Forum Discussion
Multiple Windows Authentication Prompts after F5 Authentication
I am not the principle engineer on this issue, nor an F5 expert. I am part of a project that uses F5 and doing a little research to see if I can find help for an issue we are having.
The desired scenario as I understand it is as follows:
- We send by email a SQL Server Reporting Services (SSrS) report to a recipient.
- In the email message body are hyperlinks that when clicked are supposed to route the user through our F5 onto the SSrS report manager, where a report is then run and displayed.
- The user clicks the hyperlink in the email and is prompted by F5 for their domain credentials.
- F5 routes them to the SSrS report manager site where the selected report is run and displayed.
- The report that is displayed also has within it hyperlinks that open another report on the SSrS report manager.
- The user clicks on one of these hyperlinks and the third report runs and displays.
Here is the problem we are having:
- When the SSrS report manager was running on a single server, the user was prompted once by F5, routed to the report on the report manager, and the report ran and displayed. If the use clicked on a hyperlink in this second report, the third report ran and displayed. The user was only prompted for authentication credentials once (by F5) in this process.
- When the SSrS report manager is load-balanced on two servers, the user gets prompted for credentials by F5, then by Windows. If the user is on a domain-joined computer in the network, then he receives no further prompts as he moves from the second report to the third report. However, if the user is on a non-domain computer outside our network, when he clicks on a hyperlink in the second report, he is prompted again for Windows credentials (a variable number of times from once to five times or more). Sometimes the third report will come up if we cancel the authentication dialogue, other times not.
Can anyone suggest what might be causing this phenomenon and what we might do to fix it? Thanks for any help.
12 Replies
- Michael_Jenkins
Cirrostratus
So it looks like I've got it working now. After all your help @Kevin, I realize that I didn't have delegation allowed on the host/kerberos_user account for the http/ssrs_user SPN (but did for the server accounts) which makes sense why it'd only work with them. I didn't realize I could search for a user to get the service principal. Once I added that to the user, it started working after I did one more thing.
The other issue was that on the ssrs_user account, the spn was set to
, and it didn't work. Once i removed that and addedHTTP/ssrs.example.com
in its place, it started working. I'm guess case matters. 🙂http/ssrs.example.com
Thanks for all your help. It's helped me learn a lot of little things about Kerberos so far. I appreciate your expertise.
- Doug_Pruiett_24
Nimbostratus
Thank you Kevin for all the great guidance you provided through this thread. Through your and Michael's work our SSrS reporting process can now proceed with beta testing. Great work all.
Recent Discussions
Related Content
* Getting Started on DevCentral
* Community Guidelines
* Community Terms of Use / EULA
* Community Ranking Explained
* Community Resources
* Contact the DevCentral Team
* Update MFA on account.f5.com