Jonathan Gardner » SQL Server

SRS Double Hop Authentication

Jonathan — Fri, 09 Sep 2011 16:35:25 +0000

I was recently asked by a client to architect a data and reporting environment. Part of the business requirements was separation of the production database server and the reporting services server. Another part of the business requirements stated that the reports were to leverage a shared data source and Windows Authentication. While none of the business requirements were a problem for the SQL Server 2008 R2 environment I was creating, there was an issue with the double hop authentication. I struggled to find a guide to setting this up in the BOL or on any of the usual blog suspects. After opening a case with Microsoft I finally got all the information.

Architecture

This article will cover implementation of a 3-Tier SQL Server 2008 R2 reporting services installation. For this discussion the database will be running on SQL01. Reporting Services will be running on SRS01, and the client consuming the reports will be a local workstation LAPPY386.

Reporting Services Configuration

NOTE: This article assumes that Microsoft best practices were followed and the SQL Server services are running under domain accounts.

To use double hop authentication, SRS uses Kerberos authentication. This is not enabled by default in the reporting services configuration. It is added to the reporting services configuration file. For a default installation the file is C:\Program Files\Microsoft SQL Server\MSRS10_50.MSSQLSERVER\Reporting Services\ReportServer\rsreportserver.config. Edit this file in notepad and add thetag in the authentication section. Once the file is modified it should look like the section below.

; ; ;

Modifications to the Reporting Services configuration file requires a restart of the services to take effect.

Service Principal Names

This article is not about SPNs so I won’t go into detail about them. In short, they help facilitate authentication for a service when it executes. You can find more information about SPNs in the Books Online here.

Without the SPNs set properly the following error is a common issue:

 An error has occurred during report processing. (rsProcessingAborted)      Cannot create a connection to data source 'Datasource'. (rsErrorOpeningConnection)           Login failed for user 'NT AUTHORITY\ANONYMOUS LOGON'.

SPNs need to be set on the SQL Server, SQL01, and the Reporting Server, SRS01. Setting a SPN is done through the SetSPN.exe tool run from the command line. The URL of the SPN needs to be set the same way the data source will be configured. For good measure, always enter both the short name and the FQDN to make sure that it will function if someone comes behind me and creates a data source with either server name. The URL needs to be set with the proper port number. Below the default SQL Server port is used but for a named instance or non-default port this will need to be adjusted accordingly. A port number only needs to be specified for the SRS http SPN when a non standard port is used. The SPN is set for the service account that is being used.

On SQL01:

SetSPN –A mssql/sql01:1433 domain\SQLServiceAcct

And

SetSPN –A mssql/sql01.domain.local:1433 domain\SQLServiceAcct

ON SRS01

SetSPN –A http/srs01 domain\SRSServiceAcct

SetSPN –A http/srs.01.domain.local domain\SRSServiceAcct

A restart of the SQL Server or Reporting Server services is not required for the SPN to take effect but it will have to propagate throughout the domain. The frequency of this varies. If you are an Enterprise Administrator and want to force this replication in your domain, information to do that can be found here.

To ensure that the SPN has been configured correctly for each account the SetSPN command is able to list all SPNs set for a service account.

SetSPN –L domain\account

It also can check the entire domain for duplicate SPN entries.

SetSPN –X

With all of this in place the double hop authentication should now be working.

UPDATED:

Vijay Krishnan (Blog | Twitter ) pointed out something I was missing in this guide.

Account Delegation

The service account domain\account needs to be configured for Kerberos Delegation. The configuration needs to be set on the service account in Active Directory. See the image below for the setting.

SQLSaturday #57, Houston

Jonathan — Fri, 23 Jul 2010 20:51:09 +0000

As Cochair of the planning committee I am very pleased to announce that we are officially having a SQLSaturday in Houston. The event will be on January 29th, 2011 at the Bammel Church of Christ.

Co Chairs

Jonathan Gardner (Blog|Twitter)

Malik Al-Amin (Blog|Twitter)

Nancy Hidy Wilson (Twitter)

Information

We have created a Twitter account @SQLSatHou to distribute information. Please use the hastag #SQLSat57 when discussing the event and it will show up on the official SQLSaturday site.

The official SQLSaturday #57, Houston website is here.

Volunteers

We are always looking for people to help out. On the registration page there is a section to volunteer. I would highly encourage everyone to do this. While my motives are a bit selfish, it is really a great way to network with other volunteers and give back. If that is not enough, check out David’s Post on Five Reasons You Should Volunteer with Your Local SQL User Group and Host a SQL Saturday

Hope to see you there!

Using Model to Change Default Database Settings

Jonathan — Mon, 12 Apr 2010 19:35:37 +0000

During a Twitter conversation today Malik Alamin (Twitter) asked about the Autogrow settings on his databases. The conversation naturally progressed to the question of how you change the default behavior and set all newly created databases to have user defined settings. Brent Ozar (Blog | Twitter) was able to point us in the right direction to find a solution. Modifying the model database.

About the model Database

When a new database is created either by using the CREATE DATABASE statement, that mean via SSMS as well, the model database is used as a template. This means that change made to the model database settings, including tables, permissions, stored procedures, and functions will all transfer over to the newly created database.

According to the TechNet article about the model database some file sizes may look different depending on what version of SQL Server is installed. Also, there are some things that cannot be modified in the model database. Items like CHANGE_TRACKING, ENCRYPTION, and TRUSTWORTY cannot be modified. A full list of restrictions can be found in the TechNet Article.

Example

I need to set the auto grow on my data file to Autogrow by 10% instead of 1 MB as was the default on my instance. I can run the ALTER DATABASE command or use SSMS against the model database

USE [master] GO ALTER DATABASE [model] MODIFY FILE ( NAME = N’modeldev’, FILEGROWTH = 10%) GO USE [master] GO ALTER DATABASE [model] MODIFY FILE ( NAME = N’modeldev’, FILEGROWTH = 10%) GO

Making these changes will alter all newly created databases to have the same settings.

Note: Jorge Segarra (Blog | Twitter) pointed out that this does NOT work in a SharePoint environment. SharePoint does not use the model database when it creates new site databases.

What Features Visual Studio 2010 Offers DBAs and Database Devs

Jonathan — Thu, 08 Apr 2010 15:00:23 +0000

I was recently reviewing some the change management and document control policies that governs our IT group. While I have been confirming to these change management policies I started to think back on how we make our developers work with code.

We have deployed a Team Foundation Server 2010 and are using it for source control and remote build functionalities. We require all source code to be managed and maintained on the TFS. We also work with a Test Driven Development philosophy creating Unit Testing to ensure code integrity as members of the team work on different aspects of an application.

It seems that we were holding our database developers (i.e. me) and our application developers to two different standards. This article is the first in a series to explore what Visual Studio 2010 and TFS 2010 has to offer for Database Developers and DBAs.

These topics will include but not be limited to:

Database Deployment
Database Change Management
Database Unit Testing
Database Test Data Generation
Data Access
Version Control
Build Automation

Some of these features are only available in certain versions of Visual Studio and/or only available via TFS. I will outline and note these feature when we cross them. Keep an eye out for our first article on Database Deployment next week.

Using Joins instead of Sub Queries: a Case Study

Jonathan — Thu, 10 Dec 2009 21:45:24 +0000

During a recent upgrade from SQL 2000 to SQL 2005 some poorly written code was exposed on a custom web application. Users and developers started reporting that their applications were timing out. One of the queries I posted in the Execution Plan Challenge. Another exposed query involved a sub query.

    FROM
        SUM_METER_DAILY a,
        METER_MASTER b,
        MS_METER c
    WHERE
        b.METER_ID IN (SELECT DISTINCT d.METER_ID
            FROM LINE_SEGMENT_DETAIL d
            WHERE d.LINE_SEGMENT = @LINESEG)

While this was not the only issue with this query the execution plan showed that 88% of the query time was being spent on the SELECT DISTINCT portion of the query. It was taking over 4 min to return a result set that contained only 55 rows.

By using the joins below we were able to reduce the time of the query from over 4 minutes to sub 1 second.

FROM dbo.MS_METER b INNER JOIN dbo.SUM_METER_DAILY a ON a.METER_ID = b.METER_ID INNER JOIN dbo.MS_METER_CFG c ON b.METER_ID = c.METER_ID INNER JOIN dbo.BAL_GROUP_ASSIGNMENTS e ON c.STATION_ID = e.OBJECT_ID INNER JOIN dbo.BAL_GROUP f ON e.PARENT_BAL_GROUP_ID = f.BAL_GROUP_ID

WHERE b.METER_IDNUM is not NULL
    AND a.IN_USE_FLAG = 1
    AND a.CONTRACT_DAY <= @CONTRACTDATE
    AND a.CONTRACT_DAY >= DATEADD(DAY, -4, @CONTRACTDATE)
    AND a.IN_USE_FLAG = 1
    AND f.BALANCE_GROUP_NAME = @LINESEG

Are Joins better than Sub-Queries. The answer to that question is the same as the answer to most SQL questions. 'It depends’. Joins and Sub-Queries need to be taken on a case by case basis.

In this case the major problem was the SELECT DISTINCT in the subquery. Using a subquery forces SQL to evaluate each row in the outer query. Using DISTINCT in the subquery means that the subquery must do a complete scan of the table, sort the values and then return TRUE if any rows are returned.

If you have examples of subqueries that are faster than a join to return the same data set we would love to share them with everyone.

References:

Using Subqueries, http://docs.hp.com/en/36216-90103/ch03s02.html

User and Schema Association after Restore on DR Computer

Jonathan — Tue, 27 Oct 2009 12:53:43 +0000

I was faced with a situation I have yet to encounter as a DBA. I don’t know why I have yet to find this but I will write about it anyway. I have been working on a side by side upgrade/migration project going from SQL Server 2000 to SQL Server 2005. I have the two boxes configured but in the upgrade we are also going to have to correct some ‘error’ in security. It is because of this fact that I just can’t migrate the master database and get all of my user associations back working together.

The Problem

When we restored the database it contained users and schema that were no longer associated with security logins on the new server. When this happens and you add the Security User with the same name you can’t associate it with the user permissions on the database. If you do you will get the following error message

User, group, or role ‘NewUser’ already exists in the current database. (Microsoft SQL Server, Error: 15023)

This can be corrected if the ‘NewUser’ is removed from the security on the specific database, however if the ‘NewUser’ owns any schema you will not be able to drop him without dropping the schema and you can’t drop the schema if the schema is associated with any other database object. You get my point.

The Solution

In order to keep the chain I used the ALTER AUTHORIZATION command to change the owner of the ‘NewUser’ schema to ‘dbo’. Once the owner of the schema has changed I am free to drop the user and recreate him by associating the database user with the database. After I have recreated the login I am able to run the ALTER AUTHORIZATION command again and change the owner of the ‘NewUser’ schema back to the ‘NewUser’ that I just created. I have attached the code that I used below as an example.

p style=”padding-left: 60px; “>USE DB1 GO

p style=”padding-left: 60px; “>ALTER AUTHORIZATION ON SCHEMA::NewUser TO dbo; GO

IF EXISTS (SELECT * FROM sys.database_principals WHERE name = N’NewUser’)

p style=”padding-left: 60px; “>DROP USER [NewUser] GO

p style=”padding-left: 60px; “>USE [master] GO

p style=”padding-left: 60px; “>ALTER LOGIN [NewUser] WITH DEFAULT_DATABASE=[DB1], DEFAULT_LANGUAGE=[us_english], CHECK_EXPIRATION=OFF, CHECK_POLICY=OFF, NO CREDENTIAL GO

p style=”padding-left: 60px; “>USE [DB1] GO

p style=”padding-left: 60px; “>CREATE USER [NewUser] FOR LOGIN [NewUser] GO

p style=”padding-left: 60px; “>USE [DB1] GO

p style=”padding-left: 60px; “>EXEC sp_addrolemember N’db_datareader’, N’NewUser’ GO

p style=”padding-left: 60px; “>USE DB1 GO

p style=”padding-left: 60px; “>ALTER AUTHORIZATION ON SCHEMA::NewUser TO NewUser; GO

There are some things to keep in mind here. It is better if you can restore the master database to restore all of the users. It is also important to know that in doing this the password for the user must either be known or reset. Doing so is not an easy task if you have many database users.

Links of the Week (9/25/2009)

Jonathan — Fri, 25 Sep 2009 19:56:31 +0000

SQL

SQL WHERE Clause Optimization – Query optimization can make or break an application. Understanding how a WHERE clause can affect a query is very important. This article helps shed light on that.

Creating Dynamic Output in SSIS – SQL Integration Services is one of SQL Servers most powerful features. This article will demonstrate how to build dynamic output into a SIS package.

SQL Server Reporting Services Conditional Formatting – Help information stand out in your reports.

Lessons Learned: Why is my tlog backup huge at 5am – Article explaining what rebuilding index files will do to a logfile backup.

Microsoft Project and Project Server

Project Server 2007 Report Pack II – Little did I know that Microsoft had written a series of reports for Project Server. Now I don’t have to go write my own. This makes me happy.

Microsoft Project 2010 Demo Videos – As a project manager I spend lots of time dealing with Project and Project Server. The new apps look great!

Technology Links of the Week (9/11/09)

Jonathan — Fri, 11 Sep 2009 19:22:53 +0000

SQL Server

Retaining historical index usage statistics for SQL Server

Ten Common SQL Programming Mistakes

Maximizing work space with SQL Server Management Studio by using separate results tabs

SQL Server 2008 R2 Hands-on Lab

Apple

Mac OS X Snow Leopard: The Complete Guide

Technology Links of the Week (6/29/09)

Jonathan — Mon, 29 Jun 2009 21:25:46 +0000

I have been spending most of my time in SQL Server lately so this weeks Technology Links will be centered around SQL.

SQL Server

Execute SQL and Bulk Insert Tasks in SSIS

Backup Monitoring and Reporting

SQL Databases That Have Not Had a Full Backup in x Days

Using SQL Server Data Mining Add-Ins for Office 2007 to Predict Database Growth Trends

Operations Manager

Configuring IM Notifications in System Center Operations Manager 2007

SQL Server Integration Services

Jonathan — Wed, 03 Jun 2009 12:33:00 +0000

I was recently asked to work on a project where I needed to export data from our accounting database, transform it and then insert it into another database to be accessed by application in our edge network. Having spent most of my days as a ‘Jack of All Trades’, I had yet to dig into Integration Services. Through the course of my recent project, I have found that I have sadly missed out.

According to Microsoft, Integration Services is ‘used to solve complex business problems by copying or downloading files, sending email- messages in response to events, updating data warehouses, cleaning and mining data, and managing SQL Server objects and data.’ What Integration Services really does is bring all of the SQL services together.

As a student of David Allan’s Getting Things Done and Tim Ferriss’ The 4 Hour Work Week, I am always looking for ways to automate my life. Integration Services allows me to automate administrative tasks that I find myself performing on a regular basis. Actions like bulk data loading, copying/modifying database objects, and moving data from an OLTP into a data warehouse can be easily automated via on demand commands or scheduled jobs.

For readers not familiar with SQL Server Integration Services I would start with information straight from the source. Microsoft provides lots of information and feature outlines on the SQL Server website.

Future posts will cover Integration Services in greater detail with examples of specific solutions.