Setup HTTP Reservation Security - SQL-FineBuild/Common GitHub Wiki

Previous Setup RS Virtual Folders Manual Configuration Backup Report Service Encryption Keys Next

SQL FineBuild can set the HTTP Reservation Security needed when Report Services runs using a Domain Account.

HTTP Reservations apply to SQL Server 2008 and above running on Windows 2008 and above for both SQL Reporting Services and PowerBI Server. They are not relevant for SQL2005.

The default settings for HTTP Reservation Security do not allow the delegation needed when using a Domain Service Account. Each reservation for Report Services must be deleted and re-created to allow delegation.

FindBuild Setup HTTP Reservation Security

Processing of Setup HTTP Reservation Security relates to Process Id 4RAJ in the FineBuild4InstallXtras script. It will always be performed as part of a Report Services install.

SQL FineBuild will perform the following processing:

  • Enumerate all HTTP Reservations
  • Delete HTTP reservations for SQL Reporting Services or for PowerBI Server
  • Rebuild HTTP reservations to allow delegation

Top

Manual Setup HTTP Reservation Security

The following steps show what you would have to do to setup HTTP Reservation Security manually. FineBuild does all of this work for you automatically.

For a Cluster Install, this process must be performed on all nodes that form the Report Services Cluster.

  1. Log on to the database server that hosts Report Services

  2. Run the command below:

  NETSH HTTP SHOW URLACL
  1. A number of lines that look similar to the sample below will be shown:
  Reserved URL            : http://PDGB01SQLC08N01:80/ReportServer/
    User: NT SERVICE\PowerBIReportServer
      Listen: Yes
      Delegate: No
      SDDL: D:(A;;GA;;;S-1-5-80-1983730986-2798957292-37364343-1664190425-3529081663)
  1. Delete each reservation that has a user of NT Service\PowerBIReportServer' or NT Service\ReportServer. Ignore any lines for all other users, these must not be altered.
  NETSH HTTP DELETE URLACL URL="http://PDGB01SQLC08N01:80/ReportServer/"
  1. Rebuild each deleted reservation:
  NETSH HTTP ADD URLACL URL="http://PDGB01SQLC08N01:80/ReportServer/" USER="NT SERVICE\PowerBIReportServer" DELEGATE=YES
  1. Repeat the command to show the URLACL list. A number of lines that look similar to the sample below will be shown.
  Reserved URL            : http://PDGB01SQLC08N01:80/ReportServer/
    User: NT SERVICE\PowerBIReportServer
      Listen: Yes
      Delegate: Yes
      SDDL: D:(A;;GA;;;S-1-5-80-1983730986-2798957292-37364343-1664190425-3529081663)
  1. Report Services will now allow the delegation of security needed when the Service Account is a Domain Account.

Copyright FineBuild Team © 2019 - 2021. License and Acknowledgements

Previous Setup RS Virtual Folders Top Backup Report Service Encryption Keys Next