1

I have to configure Kerberos for PerformancePoint and I have one farm account for all services in test farm. I need add delagtion for Performance Account.

Can I use Farm account to set spn as below for PerformancePoint and add delegation to SQL account?

setspn -s SP\PPS Domain\Farm account

If any other services won't have problem with it?

1

From the technical point of view you can use this one account for this purpose. From a best practice I would not recommend it. Enabling delegation is always a securitry threat.

Please check out this Microsoft KB article for all the needed details:

http://support2.microsoft.com/kb/2723073

From reading your questions I get the impression you are missing some pieces. The SPN and the delegation are only one part of the final solution. The service/datasource that will be addressed must be also running on kerberos. For Performance Point Services we are talking about constrained delegation (with protocol transition) so you need to explicitly name each kerberos enabled data source to allow delegation.

Take a look at the KB article and for even more kerberos fun read this MS paper on SP and Kerberos:

http://www.microsoft.com/en-us/download/details.aspx?id=23176

  • 1
    I asked only about spn because I try to confirm if farm acoount which is use for all service can be use to add spn, if any other service will not have problem with it? Proces will look: I setspn -s SP\PPS Domain\Farm account then I set setspn -s SP\C2WTS Domain\local account then I setspn -s MSOLAPSvc.3\SQLServer:Instance Domain\SQL account then I will delegation for that two accounts Fram and C2WTS to SQL account to MSOLAPSvc.3 and finally I give local permissions for C2WTS account, now ok? – Wilon Oct 8 '14 at 10:46
  • 1
    Not sure I've understand your process, but as long as you are aware of all the extra stuff and you have read the KB article you are good to go. There will be no impact to use the farm account for PSS and there is no impact on other services setting the spn and configure delegation. Security aside. – Marco Scheel Oct 8 '14 at 11:27
  • Unfortunately after add spn form SQL account, PerofmancePoint and Server account and do delegation from PerofmancePoint and Server accounts to SQL account still it doesn't work :/ – Wilon Oct 8 '14 at 14:04

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.