dbTalk Databases Forums  

Using Kerberos and running MSOLAPService under a domain account

microsoft.public.sqlserver.olap microsoft.public.sqlserver.olap


Discuss Using Kerberos and running MSOLAPService under a domain account in the microsoft.public.sqlserver.olap forum.



Reply
 
Thread Tools Display Modes
  #1  
Old   
Bengt Jax
 
Posts: n/a

Default Using Kerberos and running MSOLAPService under a domain account - 02-03-2004 , 10:50 AM






Hi

Is it not supported to use Kerberos and run the MSOLAPService under a domain
account?
When trying to connect to the OLAP server I get "Unspecified error". When
running the MSOLAPService under Local System it works fine.

The article at http://www.mosha.com/msolap/articles...delegation.htm
is a little unclear on this I think.
Point 2 says "Correct SPN should be registered in the Active Directory" with
an alternative if you are running under another account.
Point 4 says "The MSSQLServerOLAPService must be running under the
LocalSystem account in order for delegation to be enabled."

Whats true about this?

Best regards
Bengt
Decision Support Panel



Reply With Quote
  #2  
Old   
Mosha Pasumansky [MS]
 
Posts: n/a

Default Re: Using Kerberos and running MSOLAPService under a domain account - 02-03-2004 , 04:55 PM






So have you registered SPN manually setspn ? Are you using exactly same FQDN
to connect to the server as you registered ?

--
==================================================
Mosha Pasumansky - http://www.mosha.com/msolap
Development Lead in the Analysis Server team
All you need is love (John Lennon)
Disclaimer : This posting is provided "AS IS" with no warranties, and
confers no rights.
==================================================
"Bengt Jax" <bengt.jax (AT) dspanel (DOT) com.removethis> wrote

Quote:
Hi

Is it not supported to use Kerberos and run the MSOLAPService under a
domain
account?
When trying to connect to the OLAP server I get "Unspecified error". When
running the MSOLAPService under Local System it works fine.

The article at
http://www.mosha.com/msolap/articles...delegation.htm
is a little unclear on this I think.
Point 2 says "Correct SPN should be registered in the Active Directory"
with
an alternative if you are running under another account.
Point 4 says "The MSSQLServerOLAPService must be running under the
LocalSystem account in order for delegation to be enabled."

Whats true about this?

Best regards
Bengt
Decision Support Panel





Reply With Quote
  #3  
Old   
Bengt Jax
 
Posts: n/a

Default Re: Using Kerberos and running MSOLAPService under a domain account - 02-03-2004 , 05:45 PM



Thanks for your prompt reply.

Yes I do think I have done the setspn part correct.
I have tried to connect with both the NetBios and the FQDN name with no
luck.
I have done the tests locally on the OLAP server using the MDX sample by
adding the SSPI=Kerberos to the connection string but I can't get it to work
when running Analysis Services under a domain account. I just get
"Unspecified error".

Some additional info:
The domain account running the MSOLAPSvc is a member of the groups
Adminstrators and OLAP Administrators on the OLAP server.

List from setspn
setspn -l vm3ksql2k
Registered ServicePrincipalNames for
CN=VM3KSQL2K,CN=Computers,DC=dspaneltest,DC=com:
MSOLAPSvc/vm3ksql2k.dspaneltest.com
MSSQLSvc/vm3ksql2k.dspaneltest.com:1433
MSOLAPSvc/VM3KSQL2K
HOST/VM3KSQL2K
HOST/vm3ksql2k.dspaneltest.com

The Olap server (SP3) is running on a Windows 2003 machine, could that be a
problem?

Any idées?

Thanks
Bengt

"Mosha Pasumansky [MS]" <moshap (AT) online (DOT) microsoft.com> wrote

Quote:
So have you registered SPN manually setspn ? Are you using exactly same
FQDN
to connect to the server as you registered ?

--
==================================================
Mosha Pasumansky - http://www.mosha.com/msolap
Development Lead in the Analysis Server team
All you need is love (John Lennon)
Disclaimer : This posting is provided "AS IS" with no warranties, and
confers no rights.
==================================================
"Bengt Jax" <bengt.jax (AT) dspanel (DOT) com.removethis> wrote in message
news:OZ63%23Wn6DHA.804 (AT) tk2msftngp13 (DOT) phx.gbl...
Hi

Is it not supported to use Kerberos and run the MSOLAPService under a
domain
account?
When trying to connect to the OLAP server I get "Unspecified error".
When
running the MSOLAPService under Local System it works fine.

The article at
http://www.mosha.com/msolap/articles...delegation.htm
is a little unclear on this I think.
Point 2 says "Correct SPN should be registered in the Active Directory"
with
an alternative if you are running under another account.
Point 4 says "The MSSQLServerOLAPService must be running under the
LocalSystem account in order for delegation to be enabled."

Whats true about this?

Best regards
Bengt
Decision Support Panel







Reply With Quote
  #4  
Old   
Mosha Pasumansky [MS]
 
Posts: n/a

Default Re: Using Kerberos and running MSOLAPService under a domain account - 02-05-2004 , 07:09 PM



Everything looks fine. Are you sure you have SP3 on both server and client
and you use MSOLAP.2 ?

--
==================================================
Mosha Pasumansky - http://www.mosha.com/msolap
Development Lead in the Analysis Server team
All you need is love (John Lennon)
Disclaimer : This posting is provided "AS IS" with no warranties, and
confers no rights.
==================================================
"Bengt Jax" <bengt.jax (AT) dspanel (DOT) com.removethis> wrote

Quote:
Thanks for your prompt reply.

Yes I do think I have done the setspn part correct.
I have tried to connect with both the NetBios and the FQDN name with no
luck.
I have done the tests locally on the OLAP server using the MDX sample by
adding the SSPI=Kerberos to the connection string but I can't get it to
work
when running Analysis Services under a domain account. I just get
"Unspecified error".

Some additional info:
The domain account running the MSOLAPSvc is a member of the groups
Adminstrators and OLAP Administrators on the OLAP server.

List from setspn
setspn -l vm3ksql2k
Registered ServicePrincipalNames for
CN=VM3KSQL2K,CN=Computers,DC=dspaneltest,DC=com:
MSOLAPSvc/vm3ksql2k.dspaneltest.com
MSSQLSvc/vm3ksql2k.dspaneltest.com:1433
MSOLAPSvc/VM3KSQL2K
HOST/VM3KSQL2K
HOST/vm3ksql2k.dspaneltest.com

The Olap server (SP3) is running on a Windows 2003 machine, could that be
a
problem?

Any idées?

Thanks
Bengt

"Mosha Pasumansky [MS]" <moshap (AT) online (DOT) microsoft.com> wrote in message
news:402026ce$1 (AT) news (DOT) microsoft.com...
So have you registered SPN manually setspn ? Are you using exactly same
FQDN
to connect to the server as you registered ?

--
==================================================
Mosha Pasumansky - http://www.mosha.com/msolap
Development Lead in the Analysis Server team
All you need is love (John Lennon)
Disclaimer : This posting is provided "AS IS" with no warranties, and
confers no rights.
==================================================
"Bengt Jax" <bengt.jax (AT) dspanel (DOT) com.removethis> wrote in message
news:OZ63%23Wn6DHA.804 (AT) tk2msftngp13 (DOT) phx.gbl...
Hi

Is it not supported to use Kerberos and run the MSOLAPService under a
domain
account?
When trying to connect to the OLAP server I get "Unspecified error".
When
running the MSOLAPService under Local System it works fine.

The article at
http://www.mosha.com/msolap/articles...delegation.htm
is a little unclear on this I think.
Point 2 says "Correct SPN should be registered in the Active
Directory"
with
an alternative if you are running under another account.
Point 4 says "The MSSQLServerOLAPService must be running under the
LocalSystem account in order for delegation to be enabled."

Whats true about this?

Best regards
Bengt
Decision Support Panel









Reply With Quote
  #5  
Old   
Bengt Jax
 
Posts: n/a

Default Re: Using Kerberos and running MSOLAPService under a domain account - 02-06-2004 , 06:31 AM



Yes I'm quite sure...
I have tried both from a client and locally on the server using the
MDXSample and I'm using MSOLAP.2 and SP3. Same error from both places
"Unspecified error".

I found one more post on the newsgroup that seems to have the same problem:
http://groups.google.com/groups?hl=s...TF-8%26hl%3Dsv

Any additional idées? Could it be a bug maybe?

Thanks for your time...

Regards
Bengt

"Mosha Pasumansky [MS]" <moshap (AT) online (DOT) microsoft.com> wrote

Quote:
Everything looks fine. Are you sure you have SP3 on both server and client
and you use MSOLAP.2 ?

--
==================================================
Mosha Pasumansky - http://www.mosha.com/msolap
Development Lead in the Analysis Server team
All you need is love (John Lennon)
Disclaimer : This posting is provided "AS IS" with no warranties, and
confers no rights.
==================================================
"Bengt Jax" <bengt.jax (AT) dspanel (DOT) com.removethis> wrote in message
news:OQuXj%23q6DHA.2300 (AT) TK2MSFTNGP10 (DOT) phx.gbl...
Thanks for your prompt reply.

Yes I do think I have done the setspn part correct.
I have tried to connect with both the NetBios and the FQDN name with no
luck.
I have done the tests locally on the OLAP server using the MDX sample by
adding the SSPI=Kerberos to the connection string but I can't get it to
work
when running Analysis Services under a domain account. I just get
"Unspecified error".

Some additional info:
The domain account running the MSOLAPSvc is a member of the groups
Adminstrators and OLAP Administrators on the OLAP server.

List from setspn
setspn -l vm3ksql2k
Registered ServicePrincipalNames for
CN=VM3KSQL2K,CN=Computers,DC=dspaneltest,DC=com:
MSOLAPSvc/vm3ksql2k.dspaneltest.com
MSSQLSvc/vm3ksql2k.dspaneltest.com:1433
MSOLAPSvc/VM3KSQL2K
HOST/VM3KSQL2K
HOST/vm3ksql2k.dspaneltest.com

The Olap server (SP3) is running on a Windows 2003 machine, could that
be
a
problem?

Any idées?

Thanks
Bengt

"Mosha Pasumansky [MS]" <moshap (AT) online (DOT) microsoft.com> wrote in message
news:402026ce$1 (AT) news (DOT) microsoft.com...
So have you registered SPN manually setspn ? Are you using exactly
same
FQDN
to connect to the server as you registered ?

--
==================================================
Mosha Pasumansky - http://www.mosha.com/msolap
Development Lead in the Analysis Server team
All you need is love (John Lennon)
Disclaimer : This posting is provided "AS IS" with no warranties, and
confers no rights.
==================================================
"Bengt Jax" <bengt.jax (AT) dspanel (DOT) com.removethis> wrote in message
news:OZ63%23Wn6DHA.804 (AT) tk2msftngp13 (DOT) phx.gbl...
Hi

Is it not supported to use Kerberos and run the MSOLAPService under
a
domain
account?
When trying to connect to the OLAP server I get "Unspecified error".
When
running the MSOLAPService under Local System it works fine.

The article at
http://www.mosha.com/msolap/articles...delegation.htm
is a little unclear on this I think.
Point 2 says "Correct SPN should be registered in the Active
Directory"
with
an alternative if you are running under another account.
Point 4 says "The MSSQLServerOLAPService must be running under the
LocalSystem account in order for delegation to be enabled."

Whats true about this?

Best regards
Bengt
Decision Support Panel











Reply With Quote
Reply




Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

vB code is On
Smilies are On
[IMG] code is On
HTML code is Off



Powered by vBulletin Version 3.5.3
Copyright ©2000 - 2012, Jelsoft Enterprises Ltd.