Business intelligence with Excel Services 2013 - Business Intelligence in Microsoft SharePoint 2013 - page 168

External data configuration
One of the most challenging aspects for administrators is configuring external data for use by Excel
Services. Unfortunately, for implementations that aren't single-box, evaluator-style deployments,
some amount of configuration is required to make external data connectivity work, especially with
regard to security.
More Info You can read more on this topic at http://technet.microsoft.com/en-us/library/
hh525341(ofice.15).aspx .
This section isn't an exhaustive approach to all external data connectivity. It does, however, provide
some simple guidance and links to detailed steps to complete the high-level configuration needed
to get going. Also note that much of the configuration work described here can be reused by other
service applications such as Visio Services or Performance Point Services.
The simplest way to establish data connectivity on the server is to use a single account to connect
to all the data sources. The downside of this is that there won't be any per-user security applied to the
data. The single account used for getting data for Excel Services is known as the Unattended Account .
This is simply a user account that is created for the purpose of read-only access to data sources. The
account credentials (user name and password) must be stored in the Secure Store Service (SSS). SSS is
another service application, similar to Excel Services, that stores accounts securely.
More Info You can read an article with details about how to configure SSS and the
Unattended Account for Excel Services at http://technet.microsoft.com/en-us/library/
ff191191.aspx .
If you want per-user security, the best option is to configure Kerberos in your environment. Kerberos
configuration can be complex, and you might not need it if you are satisfied with users having simple
read-only access via a single account.
There are other options, as well, by which you can store different credentials used for data refresh
for different groups of users.
Configure the authentication in the workbook
In most deployments the workbook author will need to explicitly mark which type of option to use
when the file is loaded on Excel Services. If you are using a single-box deployment (and are working
from that computer) or you have configured Kerberos, the default settings will suffice and you can
skip this section.
To get an existing workbook configured to use the Unattended Account, perform the following
procedure: