Hi.

We have a Olap server in a external domain. The users cannot access the
cubes if we have not created an user account with the same password on both
domains. We have tried from Excel to speciy the external domain\username
when connecting to the analysis server, but we then get an error message
saying that Excel cannot access the databaseserver. If the passwords are the
same on both domains this works fine. Setting up a trust is not an option.
We don't mind creating 2 user accounts but we would like to not having to
manually update the password on the external domain everyother month. Does
anyone know how to solve this? Thank you.

Kind regards,
Gaute B.

you have 3 options:
* trust the domain (like you already have describe)
* create the same username / password on both domains
* use HTTP access (this required Enterprise edition of AS)

Maybe, there is another solution:
the runas command line.
runas /user:domain\user /netonly excel.exe
this starts Excel and use the domain\user login when the user access remote
ressources. (not tested, but this works fine for other applications with the
same authentication problem)


"Gaute Bekeng" <baldrick4 (AT) hotmail (DOT) com> a écrit dans le message de news:
%23NufqdmwEHA.2908 (AT) tk2msftngp13 (DOT) phx.gbl...

This is discussed extensively in the SSAS Operations Guide:
http://www.microsoft.com/technet/pro.../anservog.mspx
In the section titled: Security Administration
--
Dave Wickert [MSFT]
dwickert (AT) online (DOT) microsoft.com
Program Manager
BI SystemsTeam
SQL BI Product Unit (Analysis Services)
--
This posting is provided "AS IS" with no warranties, and confers no rights.

"Jéjé" <willgart (AT) BBBhotmailAAA (DOT) com> wrote

Thanks. I'll check this out.

Gaute
"Dave Wickert [MSFT]" <dwickert (AT) online (DOT) microsoft.com> skrev i melding
news:usKzOhwwEHA.3832 (AT) TK2MSFTNGP10 (DOT) phx.gbl...

Dave -

Can you clarify a security question re: accessing Analysis Services cubes
across domains? A quick read of the SSAS Operations Guide and the books
online for SQL Server leads me to believe that access should work across
trusted domains. Books online specifically says: "If you are using NTLM
Security Support Provider as your authentication method, all user accounts
and groups that are to be granted access to cubes on an Analysis Server must
be in the same domain as the user account under which the Analysis server was
installed **or in a trusted domain.**" If the trust between domains is a
one-way trust -- the AS Server domain trusts the client domain -- this does
not work. Must the trust between domains be a two-way trust in order to
access AS cubes across domains? If not, is there information somewhere about
setting up this configuration to work?

Thanks for any assistance.

Rich Miller


"Dave Wickert [MSFT]" wrote:

You do not have to have a two-way trust. The only requirement is that the
domain which the SSAS server is a member of must trust the client domain. I
have personally done this many times. We have various lab configuations
which are configured like this. It should work -- there must be some other
configuration problem.
--
Dave Wickert [MSFT]
dwickert (AT) online (DOT) microsoft.com
Program Manager
BI SystemsTeam
SQL BI Product Unit (Analysis Services)
--
This posting is provided "AS IS" with no warranties, and confers no rights.

"Rich Miller" <RichMiller (AT) discussions (DOT) microsoft.com> wrote

Dave -

Thanks for the feedback. Since this is running across a VPN, I suspect
there are a number of areas where the configuration may be an issue. We have
been testing the SQL Server Enterprise/data pump solution as a workaround,
but I don't want to have to tell our partners that they need to invest in the
enterprise version of SQL Server. Given that all of my other possible
configuration problems can be worked out, I assume I should be able to set
this up without investing in the enterprise version?

What are my IT team's options for getting some technical support in getting
this configured correctly?

Rich


"Dave Wickert [MSFT]" wrote:

Newsgroups are more of an informal support channel. Where are you located?
If you are looking for official support, then you may want to contact your
local Microsoft office to see if there is certified partner you can work
with in your area. Possibly one of the Microsoft PSS (Premier Support
Services) support engineers which are monitoring the newsgroup may jump in
here and comment on their offerings. That is Microsoft's official support
channel.
--
Dave Wickert [MSFT]
dwickert (AT) online (DOT) microsoft.com
Program Manager
BI SystemsTeam
SQL BI Product Unit (Analysis Services)
--
This posting is provided "AS IS" with no warranties, and confers no rights.

"Rich Miller" <RichMiller (AT) discussions (DOT) microsoft.com> wrote