SSRS: authentication error 14

I hate the SSRS error:  authentication error 14 in the http log of SSRS.

Time to time we have this issue , even though the farm is already established and we haven't changed anything in the topology.

We have 2 SharePoint WFEs and one SSRS server, SSRS is in integrated mode.

Here are few posts that I have found describe the error with different causes:

Web service request failed with HTTP status 401: Unauthorized in ssrs 2008 r2

Troubleshooting HTTP Errors

But, unfortunately all of these didn't help to resolve the authentication error 14.


What we noticed that we can have such error on one WFE, but other WFE  still can call SSRS to render the reports.
We saw a correlation between free memory and ability SharePoint to call SSRS.

Even though we can have 5 gb of available , but free can be lower 1 GB.

In this case SharePoint can't call SSRS server.

The easiest and not so smart action to make SSRS worked on this WFE is:

1. On WFE: IIS reset;

2. SSRS: server reboot,

3. SSRS: SSRS Service re-start

I would glad to hear your comments on this issue and suggestions how can I intelligently resolve this issue.

rsviewerpage.aspx Type Sys.UI._Timer has already been registered

You have configured SSRS on SharePoint 2010. You successfully open report builder and run report, but when you try to run it through rsviewerpage.aspx it stucks.

My suggestion, as usual, look at the logs:
 - ULS;
 - SSRS log (SSRS: How to troubleshoot?)

But in this specific case, I found really helpful look at the F12 Developer tools panel in IE.
In console I found an error:
Type Sys.UI._Timer has already been registered
SCRIPT5022: Sys.ScriptLoadFailedException: The script '{your portal url}/ScriptResource.axd?d={some data}


It turned out that the error in rsviewerpage.aspx is due to configuration in this specific web application:
Check in web.config the following:
 <compilation batch="false" debug="false">

In case debug="true" rsviewerpage.aspx gives you that error. As you may guess, once you set debug="false" reports will run successfully.

I officially announce such behavior as a bug in SharePoint 2010 and SSRS integrated mode:

   Setting in the web.config debug="true" will case an error Type Sys.UI._Timer has already been registered in the rsviewerpage.aspx  and report stucks

Simple concept: when to use Reporting Services (SSRS) and when to use PerformancePoint Services 2010

[Question]:
When to use SQL Server Reporting Services (SSRS) and when to use PerformancePoint Services 2010"?

[Answer]:
PerformancePoint Services excels in the creation of KPIs and scorecards. If you need other type of reports (tabular, interactive, visual, or freeform), you will need SQL Server Reporting Services (SSRS).

BI: essential terminology and understanding

Have you ever asked yourself:
What is KPI?
What is Scorecard?
What is Dashboard?
And anyway what is BI?

Here is a quick picture of BI (Business Intelligence)

Here is BI terminology:

BI- business intelligence - include historical and current views of business operations, and they may also include predictive views.

KPI -key performance indicator. example: Sales numbers, Profit numbers, Percentage of happy employees, student graduation rates in a school, number of points scored by a football team.

Scorecard - contains a small selection of essential KPIs

Dashboard - might contain multiple scorecards, independent KPIs that are not part of any scorecard, standard reports, other non BI functionality (i.e. a discussion board)

Source - Microsoft SharePoint 2010 Administrator's Companion

SSRS: Performance

SSRS Add-in installation:

http://technet.microsoft.com/en-us/library/aa905871(v=sql.100).aspx

SSRS Performance Optimizations:

http://sqlcat.com/sqlcat/b/technicalnotes/archive/2009/01/14/reporting-services-performance-optimizations.aspx

Monitoring SSRS Performance:

http://www.pertell.com/sqlservings/archive/2011/11/monitoring-ssrs-report-performance-part-4

SSRS Memory Pressure zone:

http://www.bidn.com/blogs/JeffRush/ssas/1330/ssrs-memory-pressure-zones

SSRS HTTP Errors:

http://msdn.microsoft.com/en-US/library/ms159778(v=sql.100).aspx

SSRS Authentication (why we do need just RSNegotiateNTLM)

http://msdn.microsoft.com/en-US/library/cc281253(v=sql.100).aspx

SQL Server 2008 Reporting Services for high-availability deployment

http://searchsystemschannel.techtarget.com/feature/SQL-Server-2008-Reporting-Services-for-high-availability-deployment 

SSRS: Errors

SSRS makes my life unbearable.

This post for everyone who suffers with SSRS errors in SharePoint.

Here is the links that may help to identify the cause of the error:

From my experience with SSRS:

SSRS: How to troubleshoot?

SSRS and SharePoint 2007: How to configure

Simple concept: SSRS authentication

SSRS: authentication error 14 (not so smart temporary fix)

From others:

Session Timeout during execution SSRS reports

Timeouts and Microsoft SQL Server 2005 Reporting Services

Troubleshooting Server and Database Connection Problems

Reporting Services Log Files

Troubleshooting Concepts (Reporting Services)

Installing and Configuring SQL Server Reporting Services

Report Server Service Trace Log

Quick notes:

 -  The reports are slow? and SSRS log file doesn't refresh much?
 Look at the  ULS log whether the SharePoint server has an error with loading dll:

Error: Failure in loading assembly: 

Fix the error via: editing web.config file for a web application or adding the missing dll into GAC. In mycase it helped to start reports quicker.

SSRS: How to troubleshoot?

Got weird errors on SSRS?: 
such as below:

• An error occurred during client rendering.
  • Too many automatic redirections were attempted. 

The good place to start is:

1.

SSRS logs

C:\Program Files\Microsoft SQL Server\MSRS10.MSSQLSERVER\Reporting Services\LogFiles
(assuming that you have C:\ as a system drive)
2.
Find error and google it.

P.S.
In case you have found this post by searching:

• An error occurred during client rendering.
  • Too many automatic redirections were attempted. 

You may have problem with HTTPS communication.

Check the config file for SSRS:

C:\Program Files\Microsoft SQL Server\MSRS10.MSSQLSERVER\Reporting Services\ReportServer\rsreportserver.config

If you need to have HTTP connection: set

<Add Key="SecureConnectionLevel" Value="0"/> instead of 2

Integrated Windows authentication: NTLM or Kerberos?

Recently, I have been studied the topic "Kerberos: Why do I need it?"


Here is a quick explanation (from Configuring Kerberos Authentication for Microsoft SharePoint 2010 Products)what is Integrated Windows Authentication and relation to NTLM and Kerberos:

Integrated Windows authentication enables Windows clients to seamlessly authenticate with SharePoint Server without having to manually provide credentials (user name/password). Users accessing SharePoint Server from Internet Explorer will authenticate by using the credentials that the Internet Explorer process is running under — by default the credentials that the user used to log on to the desktop. Services or applications that access SharePoint Server in Windows integrated mode attempt to authenticate by using the credentials of the running thread, which, by default, is the identity of the process.

NTLM

NT LAN Manager (NTLM) is the default protocol type when Integrated Windows authentication is selected. This protocol takes advantage of a three-part challenge-response sequence to authenticate clients. For more information about NTLM, see Microsoft NTLM (http://go.microsoft.com/fwlink/?LinkId=196643).

Pros:

·         It is easy to configure and typically requires no additional infrastructure/environment configuration to function

·         It works when the client is not part of the domain, or is not in a domain trusted by the domain that SharePoint Server resides in

Cons:

·         It requires SharePoint Server to contact the domain controller every time that a client authentication response needs validation, increasing traffic to the domain controllers.

·         It does not allow delegation of client credentials to back-end systems, otherwise known as the double-hop rule. It is a proprietary protocol.

·         It is a proprietary protocol.

·         It does not support server authentication.

·         It is considered less secure than Kerberos authentication

Kerberos protocol

The Kerberos protocol is a more secure protocol that supports ticketing authentication. A Kerberos authentication server grants a ticket in response to a client computer authentication request, if the request contains valid user credentials and a valid Service Principal Name (SPN). The client computer then uses the ticket to access network resources. To enable Kerberos authentication, the client and server computers must have a trusted connection to the domain Key Distribution Center (KDC). The KDC distributes shared secret keys to enable encryption. The client and server computers must also be able to access Active Directory directory services. For Active Directory, the forest root domain is the center of Kerberos authentication referrals. For more information about the Kerberos protocol, see How the Kerberos Version 5 Authentication Protocol Works (http://go.microsoft.com/fwlink/?LinkId=196644) and Microsoft Kerberos. (http://go.microsoft.com/fwlink/?LinkId=196645)

Pros:

·         Most secure Integrated Windows authentication protocol

·         Allows delegation of client credentials

·         Supports mutual authentication of clients and servers

·         Produces less traffic to domain controllers

·         Open protocol supported by many platforms and vendors

Cons:

·         Requires additional configuration of infrastructure and environment to function correctly

·         Requires clients have connectivity to the KDC (Active Directory domain controller in Windows environments) over TCP/UDP port 88 (Kerberos), and TCP/UDP port 464 (Kerberos Change Password – Windows)

Long story short, I have decided that I am willing to spare time and configure Kerberos if I see the farm desperately needs following:

 1. Boost performance

 2. SSRS reports needs to pass a user credentials to external source like this one:

3. BDC uses Web services that needs to pass a user token to the external source

4. Any other type delegation (which is not present in my specific scenario but it might be in your case)

Simple concept: SSRS authentication

[Question]: How to figure out what authentication does SSRS use? Is Kerberos enabled ?


[Answer]:


Go to the box where SSRS service is running;
"{System drive}:\Program Files\Microsoft SQL Server\MSRS{some numbers}.MSSQLSERVER\Reporting Services\ReportServer\rsreportserver.config"


Check the section: "Authentication"


For example, the value for SSRS authentication without Kerberos which SSRS service runs under not NetworkService or LocalSystem account:



<Authentication>
<AuthenticationTypes>
<RSWindowsNTLM/>
</AuthenticationTypes>
<RSWindowsExtendedProtectionLevel>Off</RSWindowsExtendedProtectionLevel>
<RSWindowsExtendedProtectionScenario>Proxy</RSWindowsExtendedProtectionScenario>
<EnableAuthPersistence>true</EnableAuthPersistence>
</Authentication>

The explanation of the value is here - How to: Configure Windows Authentication in Reporting Services


More on that: Authentication Types in Reporting Services 

SSRS and SharePoint 2007: How to configure

You want to integrate SQL Report Services with SharePoint? That's a quiet easy but make sure that you follow these steps:

 0. Install SSRS on the same machine where your one of the web front is.
 1.  Download the  rsSharePoint.msi (Microsoft SQL Server 2008 Reporting Services Add-in for Microsoft SharePoint Technologies)
 2. Run as admin  msiexec -i rsSharePoint.msi SKIPCA=1. ( How to: Install or Uninstall the Reporting Services Add-in)
 3. Locate under the temp folder( cmd: CD %TEMP% )  and run rsCustomAction.exe /i

 This way you will see the actions that are being performed. Read it carefully in the real time - to catch the reason of errors in case rsCustomAction.exe fails

 One of the issue I saw on that step is the Administrator doesn't have access to the Central Administration to activate Report Server feature.

 The solution for this error is to add the  administrator (the user that you use to run rsCustomAction.exe) as a site collection administrator.

To troubleshoot the SSRS errors - make use of it SSRS log file - %programfiles%\Microsoft SQL Server\<SQL Server Instance>\Reporting Services\LogFiles  - SQL Reporting Services Log Files .

SSRS: Export the report : Internet Explorer cannot download RInternet Explorer cannot download ReportViewerWebPart.axd from

If you are experience problem with exporting the report and getting the error:
Internet Explorer cannot download RInternet Explorer cannot download ReportViewerWebPart.axd from

The following steps might help you resolve the issue:

1. In Internet Explorer, select "Internet Options..." from the "Tools" menu.

2. Click on the "Advanced" tab.

3. Scroll down to the "Security" section.

4. Un-tick the "Do not save encrypted pages to disk" check box.

5. Click the "OK" button.