Reporting Services XML 数据源的集成安全性
我正在设置我的报表服务器以使用 Web 服务作为 XML 数据源。我选择使用集成安全性时，网络服务和报告之间似乎存在身份验证问题。这是我所拥有的：
1）我有一个带有公开服务的网站。该网站配置为仅在集成安全性上运行。这意味着我们关闭了所有其他模式，并在目录安全下关闭了启用的匿名访问。
2）在网站的Web.config中，我将身份验证模式设置为Windows。
3) 我将报告数据源设置为 XML 数据源。我有该服务的正确 URL 并将其设置为 Windows 集成安全性。由于我要从浏览器跳转到报告服务器再到 Web 服务，所以我想知道 Kerberos 是否存在问题，但我不确定。
当我尝试访问该服务时，收到 401 错误。
以下是我生成的 IIS 日志：
2011-01-07 14:52:12 W3SVC IP_ADDY POST /URL.asmx - 80 - IP_ADDY - 401 1 0 2011-01-07 14:52:12 W3SVC IP_ADDY POST /URL.asmx - 80 - IP_ADDY - 401 1 5
以前有人解决过这个问题吗？谢谢！
I am working on setting up my report server to use a web service as an XML datasource. I seem to be having authentication issues between the web service and the report with I choose to use Integrated security. Here's what I have:
1) I have a website w/ an exposed service. This website is configured to run ONLY on Integrated Security. This means that we have all other modes turned off AND Enabled anonymous access turned off under directory security.
2) Within the Web.config of the website, I have the authentication mode set to Windows.
3) I have the report datasource set to being an XML data source. I have the correct URL to the service and have it set to Windows Integrated Security. Since I am making a hop from the Browser to the Reporting Server to the Web Service, I wonder if I am having an issue w/ Kerberos, but I am not sure.
When I try to access the service, I get a 401 error.
Here are the IIS logs that I am generating:
2011-01-07 14:52:12 W3SVC IP_ADDY POST /URL.asmx - 80 - IP_ADDY - 401 1 0
2011-01-07 14:52:12 W3SVC IP_ADDY POST /URL.asmx - 80 - IP_ADDY - 401 1 5
Has anyone worked out this issue before? Thanks!
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
听起来您确实遇到了“双跳”问题。是否可以在您的 Web 服务上创建一个报告服务器明确使用的帐户，而不是传递用户凭据？
It does sound like you are experiencing the "double hop" issue. Is it possible to create an account on your web service that the reporting server uses explicitly instead of passing through the users credentials?
如果您不想乱用 Kerberos，还有一个更简单的解决方案……尽管用户体验不太理想。
在数据源上...如果您选中“运行报告的用户提供的凭据”和“连接到数据源时用作 Windows 凭据”，则用户在运行报告时将被提升为登录。由于凭据被提供给 SSRS 服务器，因此从 SSRS 到 Web 服务只有一跳...从而避免了双跳 NTLM 身份验证问题。
不过，它的用户友好性较差，因为您必须登录才能运行报告。
There's a simpler solution if you dont want to muck around with Kerberos... although the user experience is less desirable.
On the Data Source...If you check the "Credentials supplied by the user running the report" and the "Use as Windows credentials when connecting to the data source" then the user will be promoted to log in when they run the report. Since the credentials are being supplied to the SSRS server it's only a single hop from SSRS to the webservice... thus avoiding the double-hop NTLM authentication problem.
It's less user-friendly, though, since you have to log in to run the report.