SYMPTOM
A Strategy 9.x and 10.x environment is configured for Integrated Authentication with Microsoft Analysis Services. Under Integrated Authentication, the end user's Windows ID is passed to Analysis Services when executing reports so that security defined within Analysis Services takes effect.
However, when a user subscribes to a report against Analysis Services using Strategy Distribution Services, the report does not execute under that user's Windows ID. Instead, it falls back to the database login and password supplied in the database instance.
Subscribed reports may fail with an XMLA or SOAP error such as "An error was encountered in the transport layer."
Note: If the database login object associated with the database instance enables the option "Use network login id (Windows authentication)," the ID of the Intelligence Server's service account will be used, not the login ID of the user who opened the session.
CAUSE
Integrated Authentication in Strategy uses a technique, "Kerberos impersonation," to authenticate against Microsoft Analysis Services data sources. It is necessary to use Kerberos, rather than Windows impersonation, so that Integrated Authentication can be supported in UNIX or Linux environments.
Kerberos impersonation requires a token from a live user session on the client machine. This token is available when the user logs into an interactive Intelligence Server session using Strategy Desktop or Web.
When reports are executed by Distribution Services, however, the user does not have to be logged into the client machine at that time. The session token is not available; therefore Kerberos authentication cannot be performed normally.
ACTION
Currently this issue is being reviewed by Strategy for a potential code fix on an upcoming Strategy release.
WORKAROUND
Credentials for individual users may be passed to Analysis Services data sources using either of two mechanisms: connection mapping or linked warehouse execution.
KB32317
