We have an instance of SSRS (SQL Server Reporting Services) which uses Kerberos Constrained Delegation to fetch data for its reports from SQL Server on behalf of its users.
For this purpose, SSRS was configured to use <RSWindowsNegotiate/> authentication option.
Unfortunately, this option allows NTLM sign-in as well. Users successfully login with NTLM, and then get an error when trying to launch a report (because the delegation obviously fails).
There is also <RSWindowsKerberos> option, but unfortunately it's not supported by browsers.
What's even worth, after such NTLM login SSRS won't try for some period of time to get a Kerberos ticket on behalf of a user - even if the user now logs in using Kerberos, even from another browser or from another station. I guess, this is because SSRS launches some session object for the user after successful login, and associates new logins to this session - so until it expires (in ~10 minutes), no delegation would be attempted.
Is there a way to make NTLM logins fail, or at least give user a warning that he should close his browser, wait for some time and re-login by Kerberos?
