The Microsoft Dynamics CRM Team Blog
News and views from the Microsoft Dynamics CRM Team
Microsoft Dynamics CRM handles all the reports with Microsoft SQL Server Reporting Services (SRS). SRS is a separate application that you can install on a different server than SQL Server or the Microsoft Dynamics CRM Server if desired. Microsoft Dynamics CRM then connects to SRS by using the Reporting Services URL, as specified during installation.
When is Data connector used?
The Connector for Microsoft SQL SRS is not required during a normal, non-IFD installation. For IFD installations, or when you make modifications to the default setup, Data connector installation is mandatory for running the reports.
Data connector is also required when the scheduling reports are used in CRM.
What does Data Connector do?
Previous versions of Microsoft Dynamics CRM had a common problem with CRM and SRS communication, referred to as the double-hop Kerberos authentication. When both were installed on different servers it was required that we enable delegation in order to pass the authentication token to SSRS.
In CRM 4.0, we did away with the requirement for delegation to be configured by introducing the component called the SQL Reporting Services Data Connector. It’s basically a data processing extension which attaches itself to the SSRS server and accepts the auth information from the CRM server and passes it to the SSRS server. This resolves a common authentication problem when trying to access and run reports in previous versions of Microsoft CRM, referred to as "The Kerberos double-hop authentication issue."
A common issue while installing CRM data connector
The above error/warning is caused because of the following conditions:
Condition 1 - Error
Condition 1 - Error
Condition 2 - Warning All CRM components: SQL, SRS are installed on a computer that is running Microsoft Server Small business edition where Connector is being installed
Condition 2 - Warning
All CRM components: SQL, SRS are installed on a computer that is running Microsoft Server Small business edition where Connector is being installed
What happens behind the scenes?
The reason you are encountering this error is because of a security issue that can occur if the CRMAppPool and the application pool used by SRS are the same account. While communicating to the SQL server.
When using the CRM Data Connector, it authenticates from SRS to SQL as the SRS Application Pool Identity and CRM grants the SRS app pool account the CRMReaderRole, which grants select permissions to the filtered views. When CRM is installed, the CRMAppPool identity is granted dbo permissions to the database. If both accounts are the same, the account used for the CRM Data Connector would have full database access.
Therefore to help make the data more secure, before you install CRM 4.0 connector, you can either:
a) Install CRM and SQL reporting services on different machines b) Configure Reporting services App pool on the computer to user a different account.
a) Install CRM and SQL reporting services on different machines
b) Configure Reporting services App pool on the computer to user a different account.
I cannot install the connector.
15:04:13| Error| Check ReportServerValidator : Failure: Unable to validate SQL Server Reporting Services Report Server installation. Please check that it is correctly installed on the local machine.
15:04:13| Info| Check ConfigDatabaseExistsValidator: Success
15:04:16|Verbose| Retrieving config database version Provider=SQLOLEDB;Data Source=CRM02CJ001;Initial Catalog=MSCRM_CONFIG;Integrated Security=SSPI ...
15:04:16| Info| Config database version: 4.0.7333.3.
15:04:16| Info| Check ConfigDatabaseVersionValidator: Success
15:04:17|Verbose| Exception caught while checking access to group <GUID=32a199dc-012f-4759-b73e-156edef3508e> ... System.DirectoryServices.DirectoryServicesCOMException (0x80072030): There is no such object on the server.
The GUID found in the log does not exist on my server.
If both CRM and SQL 2008 R2 Reporting Services are on same server then the CRM security works.
(i.e. if a user is in Marketing Business Unit then they cannot view Finance Business Unit info). (Worked when tested with one user).
If you use 2 servers, CRM 4.0 installed on server 1 and SQL 2008 R2 Reporting Services installed on server 2,
then CRM security does not work.
(i.e. if a user is in Marketing Business Unit then they can view Finance Business Unit info).
(Firstly the drop down parameters in the report was blank, by playing round with settings in IIS I got it to work, but CRM security for Business Unit/s not working).
How do I configure it to work ? (I already ran CRM Data connector).