Permissions
Kerberos delegation error (KRB5KDC_ERR_BADOPTION)
Power BI dataset refresh error: what it means and how to fix it.
What this means
Kerberos constrained delegation is not configured (the SPN is missing on the gateway service account).
How to fix it
- Add the source SPN to the gateway account's Delegation tab.
- Set the user mapping and add the account to the Windows Authorization Access Group.
- Run the gateway SSO test.
Frequently asked questions
- What does the "Kerberos delegation error (KRB5KDC_ERR_BADOPTION)" error mean?
- Kerberos constrained delegation is not configured (the SPN is missing on the gateway service account).
- How do I fix it?
- Add the source SPN to the gateway account's Delegation tab. Set the user mapping and add the account to the Windows Authorization Access Group. Run the gateway SSO test.
- Where does this Power BI refresh error appear?
- It appears in a Power BI semantic model's refresh history when a scheduled or on-demand refresh fails.
Related permissions errors
Catch this automatically
RefreshRadar monitors every Power BI dataset refresh and emails you when one fails, with the likely cause and the fix, so you are not hearing about a broken refresh from your stakeholders first.