How to: Register a Service Principal Name (SPN) for a Report Server
If you are deploying Reporting Services in a network that uses the Kerberos protocol for mutual authentication, you must create a Service Principal Name (SPN) for the Report Server service if you configure it to run as a domain user account. Additionally, when you configure a domain user as the service account, the report server must be configured to use NTLM authentication.
About SPNs
An SPN is a unique identifier for a service on a network that uses Kerberos authentication. It consists of a service class, a host name, and a port. On a network that uses Kerberos authentication, an SPN for the server must be registered under either a built-in computer account (such as NetworkService or LocalSystem) or user account. SPNs are registered for built-in accounts automatically. However, when you run a service under a domain user account, you must manually register the SPN for the account you want to use.
To create an SPN, you can use the SetSPN command line utility. For more information, see Setspn Overview on the Microsoft Windows Server TechCenter.
You must be a domain administrator to run the utility on the domain controller.
Syntax
The command syntax for using SetSPN utility to create an SPN for the report server resembles the following:
Setspn -a http/<computername>.<domainname>:<port> <domain-user-account>
SetSPN is available with Windows Server 2003 Service Pack 1 support tool pack, which you must download separately. The -a argument is used to register a service principal name with a particular account.
HTTP is the service class. The Report Server Web service runs in HTTP.SYS. A by-product of creating an SPN for HTTP is that all Web applications on the same computer that run in HTTP.SYS (including applications hosted in IIS) will be granted tickets based on the domain user account. If those services run under a different account, the authentication requests will fail. To avoid this problem, be sure to configure all HTTP applications to run under the same account, or consider creating host headers for each application and then creating separate SPNs for each host header. When you configure host headers, DNS changes are required regardless of the Reporting Services configuration.
The values that you specify for <computername>, <domainname>, and <port> identify the unique network address of the computer that hosts the report server. This can be a local host name or a fully qualified domain name (FQDN). If you only have one domain and are using port 80, you can omit <domainname> and <port> from your command line. <domain-user-account> is the user account under which the Report Server service runs and for which the SPN must be registered.
Note
NOTE: if you are using Internet Explorer and Kerberos authentication it is recommended you do not specify the port as part of the command line. For more information, see Internet Explorer cannot use the Kerberos authentication protocol to connect to a Web site.
Register an SPN for Domain User Account
To register an SPN for a Report Server service running as a domain user
Install Reporting Services and configure the Report Server service to run as a domain user account. Note that users will not be able to connect to the report server until you complete the following steps.
Download and install Windows Server 2003 Service Pack 1 Support Tools from the Download Center.
Log on to the domain controller as domain administrator.
Open a Command Prompt window.
Copy the following command, replacing placeholder values with actual values that are valid for your network:
Setspn -a http/<computer-name>.<domain-name>:<port> <domain-user-account>Run the command.
Open the RsReportServer.config file and locate the <AuthenticationTypes> section. Add <RSWindowsNegotiate/> as the first entry in this section to enable NTLM.