Gateway Access to Non-Domain Joined Computer Running Analysis Services

[frankpl]

Hi,

I want to connect from PBI to an Analysis Services multidimensional cube running on a standalone server not member of any domain (actually, this server is a VM running in Azure). Is this scenario not supported, and will it only work if the SSAS server is member of a domain?

What I did:

• Made sure Analysis Services is new enough to support the gateway --> it is version 2016 SP1 CU3
• Installed the gateway on the server
• Configured a data source to an AS database on the server, getting a connection success message in PBI
• Mapped my user to the effective user name "SERVERNAME\existingUser"
• Added the local user existingUser on the server to the AS instance administrators.
• With PBI Desktop locally on the server, created and uploaded a report containing data from this AS database.
• Got an error message in PBI: "Couldn't load the model schema associated with this report. Make sure you have a connection to the server, and try again."
• Switched on "Additional logging" in the gateway, and checked the log while trying to get this working.

In the gateway log, I find the following error message: "AdomdErrorResponseException: The following system error occurred:  There are currently no logon servers available to service the logon request."

I then tried to change the user name mapping of the connection so that the effective user name is "localhost\existingUser". The error in PBI stayed the same, just in the log the message changed slightly, it now was: "AdomdErrorResponseException: The following system error occurred:  A specified logon session does not exist. It may already have been terminated."

When I changed the mapping to result just in "existingUser", I got still another error message: "AdomdErrorResponseException: The following system error occurred:  The name provided is not a properly formed account name."

In all cases, the gateway log showed the effectiveusername in the connection string as I had it mapped.

I then added a connection to the AS server via http/msmdpump to the gateway configuration in PBI, and changed the report to use that. But I got the same error message. And mapping the user name to "existingUser@localhost" or "existingUser@SERVERNAME" resulted in the "The name provided is not a properly formed account name." error message again, presumably as the "@" syntax would point to a UPN, which is a Kerberos concept, and hence not valid in a non-domain standalone server environment.

The gateway documentation only states that you may not set up the gateway on a domain controller, but it does not mention anywhere that it only works on a computer which is member of a domain.

Is the only way to get access to these AS multidimensional data setting up a domain controller and making this server member of  the domain?

Frank

[Seth_C_Bauer]

@frankpl From my understanding the simple answer is "yes" things work when the gateway is in the same domain. See here for reference. However, as mentioned in the link from that article to troubleshooting it appears you could have a non-domain joined machine as outlined here but there are certain trust relationships that have to be set up between the two domains.

I think it is fair to say that just randomly spinning up a seperate non-domain joined machine won't work, it requires a lot more in terms of creating some sort of linkage if the servers are not by default in the same domain.

[frankpl]

Hi Eno1978,

thank you for your answer. Actually, the gateway and the Analysis Services server are running on the same machine, hence connectivity between the gateway and Analysis Services should not be an issue. But apparently, there is an assumption in the gateway impersonation code that the effective user name is a domain account, not a local account. The section about authentication to AS in the first document you linked explicitly talks about the "local Active Directory".

Connecting to a relational SQL Server database on this non-domain joined computer through the same gateway is no problem, this is just an issue for Analysis Services.

Ok, so I will have to set up a domain for this computer, just to be able to connect to Analysis Services from PBI. This makes connecting to Analysis Services a bit less easy to set up.

Frank

[frankpl · Accepted solution]

I can confirm that after setting up domain and joining the computer running the gateway and SSAS to it, adding a domain account and giving it permission to the AS database, and adapting the user mapping to use that user, I got this working.