Powerpivot data refresh over kerberos delegation

Question

I have a SQL 2008 R2 OLAP Cube and an Excel file that uses powerpivot and embedded datasource to the Cube.

I want to upload the Excel file in SharePoint and allow users who are authenticated to the cube refresh the selected region of the excel sheet opened in SharePoint excel viewer. This refresh must happen through their windows domain account identity and be only allowed to refresh those portion of the cube which they have access to.

I'm using a single service account for all farm services including application pools , service applications and farm services. However this service account does not have access to the cube and it is configured to be an unattended service account in Secured Store Service application. So these are my questions :-

1. Is it possible to configure excel and powerpivot data refresh without giving access to the excel and power pivot service account and the unattended service account in Secured store service of SharePoint to the OLAP cube ?
2. Does identity delegation as mentioned here http://technet.microsoft.com/en-us/library/gg502605(v=office.14).aspx is applicable for my requirement.

Answer 1

After digging through and research these are the answers to the question. This should help others with the same requirement.

To both the above questions , the answer lies in setting up Kerberos Authentication with SharePoint.

Essentially, through Kerberos the identity of the windows user is passed from the client to SharePoint to Backend system. It essentially means SharePoint is the middle layer and the final authentication of the client takes place at the SQL cube or SQL Reporting server whichever applicable.

Microsoft also have a detailed video outlining the concepts behind setting up Kerberos Auth and configuring it for SharePoint 2010 and Report Server. The principal authentication concepts and approach remains the same for Powerpivot data refresh to an OLAP cube.