Scale-out Power BI Report Server behind HAProxy

[MajkF]

Hello there,

I'm exploring on-premise scale-out option and I would like to ask for some help. I'm using two Report Server nodes (version January 2021) and database in dedicated AlwaysOn SQL Server cluster. HAproxy as NLB in front of everything, designed to forward all traffic to one (master) node.

Currently I'm able to connect to https://test-powerbi.domain.com/ NLB or directly to both nodes (https://server-1/Reports), browse folder structure, create/delete folders, but I'm unable to perform any action with reports:

Error in logs is following:
OData exception occurred: System.Net.WebException: The underlying connection was closed: Could not establish trust relationship for the SSL/TLS secure channel. ---> System.Security.Authentication.AuthenticationException: The remote certificate is invalid according to the validation procedure.

My scale-out solution is using same configuration and certificates as my other single-instance Report Servers (they all work just fine). All certificates are present in certstore of both machines and used in both Web Service and Web Portal configurations:

My first thought was that NLB is messing with my certificate chain, but the same error is occuring even if I go directly to each node.

I browsed other posts here and modified rsreportserver.config by adding Hostname and UrlRoot (same for both nodes):

<Hostname>test-powerbi.domain.com</Hostname>
<UrlRoot>https://test-powerbi.domain.com/ReportServer</UrlRoot>

and ReportServerUrl (different for each node):

<ReportServerUrl>https://server-1.domain.com/ReportServer</ReportServerUrl>

I also created new multi-string value BackConnectionHostNames in registers with ServerName and FQDN (different for each node):

"server-1", "server-1.domain.com"

None of this helped, so I decided to stop trying with HTTPS and go back to HTTP, so I removed all certificates from configuration and re-added Web Server and Web Portal configurations and modified "https" into "http" in mentioned rsreportserver.config values, but to my amazement the issue remains exactly the same:

So even if no certificates are used (https calls return 503 errors) in whole Report Server service, my http call directly to Report Server node still return invalid remote certificate.

Considering that everything works perfectly, only actions with reports are failing, I expect that I made some mistake in report server configuration. Would be great if anyone pointed out what I missed.

Thanks in advance

Majk

[MajkF · Accepted solution]

I've stopped using HAproxy and used Windows Failover Cluster and everything works just fine. As everything worked, I once again removed HTTP configuration and left only the HTTPS, which resulted in following error (when opening a report):

OData exception occurred: Newtonsoft.Json.JsonReaderException: Unexpected character encountered while parsing value: <. Path '', line 0, position 0.

TL;DR: HTTP configuration should definitelly stay and shouldn't be removed. Since WFC works, I will be using it instead of HAProxy.

[MajkF]

Another update: I'm able to open and work with reports when connecting directly to the each Report Server node, but when I open the same reports from HAProxy connection, report is stuch in loading loop and creating multiple headers:

I modified default rsreportserver.config once again with the values from original post, but the issue remains.

Once again, any tips about resolving this are welcome.

[MajkF]

UPDATE:

Report Server uninstalled and installed back on both nodes. Both nodes configured to use both HTTP/80 and HTTPS/443 (same certificates as before). Separately both servers working perfectly on both HTTP and HTTPS connections.

After confirming that each node works as a single-instance RS (didn't check this the first time), I joined them using scale-out deployment and both nodes still work (HTTP as well as HTTPS) without any issue. Connections from HAProxy NLB works as well. My current configuration did no changes in rsreportserver.config so far, only the BackConnectionHostNames registry value is present.

I will continue to test and monitor current configuration and will post changes. If no changes are made, I will just mark this post as solution - just reinstall the whole thing. 🙂

[Icey]

Hi @MajkF ,

Have you tried to set the TCP port as 80? Please refer to this detailed post to re-configure your Power BI Report Server and check if the issue is still there.

Best regards

Icey

If this post helps, then consider Accepting it as the solution to help other members find it faster.

[MajkF]

Hello there,

I've tried strictly HTTP port 80 configuration (same as your screenshot) and strictly HTTPS port 443 configuration, both of them return the same remote certificate error. Currently I got both 80 an 443 ports configured and the error remains the same (no matter what port I connect to).
Regarding the recommended configuration, mine is pretty much the same. The only difference is that I use domain account to run the service and to connect to database (and two instances in scale-out deployment tab obviously).