Cannot connect to SSRS when locally, everything works ok when remotely

Question

After changing the certificate and the URL of my Report Server, I can connect remotely to the SSRS WebService or Web Portal but** I cannot connect from local**. In fact, I get a 401 error (Not authenticated).

When connecting remotely to https://myserver/ReportServer or https://myserver/Reports through my browser, I am prompted for credentials and after entering them correctly, I get the response from the server. When I am locally on the server (through RD), I enter the same URL in a browser but it keeps asking for credentials repeatedly even though I enter them correctly. This happens with every browser type I use.

I am using Reporting Services Version 15.0.1102.1002 running on Windows Server 2019 Standard.

I have enabled trace logging through SSRS\ReportServer\bin\ReportingServicesService.exe.config and added more columns to the log through HttpTraceSwitches entry.

When connecting locally to ReportServer through the browser, I get the following log:

#Fields: date time c-ip sc-status cs-username s-ip s-port s-host cs-method cs-uri-stem cs-uri-query 01/15/2023 07:43:27 "server ip" 401 - "server ip" 47873 "server url" GET /ReportServer
01/15/2023 07:43:27 "server ip" 401 - "server ip" 47873 "server url" GET /ReportServer
01/15/2023 07:43:38 "server ip" 401 - "server ip" 47873 "server url" GET /ReportServer
01/15/2023 07:43:38 "server ip" 401 - "server ip" 47873 "server url" GET /ReportServer

Note the 11 second difference between the first two and last two log entries, the latter two are the ones after I submit my credentials. As you can see, the user name is empty (-) I get a 401 (Not autheticated) error.

The log now when connecting remotely:

#Fields: date time c-ip sc-status cs-username s-ip s-port s-host cs-method cs-uri-stem cs-uri-query 01/15/2023 07:47:22 "remote ip" 401 - "server ip" 47873 "server url" GET /ReportServer
01/15/2023 07:47:28 "remote ip" 401 - "server ip" 47873 "server url" GET /ReportServer
01/15/2023 07:47:28 "remote ip" 401 - "server ip" 47873 "server url" GET /ReportServer
01/15/2023 07:47:28 "remote ip" 200 "user" "server ip" 47873 "server url" GET /ReportServer

In the last log entry, user name appears correctly.

It looks like when I'm connected locally, credentials passed from the browser never reach Report Server or it discards them.

My application that runs on the same server and uses the SSRS web service, gets the same error:

The remote server returned an error: (401) Unauthorized.

Answer 1

I managed to find a solution:

After entering credentials but not entering in the Report portal, I went to the EventViewer -> System and there was this entry:

 Log Name:      System
 Source:        LsaSrv
 Date:          1/16/2023 11:40:13 AM
 Event ID:      6037
 Task Category: None
 Level:         Warning
 Keywords:      Classic
 User:          N/A
 Computer:      ******************
 Description:
 The program RSPortal.exe, with the assigned process ID 1228, could not authenticate locally by using the target name HTTP/**********. The target name used is not valid. A target name should refer to one of the local computer names, for example, the DNS host name.

 
  Try a different target name.
 Event Xml:
 <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
   <System>
     <Provider Name="LsaSrv" Guid="{199fe037-2b82-40a9-82ac-e1d46c792b99}" EventSourceName="LsaSrv" />
     <EventID Qualifiers="0">6037</EventID>
     <Version>0</Version>
     <Level>3</Level>
     <Task>0</Task>
     <Opcode>0</Opcode>
     <Keywords>0x80000000000000</Keywords>
     <TimeCreated SystemTime="2023-01-16T09:40:13.832795000Z" />
     <EventRecordID>237591</EventRecordID>
     <Correlation />
     <Execution ProcessID="0" ThreadID="0" />
     <Channel>System</Channel>
     <Computer>hfri.grnet.gr</Computer>
     <Security />
   </System>
   <EventData>
     <Data>1228</Data>
     <Data>RSPortal.exe</Data>
     <Data>HTTP/***********</Data>
   </EventData>
 </Event>

As the message denotes, "The target name used is not valid. A target name should refer to one of the local computer names, for example, the DNS host name.". To bypass this, I've added a HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\DisableLoopbackCheck setting in registry set to 1.

This solution is proposed by:

https://learn.microsoft.com/en-US/troubleshoot/windows-server.networking/accessing-server-locally-with-fqdn-cname-alias-denied

"Error message when you try to access a server locally by using its FQDN or its CNAME alias"