I don't use Kerberos Auth in my SP farm. I have a user that is trying to create a SQL Connection in Dashboard Designer. He tried the Per-User identity option, but received an error about PerfPoint not being configured. After researching it, it seems that Kerberos is required when trying to use the Per-User identity, due to double-hop authentication not working with NTLM. This user needs to use his own AD account to access a remote SQL DB, as the data is sensitive. Using the unattended account requires that the account is assigned read access to this DB, which can't be done due to security reasons, and i assume that anyone using PerfPoint and the Unattended Account in future would also have access to this sensitive data.

Is my only option to set up Kerberos on the Farm?



Kerberos is needed when you require end-to-end authentication. Lets say you have a scenario where there is a valid domain user who has at-least a read level access to an OLAP Cube or SQL DB and this Cube/DB acts as a data source for your PPS or Report in SharePoint. Whenever this user logs into SharePoint to access the report or PPS dashboard his credentials are passed to the remote data-source.

As you likely said, double-hop authentication needs Kerberos and I'm afraid without it you will need an Unattendend Service Account with atleast read level access to your datasources make them available in SharePoint. Kerberos setup is secured and provides a better authentication mechanism along with relying on constrained delegations in Active Directory for double hop authentication. Only challenge is configuring Kerberos for the first timers is a little complex. Its recommended to get the Server/AD guy along with you to setup Kerberos with SharePoint if you are doing it for the first time in a production environment.

  • Thanks Arko. So there would be no other options to use with PerfPoint, like BCS, for example? – SPRocket Aug 13 '13 at 10:57

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.