Sql-server – Connection to database causes SSPI context error

spnsql serversql-server-2008-r2

I have migrated a SQL server from another server box that was decommissioned. They have the same name and also same IP address. However, when I connect to the server from an application using trusted connection, I get the "SSPI context not generated" error.

What I have done:

I have used the setspn -X to confirm there is no duplicate SPN.
I have changed the order of protocol to follow the order:

Shared Memory,
Named Pipes,
TCP/IP.
I have verified that when I restart SQL server, the service registers and deregisters. This was found in the SQL server log.
I have checked that on the SQL configuration the TCP/IP network protocol has the right IP and is active and enabled on both 32bit and 64bit.

I am running out of ideas and I am still getting the same error. I can't find any log that point to Kerberos.

Best Answer

Try using Microsoft Kerberos Configuration Manager for SQL Server to automatically detect and fix such SPN Issues:

https://blogs.msdn.microsoft.com/farukcelik/2013/05/21/new-tool-microsoft-kerberos-configuration-manager-for-sql-server-is-ready-to-resolve-your-kerberosconnectivity-issues/

Related Solutions

Sql-server – Error: Cannot Generate SSPI context

'Cannot generate SSPI context' is a generic error. It can be caused by many issues, like an outaded password, clock drift, Active Directory access permissions, failure to register an SPN and so on and so forth.

There is no solution to this problem. The only 'solution' is to investigate the cause, as per KB811889 and/or Troubleshooting Kerberos Errors. Applying one solution or another from random Internet resources, w/o understanding the cause, may or may not solve the issue, may or may not cause frustration, may or may not cause irrevocable damage.

Sql-server – Cannot register SPN, error 0x80090350, state 4

The error message you're seeing, 0x80090350, is defined as:

c:\util\Err>err 0x80090350

# for hex 0x80090350 / decimal -2146892976 :
  SEC_E_DOWNGRADE_DETECTED                                        winerror.h
# The system detected a possible attempt to compromise
# security.  Please ensure that you can contact the server
# that authenticated you.
# 1 matches found for "0x80090350"

I'm looking this up with the Exchange Error Lookup Tool.

According to the information in this post, this error is often caused by the MaxTokenSize issue caused by an account (indirectly or directly) being a member of a large number of groups.

Another possibility I'd consider is that a duplicate SPN exists. You can determine which SPNs Windows thinks are duplicates by running setspn -X -F (info here).

Best Answer

Related Solutions

Sql-server – Error: Cannot Generate SSPI context

Sql-server – Cannot register SPN, error 0x80090350, state 4

Related Question