SharePoint 2013+ Sqlserver 2014 Kerberos 配置图例, 终极解决方案 已经验证。

SharePoint 2013+ Sqlserver 2014 Kerberos 配置图例。

验证一下啊

图例告诉我们OK

Change the account in the SharePoint UI running the Claims to Windows token Service

1. Navigate to Security in Central Admin,
2. Click on managed Accounts and add the new C2WTS account as a Managed Account,
3. Click Security again and Click on Service Accounts,
4. Click the Drop Down and Select Claims to Windows Token Service,
5. Select the new Managed Account SP_C2WTS and click OK. (Wait a few minutes for it to complete)
6. Set the following permissions on all SharePoint servers in the farm (All must be done) – this is completed under Local Security Policy on each server

下一步是到SPfarm 服务器上配置，

1. Grant Log on as a service (this should have happened automatically)
2. Impersonate a User (this should have happened automatically)
3. Act as part of the operating system (If its greyed out then your domain admin will need to update the group policy to allow it)

既然配置到这里了 把其他几个也配置了吧。 如图 单击身份验证后模拟客户端--添加用户或组 把kerberos 账号加进去。 

以操作系统方式运行，添加kerberos 账号。

1. Local admin on all SharePoint servers
2. STOP and START the Claims to Windows Token Service (From SharePoint UI) on all servers in the Farm. Simply navigate to Services in Farm and select each server from the link in the top right corner and Stop and Start each one individually waiting for them to finish
   

也可以完全按照步骤来做。如下；

Grant permission for the account running the application pool for the Service Application

e.g. Excel Services Service Application, Reporting Services Service Application, etc.

1. For Analysis services this User must be Granted SQL Analysis Services Administrator access (Unfortunately this is required as Read permission is insufficient for the delegation of credentials)
2. Check which account is being used by navigating to Central Admin Security and then select Service Accounts and from the drop down list validate each service or application pool.
3. In my example I have an account SP_Services and that account is granted Admin permissions on Analysis Services and granted “SP_DataAccess” on SQL to the SharePoint web application content database(s).
4. Validate that the account has the following permissions on each SharePoint server
   (This should be completed automatically but should be validated under the Local Security Policy)
   1. Grant Log on as a service
   2. Impersonate a User
5. Grant process identity access to the Service account
   $w = Get-SPWebApplication -Identity http://bi.blue.com (Put the URL of your web application)
   $w.GrantAccessToProcessIdentity("blue\sp_Services") (Put your service account name)

配置一下SQL server 2014 Analysis server 的属性  打开数据库--使用实例登录 Analysis 数据库 右键单击 属性添加刚才的  ExcelService 账号，如果没有管理账号的话 也顺便加上吧。下面几个抓图 也把 管理加进去。

执行如下命令 结果如图

1. Grant process identity access to the Service account
   $w = Get-SPWebApplication -Identity http://bi.blue.com (Put the URL of your web application)
   $w.GrantAccessToProcessIdentity("blue\sp_Services") (Put your service account name)

1. Set Constrained Delegation
   (Constrained delegation must be set for any account running the Service Application pools for the services that require Kerberos as well as the Claims to Windows Token Service account and the Account running PowerPivot SQL Service)
   In my case this is SP_Services and SP_C2WTS and SQL_AS (only for PowerPivot Data Sources - this is a change with Excel 2013 as the connection refreshes with the worksheet)
   The Domain Admin is required here and must log in to a Domain Controller.
   1. Find the SP_Services(Replace with your account name) account and click on the Delegation tab
      1. Click on “Trust this user for delegation to specified services only”
         
      2. Use any authentication protocol
      3. This is where it can get confusing and you need to make sure you have all your service accounts ready that you setup previously.
         (These are the ones you ran SETSPN for)
         
      4. Start with your first Data Source and type in your service account name (NOT SERVER NAMES) e.g. SP_SQL , SQL_AS, SQLDW_SQL and click OK.
         
      5. You will then be prompted with all the SPN’s and you need to select only the ones you need here i.e. the ones that are noted above.
      6. The worst case scenario here is if the account you use is utilized for many services and you will see many SPN‘s.
      7. Select the required SPN’s (The ones you added above) and click ok.
      8. Click “Apply” button after each add i.e. when you want to select another account otherwise you will get an error.
         
      9. Repeat this process selecting each account that you need to delegate to i.e. all the data sources and the web application. It’s all about where you want to allow it to delegate to.
      10. Now select the Claims to Windows Token Service Account e.g. SP_C2WTS (Replace with your account) and repeat the exact steps you did for the SP_Services account. (Technically for the SP_C2WTS you can exclude the Web Application but for simplicity sake I made the process the same)
          
          
      11. For my PowerPivot Service account SQL_AS I was connecting to a SQL Data Warehouse and my Analysis Services so you only set constrained for the destination data source so in my case I looked up SQL_SQLDW and "selected all", clicked ok and applied constrained delegation.

配置思路 参考地址http://blogs.technet.com/b/scottstewart/archive/2014/04/10/kerberos-sharepoint-2013-sql-2012-for-business-intelligence.aspx

1. Set Constrained Delegation
   (Constrained delegation must be set for any account running the Service Application pools for the services that require Kerberos as well as the Claims to Windows Token Service account and the Account running PowerPivot SQL Service)
   In my case this is SP_Services and SP_C2WTS and SQL_AS (only for PowerPivot Data Sources - this is a change with Excel 2013 as the connection refreshes with the worksheet)
   The Domain Admin is required here and must log in to a Domain Controller.
   1. Find the SP_Services(Replace with your account name) account and click on the Delegation tab
      1. Click on “Trust this user for delegation to specified services only”
         
      2. Use any authentication protocol
      3. This is where it can get confusing and you need to make sure you have all your service accounts ready that you setup previously.
         (These are the ones you ran SETSPN for)
         
      4. Start with your first Data Source and type in your service account name (NOT SERVER NAMES) e.g. SP_SQL , SQL_AS, SQLDW_SQL and click OK.
         
      5. You will then be prompted with all the SPN’s and you need to select only the ones you need here i.e. the ones that are noted above.
      6. The worst case scenario here is if the account you use is utilized for many services and you will see many SPN‘s.
      7. Select the required SPN’s (The ones you added above) and click ok.
      8. Click “Apply” button after each add i.e. when you want to select another account otherwise you will get an error.
         
      9. Repeat this process selecting each account that you need to delegate to i.e. all the data sources and the web application. It’s all about where you want to allow it to delegate to.
      10. Now select the Claims to Windows Token Service Account e.g. SP_C2WTS (Replace with your account) and repeat the exact steps you did for the SP_Services account. (Technically for the SP_C2WTS you can exclude the Web Application but for simplicity sake I made the process the same)
          
          
      11. For my PowerPivot Service account SQL_AS I was connecting to a SQL Data Warehouse and my Analysis Services so you only set constrained for the destination data source so in my case I looked up SQL_SQLDW and "selected all", clicked ok and applied constrained delegation.

再配置 SharePoint 身份验证模式。

1. Navigate to Central Admin,
2. Select web applications,
3. Highlight the Web application (Do not click on the link – click next to it to highlight it and select it),
4. Select Authentication providers and click Windows,
5. Scroll down and change NTLM and select Kerberos
6. Open a Command Prompt as Administrator and run IISRESET (USERS WILL LOSE CONNECTIVITY AND THEIR CURRENT SESSIONS SO DO THIS DURING SCHEDULED DOWNTIME)

重新启动IIS

之后 关闭浏览器 重新登录SP 如果成功 就证明配置完成 并依据开始启作用了。 这里如果没有配置成功 会出现反复登录而 不成功的问题。