be displayed."
The following are events that are related to the error:
On CRM server:
Event Type: Warning
Event Source: ASP.NET 2.0.50727.0
Event Category: Web Event
Event ID: 1309
Date: 5/13/2008
Time: 6:55:19 AM
User: N/A
Computer: CRMSERVER
Description:
Event code: 3005
Event message: An unhandled exception has occurred.
Event time: 5/13/2008 6:55:19 AM
Event time (UTC): 5/13/2008 1:55:19 PM
Event ID: cc4c29c8f4be4e82ac0eee1234a15dc6
Event sequence: 77
Event occurrence: 1
Event detail code: 0
Application information:
Application domain: /LM/W3SVC/2/ROOT-1-128551603464644692
Trust level: Full
Application Virtual Path: /
Application Path: C:\Program Files\Microsoft Dynamics CRM\CRMWeb\
Machine name: CRMSERVER
Process information:
Process ID: 3340
Process name: w3wp.exe
Account name: CRM Service Account
Exception information:
Exception type: CrmReportingException
Exception message: An error has occurred during report processing. (rsProcessingAborted)
Request information:
Request URL: http://CRMServer:5555/OrganizationDev/CRMReports/rsviewer/reportviewer.aspx
Request path: /OrganizationDev/CRMReports/rsviewer/reportviewer.aspx
User host address: 172.x.y.z
User: OTHERDOMAIN\testuser
Is authenticated: True
Authentication Type: Negotiate
Thread account name: CRM Service Account
Thread information:
Thread ID: 1
Thread account name: CRM Service Account
Is impersonating: False
Stack trace: at Microsoft.Crm.Web.Reporting.SrsReportViewer.ConfigurePage()
at Microsoft.Crm.Application.Controls.AppUIPage.OnPreRender(EventArgs e)
at System.Web.UI.Control.PreRenderRecursiveInternal()
at System.Web.UI.Page.ProcessRequestMain(Boolean includeStagesBeforeAsyncPoint, Boolean includeStagesAfterAsyncPoint)
Custom event details:
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Event Type: Error
Event Source: MSCRMReporting
Event Category: None
Event ID: 19969
Date: 5/13/2008
Time: 6:55:19 AM
User: N/A
Computer: CRMSERVER
Description:
Web service request SetParameters to Report Server http://CRMServer/reportserver failed with SoapException. Error: An error has occurred during report processing. (rsProcessingAborted)
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
On SQL Server:
Event Type: Failure Audit
Event Source: MSSQLSERVER
Event Category: (4)
Event ID: 18456
Date: 5/13/2008
Time: 6:55:18 AM
User: NT AUTHORITY\ANONYMOUS LOGON
Computer: SQLServer
Description:
Login failed for user 'NT AUTHORITY\ANONYMOUS LOGON'. [CLIENT: 172.a.b.c] This is the IP address for the CRM server.
The take away from the events is either the SQL Reporting or CRM is attempting to access the SQL service with the Anonymous account. I expect it's SQL reporting because the CRM application is not having problems letting in the other domain users. The problem occurs only on reports.
I tried the following:
1. Applied the steps in the Planning Guide for "Taks for a native mode domain with users in a mixed-mode domain."
2. Set the CRM server to be trusted for delegation (kerberos only)
3. Created SPNs for http/crmserver domain\crmservice and http/crmserver:5555 domain\crmservice and http/crmserver.domain.local domain\crmservice and http/crmserver.domain.local:5555 domain\crmservice
Any suggestion?
Tuesday, May 13, 2008 4:19 PM
Answers
-
Jax, Consider a few things. The application is running under an Applicaiton pool in IIS.
That Pool has an "Identity" that authenticates it to the back end database. If that Machine account has the SPN attributes in AD then users within the Kerberos Realm can authenticate to it.
Now if there is a trust between say, two forest, then there has to be Kerberos resolution between the forest. If you run your sniffer and see only RPC between the forest then I guess you found your problem.
Thursday, May 29, 2008 6:39 PMModerator
All replies
-
these things can be very tricky to troubleshoot. I would open up a case with CRM support, and they can help you work it out. When I've had these kind of authentication issues, they have been very helpful and
got it working.
It sounds like you have taken the appropriate steps by creating the SPNs. Since it still isn't working, I would escallate to support.
Saturday, May 24, 2008 11:20 AMModerator -
see updates and hotfiexesa
http://support.microsoft.com/kb/949256/en-us
Regards,
Imran
msn : mscrmexpert@gmail.com
Monday, May 26, 2008 10:25 AMModerator -
Jax, Consider a few things. The application is running under an Applicaiton pool in IIS.
That Pool has an "Identity" that authenticates it to the back end database. If that Machine account has the SPN attributes in AD then users within the Kerberos Realm can authenticate to it.
Now if there is a trust between say, two forest, then there has to be Kerberos resolution between the forest. If you run your sniffer and see only RPC between the forest then I guess you found your problem.
Thursday, May 29, 2008 6:39 PMModerator