Data Source Credentials, Double Hop, SA Role

Question

Greetings, have a 2019 install of SSRS which I have a data source on another SQL Server, so when I set the credentials for the data source to be "as the user viewing the report" it fails and I believe this is due to the double hop as we do not have kerberos authentication configured. When I set the data source to "use the following credentials" and use a windows account, this works only if the account is in the SA role on the database server, any other role I tried I get an error as it is trying to run an "execute as" behind the scenes. When I leave the data source configured with the windows account with the SA role, and run a trace I can see that the database access is being done by the user running the report, not the windows account in the SA role. I have the check box "log in using these credentials, but then try to impersonate the user viewing the report" checked, so it appears to be doing just that. My question is how this is getting around the double hop problem and is it opening anything else up by having that data source use an SA account?? We can further restrict permissions in SSRS and looks like I can use database permissions but I would prefer not to have the data sources configured this way. I can't get kerberos authentication here. See screenshot below of the settings

Answer 1

Hi,
For double hop issue , you could look at : The Double-Hop Authentication Problem
But I as know to work around it, we need to use kerberos.
This is also a very detailed solution guidance at :
Configure Kerberos Authentication for Reporting Services
Regards，
Joy

---

If the answer is helpful, please click "Accept Answer" and upvote it.
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Answer 2

Thanks for the reply, but kerberos is not something the domain admin is likely to take on here. My question is how this is getting around the double hop problem by the configuration I have, and is it opening anything else up by having that data source use an SA account??