locked
SSRS 2016 HTTP 400 Bad Request RRS feed

  • Question

  • New SSRS 2016 installation when setting RSWindowsKerberos or RSWindowsKerberos I can't access the website.

    Environment

    SQL Server on Server1 housing ReportServer DB's. SPN created for SQL Server FQDN and Netbios for the service account. The FQDN SPN specifies the port 1433.

    SSRS on Server2 housing just the webserver. SPN created for HTTP for the FQDN and Netbios for the same service account. The FQDN SPN specifies the port 80. I have a reqeust to remove the FQDN with port 80 and add a new one without specifying the port. That was from a post I had read where that worked for someone. Though I doubt this is my issue.

    Service account has been set for delegation "Trust this user for delegation to any any service (Kerberos only)". Service account is in Domain1 (see below).

    Forest1/Domain1 No Trusts, Server 1 and Server 2 are both members of this domain.

    Forest2/Doman2 Trusts Domain1, data sources are located here.

    Service account has been added to the following Local Security Policies on both Server1 and Server2. "Access this computer from the network", "Enable computer and user accounts to be trusted for delegation" and "Log on as a service".

    Users domain account DOES NOT have "Account is sensitive and cannot be delegated" set.

    When set to RSWindowsKerberos the website is available. However my data sources are in a separate forest/domain so I'm trying to get them to work via Kerberos. The eventual goal is to move those data sources to the same domain, but you gotta start somewhere. SSL was never enabled on the website. Kerberos has been verified on the Server1 that hosts the ReportServer DB's. When I go to the website via IP Address the site will come up but I get errors when I manage a data source. I've also tried setting on Server2 the registry settings HKLM\SYSTEM\CurrentControlSet\Services\HTTP\Parameters DWORD values for MaxFieldLength = fffe (65534) and MaxRequestBytes = 1000000 (16777216). Though those don't sound like they should need to be set on 2016.

    Client computer is running Windows 7 with IE 11. Security tab is unavailable on the client, though I have the ability to the registry if needed. Every time I browse to the site either FQDN or Netbios name I get Login prompt and then HTTP 400 Bad Reqeust. I'm at a loss at this point.

    Thursday, March 15, 2018 6:17 PM

Answers

  • So I was able to get around the HTTP 400 error. I had them remove the port from the SPN record and I no longer get the HTTP 400 error. This is very odd as specifying the port is recommended in the documentation for setting up Kerberos authentication. But I've read some posts that said to try it, and that fixed my issue.
    • Marked as answer by ThorSG76 Monday, April 9, 2018 8:14 PM
    Monday, April 9, 2018 8:13 PM

All replies

  • Hi ThorSG76,

    As I know, when you create SPN, you need to specify the port in it. You said you add a new port for this, I think you could use the original port to check this issue. 

    In addition, you said you will get error information, when you manage datasource. What is the error information? If you use stored credential for dataseource, will it work well?

    And whether the HTTP 400 error occur after you change the registry setting? You could change the browser or run the IE as domain user to check whether it works or not

    Best Regards,
    Zoe Zhi


    MSDN Community Support
    Please remember to click "Mark as Answer" the responses that resolved your issue, and to click "Unmark as Answer" if not. This can be beneficial to other community members reading this thread. If you have any compliments or complaints to MSDN Support, feel free to contact MSDNFSF@microsoft.com.

    Friday, March 16, 2018 3:02 AM
  • So I was able to get around the HTTP 400 error. I had them remove the port from the SPN record and I no longer get the HTTP 400 error. This is very odd as specifying the port is recommended in the documentation for setting up Kerberos authentication. But I've read some posts that said to try it, and that fixed my issue.
    • Marked as answer by ThorSG76 Monday, April 9, 2018 8:14 PM
    Monday, April 9, 2018 8:13 PM