Configuring Kerberos for Excel Services is a two step process; Information Gathering and Configuration.
Step 1: Information Gathering:
1. Account running "Excel Services Application Web Service Application": In this example: ECSSvc.
Central Administration > Security > Configure service accounts
2. Account running "Claims to Windows Token Service": In this example: Local System.
Central Administration > Security > Configure service accounts
3. Account running the data source you are connecting to:
SQL:
Log on to the server running SQL > Start > Run > Services.msc and locate "SQL Server (MSSQLSERVER)", you will see the account in the "Log On As" column. In this example: SQLSvc.
Analysis Services:
Log on to the server running SSAS > Start > Run > Services.msc and locate "SQL Server Analysis Services (<Instance>)", you will see the account in the "Log On As". In this example: SSASSvc.
Since the "Claims to Windows Token Service" is running as Local System, we need to record the names of the SharePoint Servers running "Excel Calculation Services". In this example: PRIME13.
Recap:
- Account running "Excel Services Application Web Service Application": ECSSvc
- Account running "Claims to Windows Token Service": Local System
- Account running "SQL Server (MSSQLSERVER)": SQLSvc
- Account running "SQL Server Analysis Services (MSSQLSERVER)": SSASSvc
- Name of the SharePoint Server running "Excel Calculation Services". In this example: PRIME13.
Important Note:
If “Excel Services” is running on multiple SharePoint machines and the C2WTS is running as Local System, you will need to Constrain each SharePoint machine (Netbios Name) running “Excel Services” to the backend Service Account(s) (SQLSvc and/or SSASSvc).
If you are running the C2WTS as a domain account. For example Contoso\C2WTSSvc, you will only need to Constrain that one account to the backend Service Account(s) (SQLSvc and/or SSASSvc).
Step 2: Configuration:
What we need to do now is add the correct Service Principal Name to the Service Accounts running SQL/SSAS and then use Kerberos Constrained Delegation.
Service Principal Names (SPNs):
Add these SPNs to the account running the data source your workbook is connecting to. Either "SQL Server (MSSQLSERVER)" or "SQL Server Analysis Services (<Instance>)":
Account Running SQL Server (SQLSvc):
MSSQLSVC/<SQLServer_Name>
MSSQLSVC/<SQLServer_Name.FQDN
Example:
MSSQLSVC/SQLSvr
MSSQLSVC/SQLSvr.contoso.com
Account Running SQL Server Analysis Services (SSASSvc):
MSOLAPSvc.3/<SQL_Server_Analysis_Services_Server_Name>
MSOLAPSvc.3/<SQL_Server_Analysis_Services_Server_Name.FQDN>
Example:
MSOLAPSvc.3/SSASSvr
MSOLAPSvc.3/SSASSvr.contoso.com
Important Note: If Analysis Services has a named instance other than ("MSSQLSERVER)" (this is the default Instance) you will need include that in the Service Principal Name. In the below example, I will use the instance name "TABULAR".
MSOLAPSvc.3/<SQL_Server_Analysis_Services_Server_Name:Instance>
MSOLAPSvc.3/<SQL_Server_Analysis_Services_Server_Name.FQDN:Instance>
Example:
MSOLAPSvc.3/SSASSvr:TABULAR
MSOLAPSvc.3/SSASSvr.contoso.com:TABULAR
Important Note 2: If the Analysis Services Server has a Named Instance other than (MSSQLSERVER) (which is Default), like "TABULAR". You will need to add MSOLAPDisco.3 SPNs to the account running the SQL Browser service (Example: Contoso\BrowserSvc). “Disco” is short for “Discovery”. This needs to be set so the Browser Service can discover SSAS.
MSOLAPDisco.3/<SQL_Server_Analysis_Services_Server_Name>
MSOLAPDisco.3/<SQL_Server_Analysis_Services_Server_Name.FQDN>
Example:
MSOLAPDisco.3/SSASSvr
MSOLAPDisco.3/SSASSvr.contoso.com
Article: More Information regarding the MSOLAPDisco.3 SPNs can be found in the below article:
An SPN for the SQL Server Browser service is required when you establish a connection to a named instance of SQL Server Analysis Services or of SQL Server
http://support.microsoft.com/kb/950599
Kerberos Constrained Delegation (KCD):
Constrain Delegation between the account running "Excel Calculation Service" and "Claims to Windows Token Service" to "SQL Server" and SQL Server Analysis Services"
"Excel Services" to SQL:
In Active Directory Users and Computers > ECSSvc> Properties > Delegation Tab > Trust this computer for delegation to specified services only > Use any authentication protocol > Add… > Users or Computers… > SQLSvc> Check Names > OK > “Select All” Available Services > OK > OK.
"Excel Services" to "Analysis Services":
In Active Directory Users and Computers > ECSSvc> Properties > Delegation Tab > Trust this computer for delegation to specified services only > Use any authentication protocol > Add… > Users or Computers… > SSASSvc> Check Names > OK > “Select All” Available Services > OK > OK
"Claims to Windows Token Service" (if running as Local System): to SQL:
In Active Directory Users and Computers > PRIME13> Properties > Delegation Tab > Trust this computer for delegation to specified services only > Use any authentication protocol > Add… > Users or Computers… > SQLSvc> Check Names > OK > “Select All” Available Services > OK > OK.
"Claims to Windows Token Service" (if running as C2WTSSvc) to SQL:
In Active Directory Users and Computers > C2WTSSvc> Properties > Delegation Tab > Trust this computer for delegation to specified services only > Use any authentication protocol > Add… > Users or Computers… > SQLSvc> Check Names > OK > “Select All” Available Services > OK > OK.
"Claims to Windows Token Service" (if running as Local System) to "Analysis Services":
In Active Directory Users and Computers > PRIME13> Properties > Delegation Tab > Trust this computer for delegation to specified services only > Use any authentication protocol > Add… > Users or Computers… > SSASSvc> Check Names > OK > “Select All” Available Services > OK > OK
"Claims to Windows Token Service" (if running as C2WTSSvc) to SQL:
In Active Directory Users and Computers > C2WTSSvc> Properties > Delegation Tab > Trust this computer for delegation to specified services only > Use any authentication protocol > Add… > Users or Computers… > SSASSvc> Check Names > OK > “Select All” Available Services > OK > OK.
Please see my Visio Diagram. It may take a few seconds to load since it is large.
If this fails please see our other blog:
Tools and Techniques: Troubleshooting Kerberos in Excel Services and PowerPivot for SharePoint
http://blogs.technet.com/b/excel_services__powerpivot_for_sharepoint_support_blog/archive/2013/02/08/troubleshooting-kerberos-for-excel-services-and-powerpivot.aspx