title: SSRS 2016 Native Double-Hop Windows Authentication
body: <p>Myself and another admin have been trying to troubleshoot the double-hop authentication issue on our new reporting server (where the report runs as the authenticated user, but cannot delegate to the data source and returns a 'NT Authority\Anonymous’ authentication error) and we seem to be hitting a dead end. Here is a bit about our setup.</p>
  
  <p>We have SSRS 2016 installed on one server, and our data source for reports is on another server. We have done the following steps to try and enable authentication</p>
  
  <ol>
  <li>Set Group Policy on the Reporting Server to enable delegation of credentials</li>
  <li>Ensured that SSRS and MSSQLsrv on the report server have the correct SPN set for the service account running both services:
  
  <ul>
  <li>http/NetBIOS:80 domain\servicename</li>
  <li>http/FQDN.contoso.com:80 domain\servicename</li>
  <li>mssqlsvc/FQDN.contoso.com:1433 domain\servicename</li>
  </ul></li>
  <li>Enable Kerberos Delegation on the Service account, and ensure the "Account is sensitive and cannot be delegated." box is not checked</li>
  <li>Switched the Tag to &lt;<code>RSWindowsNegotiate/</code>> in the RSReportServer.config file</li>
  <li>Restarted the Service</li>
  </ol>
  
  <p>We are still receiving the error when trying to connect data sources on the report server and even issues connecting to web page via browser. Strangely enough we tried setting up a link server on the report server configuring the security to run under the user executing the command and were able to successfully do a double-hop on the link server, but still not from SSRS. </p>
  
  <p>Does the datasource need to be running under a service account, or can it run under the local service account for SQL? Would the service account need to have delegated rights to the OU in which the Servers exist? What other items may I be missing?</p>