Even though this is the PowerPivot and Excel Services blog, I felt that adding a blog on this common PowerView error was worthy of a post.
Many times I have seen customers with the error:
"Power View
An error occurred while loading the model for the item or data source '<filename.extension'>. Verify that the connection information is correct and that you have permissions to access the data source."
If you expand the "Show details", you will see Claims errors, but what does that mean?
<detail><ErrorCode xmlns="http://www.microsoft.com/sql/reportingservices">rsCannotRetrieveModel</ErrorCode><HttpStatus xmlns="http://www.microsoft.com/sql/reportingservices">400</HttpStatus><Message xmlns="http://www.microsoft.com/sql/reportingservices">An error occurred while loading the model for the item or data source 'http://microsoft/sites/bidemo/PowerPivot/Tabular.bism'. Verify that the connection information is correct and that you have permissions to access the data source.</Message><HelpLink xmlns="http://www.microsoft.com/sql/reportingservices">http://go.microsoft.com/fwlink/? inkId=20476&EvtSrc=Microsoft.ReportingServices.Diagnostics.Utilities.ErrorStrings&EvtID=rsCannotRetrieveModel&ProdName=Microsoft%20SQL%20Server%20Reporting%20Services&ProdVer=11.0.3349.0</HelpLink><ProductName xmlns="http://www.microsoft.com/sql/reportingservices">Microsoft
SQL Server Reporting Services</ProductName><ProductVersion xmlns="http://www.microsoft.com/sql/reportingservices">11.0.3349.0</ProductVersion><ProductLocaleId xmlns="http://www.microsoft.com/sql/reportingservices">127</ProductLocaleId><OperatingSystem xmlns="http://www.microsoft.com/sql/reportingservices">OsIndependent</OperatingSystem><CountryLocaleId xmlns="http://www.microsoft.com/sql/reportingservices">1033</CountryLocaleId><MoreInformation xmlns="http://www.microsoft.com/sql/reportingservices"><Source>ReportingServicesLibrary</Source><Message
msrs:ErrorCode="rsCannotRetrieveModel" msrs:HelpLink="http://go.microsoft.com/fwlink/?LinkId=20476&EvtSrc=Microsoft.ReportingServices.Diagnostics.Utilities.ErrorStrings&EvtID=rsCannotRetrieveModel&ProdName=Microsoft%20SQL%20Server%20Reporting%20Services&ProdVer=11.0.3349.0"
xmlns:msrs="http://www.microsoft.com/sql/reportingservices">An error occurred while loading the model for the item or data source 'http://microsoft/sites/bidemo/PowerPivot/Tabular.bism'. Verify that the connection information is correct and that you have permissions to access the data source.</Message><MoreInformation><Source>Microsoft.ReportingServices.ProcessingCore</Source><Message msrs:ErrorCode="rsErrorImpersonatingUser" msrs:HelpLink=http://go.microsoft.com/fwlink/? inkId=20476&EvtSrc=Microsoft.ReportingServices.Diagnostics.Utilities.ErrorStrings&EvtID=rsErrorImpersonatingUser&ProdName=Microsoft%20SQL%20Server%20Reporting%20Services&ProdVer=11.0.3349.0 xmlns:msrs="http://www.microsoft.com/sql/reportingservices">Cannot
impersonate user for data source 'TemporaryDataSource'.</Message><MoreInformation><Source>Microsoft.ReportingServices.ServiceRuntime</Source><Message msrs:ErrorCode= "rsClaimsToWindowsTokenError" msrs:HelpLink=http://go.microsoft.com/fwlink/? inkId=20476&EvtSrc=Microsoft.ReportingServices.Diagnostics.Utilities.ErrorStrings&EvtID=rsClaimsToWindowsTokenError&ProdName=Microsoft%20SQL%20Server%20Reporting%20Services&ProdVer=11.0.3349.0 xmlns:msrs= "http://www.microsoft.com/sql/reportingservices">Cannot convert claims identity to windows token. </Message><MoreInformation> <Source>Microsoft.SharePoint</Source><Message>Could not retrieve a valid Windows identity.</Message><MoreInformation><Source>mscorlib</Source><Message>Access is enied.</Message></MoreInformation> </MoreInformation></MoreInformation></MoreInformation></MoreInformation><Warnings xmlns=http://www.microsoft.com/sql/reportingservices /></detail>
If you want to analyze this more you can use Rodney Viana's tool to analyze the C2WTS:
Troubleshooting Claims to Windows NT Token Service (c2WTS) in SharePoint 2010 may be difficult if you don’t know where to start
I ran Rodney's tool and saw:
Testing Service c2WTS
+- Service c2WTS found
+- Service c2WTS is running
+- Path of service: C:\Program Files\Windows Identity Foundation\v3.5\c2wtshost.exe
+- Config File: C:\Program Files\Windows Identity Foundation\v3.5\c2wtshost.exe.config
+- Service Logon: SYSTEM\NT AUTHORITY
----- start of config file ----
<?xml version="1.0"?>
<configuration>
<configSections>
<section name="windowsTokenService" type="Microsoft.IdentityModel.WindowsTokenService.Configuration.WindowsTokenServiceSection, Microsoft.IdentityModel.WindowsTokenService, Version=3.5.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35" />
</configSections>
<startup>
<supportedRuntime version="v4.0" />
<supportedRuntime version="v2.0.50727" />
</startup>
<windowsTokenService>
<!--
By default no callers are allowed to use the Windows Identity Foundation Claims To NT Token Service.
Add the identities you wish to allow below.
-->
<allowedCallers>
<clear />
<add value="WSS_WPG" />
</allowedCallers>
</windowsTokenService>
</configuration>
----- end of config file ----
Retrieving security groups/users allowed to use the service from config file
+- WSS_WPG
Trying to login .........
Using current Windows Credentials
***** c2WTS could not provide a valid Windows Token. Reason: WTS0003: The caller is not authorized to access the service.
Server stack trace:
at System.ServiceModel.Channels.ServiceChannel.ThrowIfFaultUnderstood(Message reply, MessageFault fault, String action, MessageVersion version, FaultConverter faultConverter)
at System.ServiceModel.Channels.ServiceChannel.HandleReply(ProxyOperationRuntime operation, ProxyRpc& rpc)
at System.ServiceModel.Channels.ServiceChannel.Call(String action, Boolean oneway, ProxyOperationRuntime operation, Object[] ins, Object[] outs, TimeSpan timeout)
at System.ServiceModel.Channels.ServiceChannelProxy.InvokeService(IMethodCallMessage methodCall, ProxyOperationRuntime operation)
at System.ServiceModel.Channels.ServiceChannelProxy.Invoke(IMessage message)
Exception rethrown at [0]:
at System.Runtime.Remoting.Proxies.RealProxy.HandleReturnMessage(IMessage reqMsg, IMessage retMsg)
at System.Runtime.Remoting.Proxies.RealProxy.PrivateInvoke(MessageData& msgData, Int32 type)
at Microsoft.IdentityModel.WindowsTokenService.S4UClient.IS4UService_dup.UpnLogon(String upn, Int32 pid)
at Microsoft.IdentityModel.WindowsTokenService.S4UClient.<>c__DisplayClass1.<UpnLogon>b__0(IS4UService_dup channel)
at Microsoft.IdentityModel.WindowsTokenService.S4UClient.CallService(Func`2 contractOperation)
at c2WTSTest.Form1.button2_Click(Object sender, EventArgs e)
Now Verifying if user msft\test has rights on c2WTS
+- User msft\test has no access to the service
*** Analysis Complete ***
The first highlighted item tells me the account that was running the C2WTS: SYSTEM\NT AUTHORITY
The second highlighted item gives me the error: c2WTS could not provide a valid Windows Token. Reason: WTS0003: The caller is not authorized to access the service.
The error tells me that the account running the Claims to Windows Token Service lacks permissions/security.
Steps to resolve the issue.
I changed the Claims to Windows Token Service to a managed account and then applied the below changes (Note: you can attempt to apply the below changes to the existing account running the C2WTS):
a. Add the service account to the local Administrators Groups.
b. In local security policy (secpol.msc) under user rights assignment give the service account the following permissions:
i. Act as part of the operating system
ii. Impersonate a client after authentication
iii. Log on as a service
Restart IIS
After making this change the error went away.