The wonders of Kerberos, SharePoint and SQL Reporting Services

OK, so we’re trying to get a little more modern here, decreasing our reliance on Oracle Reports (yetch!) and Access based reporting (shudder) and move on to the spiffy SQL Server Reporting Services, only 2005, but hey, we have to start somewhere.

Given that our Intranet is SharePoint based (full MOSS2007), I of course wanted to run SSRS in integrated mode, so along came Kerberos.

I’ve had Kerberos working for SharePoint for some time now, so thought it would be a doddle to get SSRS integrated, boy was I wrong.

First up, turned out that none of our SQL servers had registered server principal names with AD, so:

Setspn –a MSSQLSvc/NETBIOSNAME_IN_UPPERCASE:PORT DOMAIN\DOMAINACCOUNT_THAT_SQL_IS_RUNNING_UNDER
Setspn –a MSSQLSvc/FQDN_NAME_IN_UPPERCASE:PORT DOMAIN\DOMAINACCOUNT_THAT_SQL_IS_RUNNING_UNDER

Note: the inclusion of the PORT, not all of the documentation mentions that for SQL…
Note: uppercase – yes, dispite the MS documentation stating that “as long as you’re only using Kerberos against Windows machines, it’s case-insensitive”, I found that it didn’t work until I pushed the case up. No I haven’t tried combinations of case to find exactly where the case is important. Though according to the Kerberos tickets on my PC, my domain ticket has an all uppercase domain, but one of my SQL tickets has only the server name (and not the domain) in uppercase… go figure.

Having discovered the case sensitivity, I had to go back and re-do all my SharePoint SPNs and just to make sure, I doubled up on the ports too:

Setspn –a HTTP/NETBIOSNAME_IN_UPPERCASE DOMAIN\DOMAINACCOUNT_THAT_THE_SP_APPPOOL_IS_RUNNING_UNDER
Setspn –a HTTP/FQDNNAME_IN_UPPERCASE DOMAIN\DOMAINACCOUNT_THAT_THE_SP_APPPOOL_IS_RUNNING_UNDER
Setspn –a HTTP/NETBIOSNAME_IN_UPPERCASE:80 DOMAIN\DOMAINACCOUNT_THAT_THE_SP_APPPOOL_IS_RUNNING_UNDER
Setspn –a HTTP/FQDNNAME_IN_UPPERCASE:80 DOMAIN\DOMAINACCOUNT_THAT_THE_SP_APPPOOL_IS_RUNNING_UNDER

And now it all works, yay, with the current user authenticating all the way back to the DB.

Only took a few days to track that down. Kudos to the MS team producing the Troubleshooting Kerberos Delegation in Windows document which took me through a very rigorous set of steps to ensure I was configured correctly (though more help on what Kerberos should look like in NetMon would be good!) though doesn’t mention case-sensitivity, had to dig that up HERE.

Now we can get back to concentrating to actually delivering reports…

Microsoft Web Experience Events

Microsoft is hosting free Microsoft Web Experience events at the Los Angeles Microsoft office on June 8th and the Denver Microsoft office on June 15th. They will be presenting information on building the next generation user experience on the web. They are providing breakfast and lunch, hosting a reception with beer and wine, and attendees are automatically registered in a drawing for an XBox 360 and a Zune that will be given away at each event. For more information, visit http://kaevans.sts.winisp.net/Shared%20Documents/webexperience.aspx.

VMWare vs MS Virtual Server for MOSS2007 Development

OK, so it's been nearly two months since I last posted, but then the work I've been doing is a little hush, hush, at least as far as our competitors are concerned.

But here's a hint:

While investigating the state of MOSS2007 BDC generator tools, I came across Todd's post on virtual machine performance for MOSS2007 development.

Makes for very interesting reading and his results are probably not all that surprising. Pitty he didn't compare with a real machine as well...

Windows on a Mac is here

Windows on a Mac is here - Product Review - CNET Asia

Apparently some non-IT industry guys won the US$14000 competition to get Windows on Mac/Intel and now it looks like Apple are releasing the method into the wild!

Spot the entry that points to Photoshop running faster on Windows than on OS/X (on the same hardware)...

I don't think the writing is on the wall for OS/X fans, but at least they now have the option to switch OS's to suit the application they're running, without having to switch the hardware too...

I think this will be a boon (well, bust actually) for the Mac gaming industry, since there will no longer be a point to releasing Mac ports of popular games, since they could just run Windows anyway... It'll be interesting to see how the Mac community jumps on this one, since we've already seen what the Linux community feels...

Google Copies Corporate Data to Google's Servers?

Slashdot Google Copies Corporate Data to Google's Servers?

It's clearly stated during the install, but Google is getting busted for copying corporate files to Google's servers via Google Desktop.

I hate to say it, but it's all about user education and standardising corporate desktops.

If non-standard applications are being installed by uneducated users... the corporate already has an a problem.

We have a single standard desktop (IT Admins and Developers being the only major exceptions) and a rappidly improving change control process to go through if exceptions are required.

You're average corporate user should not have sufficient privledges to install aplications on their desktops. And yeah, I know the software people are finding new and clever ways to get around this, especially through the use of browser plug-ins, which often seem to require minimal privs to install/work.

If you must install Google Desktop or anything really, use Group Policy to limit or even lock down the configuration. Then if that's not enough, you can always use your firewalls or Intrusion Prevention devices to block the outgoing traffic.

But that's just my 2c. It's nice to feel that corporately, we're pretty much on top of this one... it's rare.

Chapman Tripp makes waves in the Geek Community - Slashdot | 'Infectious' Open Source Software?

Slashdot 'Infectious' Open Source Software?

Some of our lawyers wrote a piece for the New Zealand State Services Commission on the use of Open Source Software.

While I don't agree with everything they say, I wont speak up about it here (I have internally).

There a few more relevant bits on our website here & here.

Telecom takes a spanking...

It's about time and kudos to TV3's Campbell Live (who's sponsor is Telecom) for hosting an article on the poor state of Broadband in NZ [windows media].

Unfortunatly TV3 didn't stream the debate that followed, though some enterprising people have made it available:

NZ:
http://sneep.net/CL-Broadband.avi or
http://www.blakjak.net/adsl/CL-Broadband.avi

Non-NZ:
http://wibble.focb.co.nz/CL or
http://www.vonfluffy.net/files/CL-Broadband.avi
Google Video coming soon.

Personally, I think this is all long over due. Telecom are seriously holding up broadband in NZ. I'm not entirely convinced that unbundling the local loop is the answer, even though it's been done in all but one other OECD country (Mexico?). If I recall correctly, in Australia, unbundling did very little, it wasn't until Telstra's entire(?) country-wide backbone was made available to other ISPs (wholesale, at cost, aka level playing field) that Broadband took off in Aussie.

Telecom's UBS (Unbundled Bit Stream?) service is kind of like unbundling the local loop, but still has the drawbacks of:

• Telecom dictate speed (up and down)
• Telecom dictate base price
• ISP's still need (expencive, non-resiliant, archiach) connectivity between Telecom and their own networks, so that they can route the ADSL users over their own connections.

It's time the Commerce Commission got out it's big stick and gave Telecom a hard time. Tax payers paid for the "last mile" when Telecom was still Government owned. And while (to my understanding) Telecom's NGN (fiber/IP) network has been paid for by profits (since privitisation), it's aging ATM network (which must be used by ISPs for the UBS service!) was paid for by Tax Payers...

BTW Campbell Live then took on the duopoly of Telecom & Vodafone (showing that just one other competitor isn't really enough) in the cellphone war... Yes, NZ has the 2nd highest pricing on the OECD! Hmm... TV3 is going to start loosing sponsors... :0