locked
Cross Forest Authentication Issues with SQL Reporting RRS feed

  • Question

  •  

    I setup CRM 4.0 in one domain with a domain service account.  SQL Reporting is located on the same machine using the same account.  SQL is on a different machine.   These are in the same single domain forest which has a two way trust relation with another domain of a separate single domain forest. Both domains are W2k3 Native Mode. 

     

    The CRM application allows access to users in both domains.  The reports are generated with accounts in the first domain where CRM and SQL Reports is located but not for users in the other domain.   The report's window displays "The report cannot be displayed."

     

    The following are events that are related to the error:

    On CRM server:

    Event Type:      Warning

    Event Source:   ASP.NET 2.0.50727.0

    Event Category:            Web Event

    Event ID:          1309

    Date:                5/13/2008

    Time:                6:55:19 AM

    User:                N/A

    Computer:         CRMSERVER

    Description:

    Event code: 3005

    Event message: An unhandled exception has occurred.

    Event time: 5/13/2008 6:55:19 AM

    Event time (UTC): 5/13/2008 1:55:19 PM

    Event ID: cc4c29c8f4be4e82ac0eee1234a15dc6

    Event sequence: 77

    Event occurrence: 1

    Event detail code: 0

     

    Application information:

        Application domain: /LM/W3SVC/2/ROOT-1-128551603464644692

        Trust level: Full

        Application Virtual Path: /

        Application Path: C:\Program Files\Microsoft Dynamics CRM\CRMWeb\

        Machine name: CRMSERVER

     

    Process information:

        Process ID: 3340

        Process name: w3wp.exe

        Account name: CRM Service Account

     

    Exception information:

        Exception type: CrmReportingException

        Exception message: An error has occurred during report processing. (rsProcessingAborted)

     

    Request information:

        Request URL: http://CRMServer:5555/OrganizationDev/CRMReports/rsviewer/reportviewer.aspx

        Request path: /OrganizationDev/CRMReports/rsviewer/reportviewer.aspx

        User host address: 172.x.y.z

        User: OTHERDOMAIN\testuser

        Is authenticated: True

        Authentication Type: Negotiate

        Thread account name: CRM Service Account

     

    Thread information:

        Thread ID: 1

        Thread account name: CRM Service Account

        Is impersonating: False

        Stack trace:    at Microsoft.Crm.Web.Reporting.SrsReportViewer.ConfigurePage()

       at Microsoft.Crm.Application.Controls.AppUIPage.OnPreRender(EventArgs e)

       at System.Web.UI.Control.PreRenderRecursiveInternal()

       at System.Web.UI.Page.ProcessRequestMain(Boolean includeStagesBeforeAsyncPoint, Boolean includeStagesAfterAsyncPoint)

     

     

    Custom event details:

     

    For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

     

     

     

    Event Type:      Error

    Event Source:   MSCRMReporting

    Event Category:            None

    Event ID:          19969

    Date:                5/13/2008

    Time:                6:55:19 AM

    User:                N/A

    Computer:         CRMSERVER

    Description:

    Web service request SetParameters to Report Server http://CRMServer/reportserver failed with SoapException. Error: An error has occurred during report processing. (rsProcessingAborted)

     

    For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

     

     

     

     

    On SQL Server:

    Event Type:      Failure Audit

    Event Source:   MSSQLSERVER

    Event Category:            (4)

    Event ID:          18456

    Date:                5/13/2008

    Time:                6:55:18 AM

    User:                NT AUTHORITY\ANONYMOUS LOGON

    Computer:         SQLServer

    Description:

    Login failed for user 'NT AUTHORITY\ANONYMOUS LOGON'. [CLIENT: 172.a.b.c]  This is the IP address for the CRM server.

     

    The take away from the events is either the SQL Reporting or CRM is attempting to access the SQL service with the Anonymous account.  I expect it's SQL reporting because the CRM application is not having problems letting in the other domain users. The problem occurs only on reports.

     

    I tried the following:

    1. Applied the steps in the Planning Guide for "Taks for a native mode domain with users in a mixed-mode domain."

    2. Set the CRM server to be trusted for delegation (kerberos only)

    3.  Created SPNs for http/crmserver domain\crmservice and http/crmserver:5555  domain\crmservice and http/crmserver.domain.local domain\crmservice and http/crmserver.domain.local:5555 domain\crmservice

     

    Any suggestion?

     

    Tuesday, May 13, 2008 4:19 PM

Answers

  •  

    Jax, Consider a few things.   The application is running under an Applicaiton pool in IIS.

    That Pool has an "Identity" that authenticates it to the back end database.  If that Machine account has the SPN attributes in AD then users within the Kerberos Realm can authenticate to it.

     

    Now if there is a trust between say, two forest, then there has to be Kerberos resolution between the forest.  If you run your sniffer and see only RPC between the forest then I guess you found your problem.

     

    Thursday, May 29, 2008 6:39 PM
    Moderator

All replies

  • these things can be very tricky to troubleshoot.  I would open up a case with CRM support, and they can help you work it out.  When I've had these kind of authentication issues, they have been very helpful and

    got it working.

     

    It sounds like you have taken the appropriate steps by creating the SPNs.  Since it still isn't working, I would escallate to support.

    Saturday, May 24, 2008 11:20 AM
    Moderator
  •  

    see updates and hotfiexesa

     

    http://support.microsoft.com/kb/949256/en-us

     

    Regards,

     

    Imran

     

    msn : mscrmexpert@gmail.com

    Monday, May 26, 2008 10:25 AM
    Moderator
  •  

    Jax, Consider a few things.   The application is running under an Applicaiton pool in IIS.

    That Pool has an "Identity" that authenticates it to the back end database.  If that Machine account has the SPN attributes in AD then users within the Kerberos Realm can authenticate to it.

     

    Now if there is a trust between say, two forest, then there has to be Kerberos resolution between the forest.  If you run your sniffer and see only RPC between the forest then I guess you found your problem.

     

    Thursday, May 29, 2008 6:39 PM
    Moderator