无法通过在 ADF 中创建的 Azure SSIS/SSIS 运行时使用 Windows 身份验证连接到 azure 多维数据集

Question

I have SSIS package created locally which connects to azure cube. In order to connect to azure cube I am using windows authentication as shown below:

As shown above I am able to connect to Azure cube locally (ie on my desktop version of SSDT) via windows authentication.

Now I have created a azure SSIS runtime in ADF (Please note this azure subscription of ADF is different than that of the azure cube which i am connecting to). Now when i deploy the local (ie desktop version ) of SSIS package to the azure SSIS and try to run trigger the SSIS package via azure catlog in SSMS or through azure ADF i am getting the below connection failure message

1) Error which i get when i try to run the package on SSIS catlog over azure server

2) Error which i get when i try to run the deployed SSIS package via ADf created.

Error details

Output

{ "SsisDBOperationGuid": "ed2ca785-a942-434a-955a-9c1f0b5ed3b7", "SsisDBOperationId": 26, "OperationErrorMessages": "12/29/2019 7:23:47 AM +00:00 : Data Flow Task:Error: ADO NET Source has failed to acquire the connection {280FE230-2294-49D8-A947-D2EA8A7F29A2} with the following error message: \\"COM error: COM error: mscorlib; Exception has been thrown by the target of an invocation..\\".\\r\\n\\n12/29/2019 7:23:47 AM +00:00 : Data Flow Task:Error: ADO NET Source failed validation and returned error code 0xC0208449.\\r\\n\\n12/29/2019 7:23:47 AM +00:00 : Data Flow Task:Error: One or more component failed validation.\\r\\n\\n", "effectiveIntegrationRuntime": "SSSISruntime (West US 2)", "executionDuration": 6, "durationInQueue": { "integrationRuntimeQueue": 1 } }

Even though i am using windows authentication in ADF connection which uses the same credentials by which visual studio package is running locally i am getting the above error. Could you please let me know how can i run a ssis pakage package in ssis azure runtime by windows authention mode and can connect to the azure cube? Any help would be greatly appreciated

Answer 1

You will need to refer this section:

Use Windows authentication in staging tasks

If the staging tasks on your self-hosted IR require Windows authentication, configure your SSIS packages to use the same Windows authentication.

Your staging tasks will be invoked with the self-hosted IR service account (NT SERVICE\\DIAHostService, by default), and your data stores will be accessed with the Windows authentication account. Both accounts require certain security policies to be assigned to them. On the self-hosted IR machine, go to Local Security Policy > Local Policies > User Rights Assignment, and then do the following:

Assign the Adjust memory quotas for a process and Replace a process level token policies to the self-hosted IR service account. This should occur automatically when you install your self-hosted IR with the default service account. If it doesn't, assign those policies manually. If you use a different service account, assign the same policies to it.

Assign the Log on as a service policy to the Windows Authentication account.

MSFT Document