locked
Proclarity Invalid Credentials for Parameter RRS feed

  • Question

  • The issue I am having is that Proclarity works great on the intranet, but when trying to access via internet it is giving "Invalid Credentials" for the parameters.  Also, what I noticed is that if there is a active cach session the dashboard comes up on the internet still displaying "Invalid Credentials" for the parameter.  If there is no active cach session then the dashboard turns for about 3 minutes the displays website cannot be found.  Please help.

     

     

    Tuesday, July 22, 2008 5:38 PM

Answers

  •  

    Frisco,

     

    The Dashboard must pass either the user's credentials (via integrated authentication) or explicitly stored credentials to the PAS and then SSAS server.  When using Dashboard on the internet, you may be running into a situation where your credentials are not making it.  I cannot remember if you are able to use Basic authentication to get the user's credentials to hop from the Dash to PAS to SSAS but Basic is required for internet authentication.  If we require Integrated, we may have to have you configure Dash to use explicit credentials.  My apologies but I haven't set this up in a while. 

     

    What version are you running of Dash and PAS - 6.3.2214.x?

     

    -Joey

    Wednesday, July 23, 2008 12:17 AM
  • Frisco,

     

    I recommend updating to the latest ProClarity code available from download.microsoft.com.

     

    Kerberos Delegation will not work across the public internet.  You will likely need to use Dashboard with Forms authentication.  This means you will use Anonymous on the IIS virtual directory and then users will enter their system or Active Directory credentials into a form to gain access.  This is similar to logging into Amazon.com or such sites.  I believe Jason is right and you will still need to use explicit credentials for the Parameters and KPIs.

     

    -Joey

    Wednesday, July 23, 2008 5:58 PM

All replies

  •  

    Frisco,

     

    The Dashboard must pass either the user's credentials (via integrated authentication) or explicitly stored credentials to the PAS and then SSAS server.  When using Dashboard on the internet, you may be running into a situation where your credentials are not making it.  I cannot remember if you are able to use Basic authentication to get the user's credentials to hop from the Dash to PAS to SSAS but Basic is required for internet authentication.  If we require Integrated, we may have to have you configure Dash to use explicit credentials.  My apologies but I haven't set this up in a while. 

     

    What version are you running of Dash and PAS - 6.3.2214.x?

     

    -Joey

    Wednesday, July 23, 2008 12:17 AM
  • Joey is right about the authentication.  You will need to configure the Dashboard for Basic Authentication in order to use it via the internet.  If your parameter values are not user specific then you could hard-code the credentials in the parameters (explicit credentials).

     

    Good Luck,

     

    Jason

    BTG Services

     

    Wednesday, July 23, 2008 4:24 AM
  • 6.3.129.200

     

    Wednesday, July 23, 2008 2:36 PM
  • Thanks Jason.

     

    That works, but it kills my single sign on.  We are using Kerberos to pass authentication.  Any ideas or suggestions?

     

    Thanks you for all you help

     

     

     

    Wednesday, July 23, 2008 3:10 PM
  • Frisco,

     

    I recommend updating to the latest ProClarity code available from download.microsoft.com.

     

    Kerberos Delegation will not work across the public internet.  You will likely need to use Dashboard with Forms authentication.  This means you will use Anonymous on the IIS virtual directory and then users will enter their system or Active Directory credentials into a form to gain access.  This is similar to logging into Amazon.com or such sites.  I believe Jason is right and you will still need to use explicit credentials for the Parameters and KPIs.

     

    -Joey

    Wednesday, July 23, 2008 5:58 PM
  • Hello Joey,

     

    Thanks for the help.  One last question.  Is there a way to set this up to allow single sign on within the intranet and forms authentication via the internet?

     

    Thanks,

     

    Wednesday, July 23, 2008 6:16 PM
  • I retract my last question.  Problem resolved.

     

    Thanks,

     

     

    Thursday, July 24, 2008 2:46 AM
  • Joey-

    I just came across this post in trying to access PAS from IE outside my network.  My problem manifests itself as a "... cube could not be found ..." error which traces to a Kerberos delegation issue.  You say that Kerberos delegation will not work across the public internet.  Yet this is the only place that I have found that explicitly states this and I've been searching for some time.  Is there any documentation that you could point me to that describes this case and why?

     

    Thanks

    -Ray

     

    Thursday, September 18, 2008 1:56 PM
  • Ray,

     

    Windows Integrated authentication does not work across proxy servers and firewalls.  I'm not sure why.  I did a quick search and found a page that states the same.  I'm sure some more searching would reveal some technical details on why proxies and firewalls don't like it.

     

    http://www.microsoft.com/technet/prodtechnol/windows2000serv/reskit/distrib/dscj_mcs_cvhj.mspx?mfr=true

     

    -Joey

    Wednesday, September 24, 2008 1:39 PM