Microsoft KB Archive Search

Notice: This website is an unofficial Microsoft Knowledge Base (hereinafter KB) archive and is intended to provide a reliable access to deleted content from Microsoft KB. All KB articles are owned by Microsoft Corporation. Read full disclaimer for more details.

  1. Home
  2. An SPN for the SQL Server Browser service is required when you establish a connection to a named instance of SQL Server Analysis Services

An SPN for the SQL Server Browser service is required when you establish a connection to a named instance of SQL Server Analysis Services

View products that this article applies to.

Symptoms

Consider the following scenario. You establish a connection to a named instance of Microsoft SQL Server Analysis Services. Then, the SQL Server Browser service determines the port on which the named instance is available. The connection uses Kerberos authentication. In this scenario, a service principle name (SPN) for the SQL Server Browser service is required in addition to the SPN for the named instance of Analysis Services. If the SPN for the SQL Server Browser service does not exist, Kerberos authentication fails. 

↑ Back to the top

Cause

This behavior occurs only when the connection string contains the SSPI=Kerberos parameter. In this case, the connection is forced to use Kerberos authentication, and the SPN for the SQL Server Browser service must be configured.


If the connection string does not contain the SSPI=Kerberos parameter, Kerberos authentication is typically used. The connection to the SQL Server Browser service uses NTLM and the NT_ANONYMOUS account instead. In this case, the connection to the SQL Server Browser service is successful. The SQL Server Browser service determines the correct port. Then, the actual database connection uses Kerberos authentication to provide the true authentication.

↑ Back to the top

Resolution

You must create an SPN for the SQL Server Browser service by using the account under which the SQL Server Browser service is running.




The format of a NetBIOS SPN is as follows:
MSOLAPDisco.3/serverHostName
The format of a fully qualified domain name SPN is as follows:

MSOLAPDisco.3/serverHostName.Fully_Qualified_domainName

How to Register SPN

You must be a member of the Domain Administrators group to run the Setspn command.

To create the SPN for the Browser Service that is running under Domain Account, run the following commands at a command prompt:


Setspn.exe -a MSOLAPDisco.3/serverHostName.Fully_Qualified_domainName Browser_Service_Startup_Account




Setspn.exe -a MSOLAPDisco.3/serverHostName Browser_Service_Startup_Account
If you must create the SPN for the Browser Service that is running under the LocalSystem account, run the following commands at a command prompt:
Setspn.exe -a MSOLAPDisco.3/serverHostName.Fully_Qualified_domainName serverHostName Setspn.exe -a MSOLAPDisco.3/serverHostName serverHostName

To verify SPN

  When the service is running under a Domain account: 
Setspn –l Browser_Service_Startup_Account



When the service is running under the LocalSystem account: 
Setspn -l serverHostName

↑ Back to the top

Status

This behavior is by design.

↑ Back to the top

Keywords: kb, kbtshoot, kbprb

↑ Back to the top

Article Info
Article ID : 950599
Revision : 1
Created on : 1/7/2017
Published on : 1/16/2014
Exists online : False
Views : 618