Rod Edwards doesn’t want just anyone to double-hop:
Ok, many of you will already be aware that in order to use Integrated Authentication successfully with SSRS particularly, that you have to configure Kerberos Authentication. At a very basic level, this allows the credentials of the user running the report, to be passed to the report server (hop 1) and then along to the target of the SSRS datasource (hop 2), also known as “Double hop” authentication. The delegation part of this signifies where the service (PBIG or SSRS) is allowed to pass these credentials along to.
- anywhere, ie…Unconstrained delegation, or
- to a restricted set of targets…Constrained delegation.
Read on to see how you can set up constrained delegation.