Dynamics 9.1 server on Windows 2022 Server
SQL Server 2022 on Windows 2022 Server
Reports created by report wizard fail when executing in Dynamics CRM
- Report Wizard reports fail with a rsProcessingAborted error.
- All out-of-the-box reports run
- All report builder reports run
This seems to be a classic issue with SPNs but all my SPNs are created and I'm still getting the issue.
SSRS Logs contain this error:
Microsoft.Crm.CrmException: An unexpected error occurred.
System.ServiceModel.Security.SecurityNegotiationException: A call to SSPI failed, see inner exception.
System.Security.Authentication.AuthenticationException: A call to SSPI failed, see inner exception.
System.ComponentModel.Win32Exception: The target principal name is incorrect
All this is configured:
IIS is running with windowsAuthentication and useAppPoolCredentials=True
Pool account: prod\CRMAppPoolAccount
The account running SSRS is a member of:
PrivReportingGroup
PrivUserGroup
ReportingGroup
SPNs for account running IIS CRM Application Pool: prod\CRMAppPoolAccount
http/CRMSERVER.prod1.prv1
http/CRMSERVER
SPNs for account running SSRS: prod\SSRSAccount
http/SQLSERVER.prod1.prv1
http/SQLSERVER
I also tried the a workaround based on https://learn.microsoft.com/en-us/previous-versions/troubleshoot/dynamics/crm/reports-created-by-report-wizard-or-custom-fetchxml-may-fail
SPN for prod\CRMAppPoolAccount
HTTP/CRMfetch(CRMSERVER)
Registry entry on SQL Server server:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MSCRM\SandboxClientSpn.CRMSERVER
Value = HTTP/CRMfetch(CRMSERVER)
After I tried the workaround I got the following error in the SQL Server Event log:
The Kerberos client received a KRB_AP_ERR_MODIFIED error from the server CRMAppPoolAccount. The target name used was HTTP/CRMfetch(CRMSERVER). This indicates that the target server failed to decrypt the ticket provided by the client. This can occur when the target server principal name (SPN) is registered on an account other than the account the target service is using. Ensure that the target SPN is only registered on the account used by the server. This error can also happen if the target service account password is different than what is configured on the Kerberos Key Distribution Center for that target service. Ensure that the service on the server and the KDC are both configured to use the same password. If the server name is not fully qualified, and the target domain (prod1.prv1) is different from the client domain (prod1.prv1), check if there are identically named server accounts in these two domains, or use the fully-qualified name to identify the server.
What is bizzaro in the above error message is that it refers to my crm pool service account as the server when it says "error from the server CRMAppPoolAccount."
What could I be missing?
