How to configure SharePoint 2013 with Reporting Services for delegations if I get data for Reporting Service from other SQL server that ShqrePoint database?

I found below blog but I'm not sure about my situation if I have WFE + APP with SRS + SP SQL + SQL with SRS?


Which spn should I create?


  1. spn for SharePoint WebApplication account
  2. spn for C2WTS
  3. spn for SRS SharePoint Service account
  4. spn for SQL Engine - but SQL where SharePoint has databases or SQL where I get data to Reporting?


  1. SharePoint WebApplication account to SQL Engine
  2. C2WTS to SQL Engine
  3. SRS SharePoint Service account to which SQL?

Thanks for support,

1 Answer 1


Warning up front: Kerberos is a big, really big PITA. It took us months to set up (SP2010). Only do it if you require the user's credentials in your dataset (double hop). Otherwise, don't use it.

About your assumptions: you're right. See also here: http://technet.microsoft.com/en-us/library/ee806870(v=office.15).aspx .

Re SPN4 and delegation3: SQL instance that holds your reporting data, as that will be the SQL instance where the credentials are forwarded to.

And, also create a diagram of all servers, SPN's, etc. Check this for all changes in error handling in Server 2012: http://technet.microsoft.com/en-us/library/hh831747.aspx

  • I'm wondering if it's obligatory to change Web Application auth metod from NTLM to Kerberos? Can I configure Kerberos only to Reporting Services service? I use Kerberos with Performance Point service and I configured Kerberos only to PPS Service and it's work correct?
    – Wilon
    Commented Nov 3, 2014 at 8:55
  • I don't have experience with Performance Point Service, but if you e.g. open SSRS reports in a SharePoint library, you must switch to Kerberos for that web application.
    – Boland
    Commented Nov 3, 2014 at 22:12
  • Last thing - SPN4 and delagation3 is about SQL Engine service account or Reporting Services service account?
    – Wilon
    Commented Nov 4, 2014 at 17:47
  • SPN3 = account (SSRS), SPN4 = server name (SQL name), not the account. No need to delegate SQL Server account.
    – Boland
    Commented Nov 4, 2014 at 22:21
  • Ok, but I have to set some account? SPN4 - should looks like this? setspn -S MSSQLSvc/SQLSERVER Domain\User
    – Wilon
    Commented Nov 5, 2014 at 7:19

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.