My client had a requirement for their PerformancePoint dashboard to connect to Analysis Services using per-user identity authentication. So, I set out to configure the authentication to use Kerberos instead of NTLM. I ran into some roadblocks due to insufficient documentation. This post describes how I solved the problem after a few rounds of trial and error. Hopefully this will help as you work on the Kerberos configuration for an Analysis Services named instance.
Here are the salient details about my client’s environment that made this scenario fall somewhat outside of the prescribed Microsoft happy path.
- SQL Server 2008 R2 Analysis Services running as a named instance
- SSAS service running under “Local System” account
- Changing this server configuration was not an option for various unrelated reasons
Based on the Microsoft guide to setting up Kerberos for SharePoint services I tried several different options before finding one that worked. There is nothing in the document that gives a specific example of an SSAS named instance running under a local account (not a domain account). So, I was trying to establish the SPN using fully-qualified domain names and port numbers, etc. Nothing worked. Ended up with several incorrect SPNs cluttering up Active Directory.
Ultimately, the trick was to remove all my previous attempts at establishing SPNs and then create a new one using this command:
setspn -A MSOLAPSvc.3/<Server Name>:<Instance Name> <Server Name>
Just replace <Server Name> with the name of your server (NOT the FQDN) and <Instance Name> with the name of the SSAS instance.
Good luck.
