1

Power BI Reporting Services in Forest1-DomainA (location F1-A).

User accounts are in Forest2-DomainA (location F2-A).

F1-A trusts F2-A. The VDI/RDS where the users login are in F1-A, the service is in F1-A. The URL is pbi.example.com, and from the VDI/RDS resolves to the Windows Server 2022 machine hosting the PBI service. On the Windows Server 2022 AD computer account we created the SPN http/pbi.example.com.

Logon with a user from the F1-A domain (as a test), works as expected. I see the Kerberos tickets. Logon with a user from F2-A, things go wrong. The Wireshark capture shows the server where the PBI service runs is attempting to discover the PBI service in F2-A, instead of F1-A. The PBI service account is in the F1-A domain.

Can the service be configured to look in its own F1-A instead of the user's F2-A? At least I guess this is why this happens.

Any help on this subject appreciated!! Thanks!

Improve this question
2
  • PowerBI is a cool product. It is not a realistically supportable product in this configuration. I have sympathy for anyone that inherits such a design.
    – Greg Askew
    Commented Feb 14, 2024 at 16:15
  • By "discovery" do you mean Kerberos TGS-REQs or something else?
    – grawity
    Commented Feb 14, 2024 at 16:16

2 Answers 2

Reset to default
1

Well, turned out that for cross forest (realm) you need to add the UPN Suffixes to the forest that is handling the authentication for that specific suffix. Then refresh these suffixes on both ends in the name suffix routing tabs in domains and trusts, and then upon authentication Kerberos can figure out based on the SPN in which forest the authentication needs to be done. That's it.

Improve this answer
1
  • hi, welcome to serverfault, remind to accept your answer, else we will be reminded to solve this issue until the end of universe. thanks.
    – djdomi
    Commented Mar 13, 2024 at 9:31
0

The PowerBi gateway is limited to the domain is installed in, so you can't have users from let's say domain a use the gateway of domain b. You need to have a gateway in both domains then

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .