For my first publication, I propose to describe the technical pre-requisites, architecture, applications and environment settings to design properly a Microsoft BI architecture in a Kerberos constrained configuration. First of all, what's and why a Kerberos constrained configuration? You’ll find a lot a technical description on Internet that defi

You’ll find below the different SPN to register and the delegations to set to run properly the Kerberos configuration in a constraint delegation mode. Register Service Provider Name Register SPN service for account as follow: Enter in command line SETSPN.exe –A <SPN Service>/<Host> <Domain>\<Account>. Add these SPN VIA ADSI-EDIT = HTTP/webmoss-

First I needed to design an architecture that will match with our functional and technical needs and pre-requisites. In our cases, we need architecture scalable; witch will use the best performance of my servers and hardware resources. We want to install all Microsoft BI applications; Sharepoint 2007 with excel services, Performance point, proclari

Find now below the draft of the SPN and delegations configuration between the different accounts, hosts, and services.

Kerberos servers Registry modification Add specific Registry Key on Web and SQL server to force Kerberos protocol to use TCP protocol. In deed Microsoft windows system uses by default UDP witch may cause a lot of perturbation. For example, a user who will be member of a lot of active directory global groups will not be able to be impersonated prope

Hello, My objective on this blog is to share technical informations about the application solutions architecture I had to build as IT project manager in my company for 10 years. Most of the time I find the informations I need on the Internet but with a development vision not really with a production one. And there is often a great difference betwee

IIS DCOM pre-requisites On web and reporting services services Server add ACC-BI-SSRS@yourdomain.net and ACC-BI-SSASWEB@yourdomain.net to the local IIS_WPG groups of each web server. Components services configuration Open Administrative Tools and open Component Services MMC Expand components services, computers and My Computer. Right click on My Co

To explain properly step by step the global configuration, I propose to split the production configuration in several parts. The first step concerns the Kerberos configurations for the following basic BI environment: IIS data pump hosted on the front web server webmoss-srv01 SSRS 2008 hosted on webapp-srv01 SQL and SSAS on sqlssas-srv01. Now we hav

We need now to define all the accounts and hosts that will be used to access by users to the different resources. It’s necessary before to publish all the SPN and delegations. You must remember at this step that Kerberos need to have only one service publication corresponding to a resource owned by one service domain user (or computer). For examp