Kerberos authentication for Excel Services

Hi,
I am configuring Keberos for Excel Service Application and facing some issue. Things i have done so far:
Configured web application to use Kerberos: Verified it from server authentication logs, klist and net mon that web application is using kerberos.
Excel service Account: domain\ExcelSVA
SQL server service account: domain\SQLSERV
C2WTS account : domain\C2wts
 set spn on in using setspn - s sp/excelservices domain\ExcelSVA and delegated constarined authentication to domain\SQLSERV
then setspn - s sp/c2wts domain\C2wts and delegated constrained authentication to domain\SQLSERV.
C2WS account has impersonate identity ,logon as service and act as part of OS rights in app servers where excel and c2wt are running 
Now when i try to refresh data i get error :The data connection uses Windows Authentication and user credentials could not be delegated.
The following connections failed to refresh: SQLServername port, databasename
http://technet.microsoft.com/en-us/library/ff487975.aspx
First 3 errors don't apply to me since i cant see these errors in SP log files and my sharepoint and database servers are in same domain.
For UPN, there is a email id assoisated with account that i am using and i have been using that email id to logon to other services in my company so UPN should be done too.
The Excel Services service account must have Active Directory permissions to query the object. Now this got me confusing. Where do i actually
give this? In sql server or AD? Which object does it need to query? The excel database in sql server. If it is so, then the permission needs to be granted on sql .
Also this link http://social.msdn.microsoft.com/Forums/en-US/99a3cf4f-dabc-4ac9-9ea8-afa677199ffa/kerberos-and-excel-services?forum=sharepointgeneralprevious
Microsoft solution described here is weired. I don't think sql server has c2wts or excel service application started on it. And from drop down list that is i don't know what is the solution talking of.
Does any one have any idea if i am missing any delegation or any step?
sachin

Any idea??
sachin

Similar Messages

  • Configuring Kerberos authentication for SSRS in native mode - SSRS 2008 R2-2012

    Hi,
    I've a SSRS native mode installation on a server and a SSAS installation on another server.
    In order to configure the Kerberos authentication for SSRS native mode, I need to register one SPN for the report server service, one SPN for SSAS service and to configure SSRS to use the negotiate authentication type, isn't it?
    Thanks

    Hi pscorca,
    If we have applications that only use Kerberos authentication and we are using RSWindowsNegotiate AuthenticationType, we must create a Service Principal Name (SPN) for the Report Server service if we configure it to run as a domain user account.
    Before setting up constrained delegation, we must register a
    Service Principle Name (SPN) for the Analysis Services instance. We will need the Analysis Services SPN when configuring Kerberos constrained delegation for middle tier services.
    There is a document about Enabling Kerberos Authentication for Reporting Services, you can refer to it.
    http://blogs.technet.com/b/rob/archive/2011/11/23/enabling-kerberos-authentication-for-reporting-services.aspx
    Hoe this helps.
    Regards,
    Alisa Tang
    Alisa Tang
    TechNet Community Support

  • Regarding Kerberos authentication for webservices.

    Hi,
          I need to use kerberos authentication for my receiver webservice.  I am working in PI7.1 . Which adapter I can use for this ( WS-RM adapter or SOAP adapter) and How to configure it for kerberos. I mean, which value of authentication parameter refers to kerberos authentication.
    Regards,
    Reyaz hussain

    Hi Reyaz,
    To tell you frankly i never come across this kerberos protocol but since you would like to use there is certainly a chance after the launch of PI 7.1. The launch has Opened the Door to the World of Web Services Reliable Messaging.  "The Integration Directory enables you to easily configure scenarios where the Integration Server acts as a message hub between WS-RM-enabled applications and any other application or technical system. Thus, you can configure scenarios where either a Web Service client calls the Integration Server and the message is then routed to any other application, or the other way around where any application calls a Web Service provider via the Integration Server. In the Integration Directory you can do the complete configuration of the Integration Server inbound or outbound processing."
    https://www.sdn.sap.com/irj/scn/wiki?path=/display/profile/2007/07/25/new+news&focusedcommentid=44360
    Regards
    joel

  • Exporting a List to Excel to use for Excel Services WebPart (not working)

    Hey everyone, here's the scenario. I'm trying to export a list to excel and save it to a library. All the connections are saved. Now. I want that excel file to render as a web part. When I make a change on the list and try to refresh the data connection
    I get the error below. Please help
    AJ MCTS: SP 2010 Configuration MCSA: Windows 7 If you find this post useful kindly please mark it as an answer :) TY

    Hi,
    I did a test as the followings:
    Create a list, and add some items into it.
    Export the list into a Excel file, then upload the excel file to a library.
    When I opened the file via Excel service, I saw the a yellow warning about unsupported features.
    Then I created a wiki page, and add Excel Web Access web part and connect the web part to the excel file.
    When I refresh all data conections, nothing happened.
    From the article:
    https://msdn.microsoft.com/en-us/library/ms496823.aspx (they are similar with SharePoint 2013)
    SharePoint lists are not supported for Excel service. So, it may cause this issue.
    I suggest you click "Open in Excel" to open the file in Excel application, then refresh the data connection, and save back to SharePoint. Then after you refresh the page, the data of the Excel Web Access web part will refresh.
    Thanks,
    Wendy
    TechNet Community Support
    Please remember to mark the replies as answers if they help, and unmark the answers if they provide no help. If you have feedback for TechNet Support, contact
    [email protected]

  • Enable Kerberos Authentication for OWA only

    Hi guys,
    Having a customer that asked me if we can enable Kerberos Authentication for OWA only?
    When reading various blogposts (official and unofficial sources) it seems that this is done for the whole CASArray which means every vdir right? Is this so and shall we instead aim for using kerberos for both MAPI/Outlook Anywhere and OWA?
    Found this for MAPI clients: http://blogs.technet.com/b/exchange/archive/2011/04/15/recommendation-enabling-kerberos-authentication-for-mapi-clients.aspx
    This seems to be more complicated?

    Hi Fredrik,
    Base on my search , I found an article which may give you some hints:
    OWA publishing using Kerberos Constrained Delegation method for authentication delegation
    This article is to show case how you would configure kerberos constrained delegation method for authentication delegation .We would use the OWA publishing post as reference.
    Best regards,
    Niko Cheng
    TechNet Community Support

  • SUP user authentication for web services

    Hi there.
    Has anyone in the comunity had any experience with building Web Service based Mobile Business Object (MBO) in SUP 1.5.2. We have built a mobile application for a blackberry device which consumes two ERP web services. The application deploys successfully and runs on the blackberry device just fine. However, untill now the user credentials needed to authenticate a consumer to a web service has been hard-coded into the mobile business object. This, from an accountability point of view, is not an acceptible model (i.e. all mobile users would be logging in to the ERP backend with 1 common user ID).
    Has anyone had any experience and could suggest an an alternative solution to this that would support accountability i.e. map SUP users to ERP users, trusted connections etc. and is this possible with SUP 1.5.2?
    S

    Actually, SUP 1.5.2 just provides the HTTP basic authentication for WS-MBO. It is enable that to create 'username' and 'password' on the WS-MBO as two input parameters. Thus, you can design your device app in SUP to prompt the dialog to accpet the username and password before you access your WS-MBO. Similar, if your web-service has input argument for username and password, you also can design a dialog like above.

  • Server-side authentication for web services

    I was hoping to use Azure's server-side authentication for a HTML/JS web app. Some things are a bit unclear. For example, if a new user authenticates via Facebook, I want to create an associated record on the server-side and associate extra data with the
    user, irrespective of the service used to log in. If they log in again, I want the client to be able to get this extra data (eg preferences) from the server. On the back-end, I also want to be able to update particular fields of this record that the user cannot
    change themselves. I know how to go about this in a plain Node.js backend, but not sure how some of these basic things map to using Azure's services.

    Once the user logs in, you will have their information available to your server scripts. So one option is to use a custom API (or a Mobile Services Table) to insert/read/update the user data. You would protect this endpoint so that only logged-in users can
    access it, and then access the
    user object to obtain an ID an associate it in a table row. Lookups could be performed by similarly querying for the ID.
    In terms of some fields being restricted, you could remove these from the update request itself.
    Some pointers that might be helpful:
    http://azure.microsoft.com/en-us/documentation/articles/mobile-services-html-get-started-data/
    http://azure.microsoft.com/en-us/documentation/articles/mobile-services-html-call-custom-api/
    http://azure.microsoft.com/en-us/documentation/articles/mobile-services-html-authorize-users-in-scripts/

  • User Authentication for Web Services

    Hi,
    I am developing a web services that resides in Intranet. Thus, would like to implement application layer of user authetication, i.e. to match the input user name and password against Database record through a web service logon() method. If authentication is passed, the client program is allowed to call subsequence web service methods, else exception needs to be thrown when calling subsequence methods.
    As understand that each method call to web services is treated seperately. Thus, how can we implement the authentication so that the client program only passes in the user name and password at once through logon() method, instead of perfoming the authentication for each method?
    Appreciate the advice. Thanks.

    Hi,
    But, I need to develop the web services logon method using WSDL which generated the LogonBindingImpl.java, instead of web services using EJB bean.
    Besides, the Web Service logon method (LogonBindingImpl.java) need to accept the input user name and password to check with the user name and password that stored in database table through the EJB bean. If checking successful, client program is allowed to invoke other WebServices method, else login failed exception need to be thrown when client calling other web services methods.
    Appreciate the advice here on how to achieve that. Thanks.

  • Setting Basic Authentication for Web Service in WLS 6.1

    Hi,
    I am trying to set-up a Basic Username/Password authentication for a Web Service
    that is hosted in WLS 6.1.
    How do I go about doing that? Also once I get the username and password, how do
    I pass that info
    to the SOAP servlet to do the authentication? Can you give me some pointers on
    this?
    Thanks
    Madhu

    How do you want to do it? Through use of client.jar for the service or
    directly? Here is how I do it directly:
    String auth = "guest", pwd = "guest";
    URL url = new URL("http://localhost:7001");
    URL cmdURL = new URL(url.toString()+"/systemtest/TestWebService");
    HttpURLConnection conn = (HttpURLConnection) cmdURL.openConnection();
    String encAuth =
    new BASE64Encoder().encode((auth + ":" + pwd).getBytes());
    // BASE64Encode distributes long strings on multiple
    // lines; we don't like that, no siree
    int it = 0;
    while ((it = encAuth.indexOf('\n')) != -1
    || (it = encAuth.indexOf('\r')) != -1) {
    encAuth = encAuth.substring(0, it) +
    encAuth.substring(it + 1);
    conn.setRequestProperty("Authorization", "Basic " + encAuth);
    conn.setRequestProperty("Content-Type", "text/xml");
    conn.setRequestProperty("SOAPAction", cmdURL.toString());
    conn.setDoOutput(true);
    conn.setDoInput(true);
    conn.setUseCaches(false);
    OutputStream oStr = conn.getOutputStream();
    String cmd =
    "<?xml version=\"1.0\" ?>\n"
    + "<soap:Envelope xmlns:soap=\"http://schemas.xmls"
         + "oap.org/soap/envelope/\"><soap:Body>"
    + "<ping><arg0>false</arg0></ping>"
    + "</soap:Body></soap:Envelope>";
    oStr.write(cmd.getBytes());
    oStr.close();
    InputStream iStr = conn.getInputStream();
    byte[] buffer = new byte[1024];
    while (true) {
    int size = iStr.read(buffer);
    if (size == -1)
    break;
    System.out.println(new String(buffer, 0, size));
    ThorAAge

  • Kerberos Authentication for EP 7.0 Portal

    We are implementing Kerberos Authentication on our EP7 Portal. In our landscape we have
    2 main domains (US & INTL). In each of the domain we have several domain controllers (more than 10 each). We had the following queries:
    1) We have a mix of domain controllers running on win 2000 and win 2003. Will this cause any issue with the SPNego configuration?
    2) Since we have more than 10 DCs in each domain do we need to add all the DCs as KDCs in the step 2 of SPNego wizard?
    System Details
    1) Portal Version à EP7 SP13
    2) Operating System à SunOS (sparcv9) 5.9
    3) LDAP à MS ADS
    4) DB à Oracle 10.2.0.2.0 - 64bit
    Thanks.

    Hi Lisandro,
    For Q1:  I don't think there should be a problem with the mixture of DCs types.
    For Q2: You only need to configure one DC in the wizard (a W2003 server may be the best choice). This is just the DC that the wizard talks to during configuration.
    Hope this helps,
    Darren

  • Kerberos Authentication for Oracle 9i ODBC

    Hi,
    I want to connect to Oracle 9i database through ODBC with Kerberos Authentication. Can any one able to provide some document/Sample Code/Web Resource ???
    Thanks,
    Zahir

    Hi,
    I want to connect to Oracle 9i database through ODBC with Kerberos Authentication. Can any one able to provide some document/Sample Code/Web Resource ???
    Thanks,
    Zahir

  • HTTP Basic authentication for proxy service and its wsdl?

    Hello:
    For some reasons I needed to configure the HTTP basic authentication on a proxy service at OSB 11g. Everything was OK until I realized that, additionally to the authentication when calling the service, the OSB also asks for credentials when I try to get that proxy wsdl file.
    My requirements are to secure the proxy service when is called only, not when retrieving the wsdl.
    Is this possible to configure on OSB / WLS? How?
    Greetings!
    Edited by: user4483647 on 02-sep-2010 12:59
    Edited by: user4483647 on 02-sep-2010 13:25

    If I'm not wrong, Basic authentication is Transport level feature. So passing User/Password in SOAPHeader doesn't make sense. SOAP message can only be sent when you have a HTTP Connection open. During opening of HTTP connection User/Password is required for basic authentication.
    http://www.student.nada.kth.se/~d95-cro/j2eetutorial14/doc/Security7.html#wp156943
    Edited by: mneelapu on Apr 2, 2009 2:09 PM

  • Basic Authentication for Web Services

    I have build Web Service according to the weblogic 6.1 examples
    successfully deploying the .ear file etc.
    Now I want to add security to the WebService uri.
    I have added a <web-resource-collection> tag to the web.xml file, but
    what should I put for the <url-pattern> ?
    Am I obliged to 'manually' add <servlet> tags to the web.xml file in
    order to add a security constraint to a WebService deployed thru a
    .ear ?
    Taking WebLogic's own statelessSession.Weather example, what is the
    minimum I need to add to the web.xml file to have basic authentication
    on the weatheruri ?
    Thanks,
    Adam

    Ok, now I'm confused.  Is this a Flex app (runs in the browser) or an AIR app?  This makes a difference because in the browser, Flash Player/Flex uses the browser's http mechanism for transport, while AIR implements it directly.  The original posted indicated some difference between Firefox and IE, which led me to believe it was a Flex browser app.  Difference between these two would make me think something was wrong with the server response, and the two browsers were passing it (the problem) back to Flash Player differently.
    Mark

  • Implementing authentication for web services

    Hi all,
    I'm struggling trying to guess how to implement basic HTTP authentication as well as using certificates in order to apply HTTPS, for some web services we've created, running on the Oracle Application Server 10.1.12. The web services were implemented using JDeveloper 9.0.4. Any help would be very appreciated.
    Thanks in advanced and regards,
    Luis

    Hi,
    But, I need to develop the web services logon method using WSDL which generated the LogonBindingImpl.java, instead of web services using EJB bean.
    Besides, the Web Service logon method (LogonBindingImpl.java) need to accept the input user name and password to check with the user name and password that stored in database table through the EJB bean. If checking successful, client program is allowed to invoke other WebServices method, else login failed exception need to be thrown when client calling other web services methods.
    Appreciate the advice here on how to achieve that. Thanks.

  • Authentication for multiple services

    I wanna setup a bunch of web services (squirrelmail, blojsom blog, dokuwiki wiki, and an online calendar system - if i can find one). Obviously, I want to make these private, so only employees see them. All of these require separate authentication. Is there a way I can use one login/pass for all these, so they don't have to keep logging in to each individual service? like they go to:
    domainname.com/services
    and then login, and all their stuff is available.
    Any hints?

    I wanna setup a bunch of web services (squirrelmail, blojsom blog, dokuwiki wiki, and an online calendar system - if i can find one). Obviously, I want to make these private, so only employees see them. All of these require separate authentication. Is there a way I can use one login/pass for all these, so they don't have to keep logging in to each individual service? like they go to:
    domainname.com/services
    and then login, and all their stuff is available.
    Any hints?

Maybe you are looking for