Required configuration for Extended Protection in Reporting Services

The default location for rsreportserver.config in SQL Server 2008 R2 is C:\Program Files\Microsoft SQL Server\MSRS10_50.<Instance Name>\Reporting Services\ReportServer\bin; and in SQL Server 2012 is C:\Program Files\Microsoft SQL Server\MSRS11.<Instance Name>\Reporting Services\ReportServer\bin.

The RSWindowsExtendedProtectionLevel and RSWindowsExtendedProtectionScenario tags must be present within the rsreportserver.config for Windows Authentication requests to be accepted by the Report Server.  This does not mean that Extended Protection needs to be enabled, just that the tags are physically present.

                <Authentication>

                                <AuthenticationTypes>

                                                <RSWindowsNegotiate/>

                                                <RSWindowsNTLM/>

                                </AuthenticationTypes>

                                <RSWindowsExtendedProtectionLevel>Off</RSWindowsExtendedProtectionLevel>

                                <RSWindowsExtendedProtectionScenario>Proxy</RSWindowsExtendedProtectionScenario>

                                <EnableAuthPersistence>true</EnableAuthPersistence>

                </Authentication>

You may also see log entries similar to the following, if the above tags are not present:

configmanager!DefaultDomain!21f8!05/26/2010-21:50:39:: e ERROR: Missing or Invalid ExtendedProtectionLevel setting

rshost!rshost!1fe0!05/26/2010-21:50:40:: e ERROR: Invalid ExtendedProtectionPolicy specified.

rshost!rshost!1fe0!05/26/2010-21:50:40:: e ERROR: Invalid ExtendedProtectionPolicy specified.

servicecontroller!DefaultDomain!21f8!05/26/2010-21:50:40:: e ERROR: Error creating HTTP endpoint. System.ArgumentException: Value does not fall within the expected range.

   at Microsoft.ReportingServices.HostingInterfaces.IRsUnmanagedCallback.CreateHttpEndpoint(RsAppDomainType application, String[] urlPrefixes, Int32 cPrefixes, String[] hosts, Int32 cHosts, Boolean wildCardPresent, String virtualDirectory, String filePath, Int32 authType, Int32 logonMethod, String authDomain, String authRealm, Boolean authPersist, Int32 extendedProtectionLevel, Int32 extendedProtectionScenario, Boolean enabled)

   at Microsoft.ReportingServices.Library.ServiceAppDomainController.SetWebConfiguration(RunningApplication rsApplication, Boolean enabled, String folder)

For further information regarding Extended Protection in Reporting Services please refer to the Books Online documents for the HTTP Log - http://msdn.microsoft.com/en-us/library/ff487481(SQL.105).aspx.

 For more information about the products or tools that automatically check for this condition on your instance of SQL Server and on the versions of the SQL Server product, see the following table: