We have a situation for which I have been trying to find an explanation for
over a week. A windows 2005 SP1 server which previously ran in Windows
authentication only suddenly caused "cannot generate sspi context" errors
after we switched it to mixed authentication mode.
-SQL service is running with domain account not trusted for delegation
-We have checked for invalid SPNs in the domain and there are none
registered for the SQL Service on this machine
-TCP/IP protocol is enabled on the server
-Named Pipes connections work fine
-After switching back to Windows authentication and clearing the ticket
cache the problem dissapears
If I understand correctly. The default authentication protocol used over
tcp/ip when connecting to SQL Server is Kerberos but if the client cannot
find a valid SPN for the SQL Service on the server then it should fall back
to NTLM. For some reason however, this is not happening as it should.
What is SQL Server service starting as...local system, domain user or domain
admin?
Kevin Hill
3NF Consulting
http://www.3nf-inc.com/NewsGroups.htm
Real-world stuff I run across with SQL Server:
http://kevin3nf.blogspot.com
"DBA72" <DBA72@.discussions.microsoft.com> wrote in message
news:65AFAA64-4847-4034-8745-211ED18ACB0E@.microsoft.com...
> We have a situation for which I have been trying to find an explanation
> for
> over a week. A windows 2005 SP1 server which previously ran in Windows
> authentication only suddenly caused "cannot generate sspi context" errors
> after we switched it to mixed authentication mode.
> -SQL service is running with domain account not trusted for delegation
> -We have checked for invalid SPNs in the domain and there are none
> registered for the SQL Service on this machine
> -TCP/IP protocol is enabled on the server
> -Named Pipes connections work fine
> -After switching back to Windows authentication and clearing the ticket
> cache the problem dissapears
> If I understand correctly. The default authentication protocol used over
> tcp/ip when connecting to SQL Server is Kerberos but if the client cannot
> find a valid SPN for the SQL Service on the server then it should fall
> back
> to NTLM. For some reason however, this is not happening as it should.
>
|||It is starting with a domain user account.
"Kevin3NF" wrote:
> What is SQL Server service starting as...local system, domain user or domain
> admin?
> --
> Kevin Hill
> 3NF Consulting
> http://www.3nf-inc.com/NewsGroups.htm
> Real-world stuff I run across with SQL Server:
> http://kevin3nf.blogspot.com
>
> "DBA72" <DBA72@.discussions.microsoft.com> wrote in message
> news:65AFAA64-4847-4034-8745-211ED18ACB0E@.microsoft.com...
>
>
|||A domain admin will need to create an SPN for the SQL Server service
manually using SetSPN or ADSI (I think)
Local system or domain admin starting sql does this automatically...domain
user does not
Kevin Hill
3NF Consulting
http://www.3nf-inc.com/NewsGroups.htm
Real-world stuff I run across with SQL Server:
http://kevin3nf.blogspot.com
"DBA72" <DBA72@.discussions.microsoft.com> wrote in message
news:F01518D8-9430-49AB-95AC-076BF1C5CF84@.microsoft.com...[vbcol=seagreen]
> It is starting with a domain user account.
> "Kevin3NF" wrote:
|||"Kevin3NF" wrote:
> A domain admin will need to create an SPN for the SQL Server service
> manually using SetSPN or ADSI (I think)
> Local system or domain admin starting sql does this automatically...domain
> user does not
> --
> Kevin Hill
> 3NF Consulting
> http://www.3nf-inc.com/NewsGroups.htm
> Real-world stuff I run across with SQL Server:
> http://kevin3nf.blogspot.com
>
> "DBA72" <DBA72@.discussions.microsoft.com> wrote in message
> news:F01518D8-9430-49AB-95AC-076BF1C5CF84@.microsoft.com...
>
Kevin,
I think you would be right if I was trying to use Kerberos but as I said,
this is not enabled for the sql service account. What I want to do is use
NTLM over tcp/ip
|||If you are getting SSPI error, something is attempting to use
Kerberos...even if that was not your intention. This is more of an Active
Directory issue than SQL Server, so I'm pretty much at the end of my
knowledge base...
Kevin Hill
3NF Consulting
http://www.3nf-inc.com/NewsGroups.htm
Real-world stuff I run across with SQL Server:
http://kevin3nf.blogspot.com
"DBA72" <DBA72@.discussions.microsoft.com> wrote in message
news:6C11E262-B916-42BA-A294-A16FD71FE5C0@.microsoft.com...
>
> "Kevin3NF" wrote:
> Kevin,
> I think you would be right if I was trying to use Kerberos but as I said,
> this is not enabled for the sql service account. What I want to do is use
> NTLM over tcp/ip
Showing posts with label explanation. Show all posts
Showing posts with label explanation. Show all posts
Tuesday, February 14, 2012
cannot generate sspi context when server in mixed authentication m
We have a situation for which I have been trying to find an explanation for
over a week. A windows 2005 SP1 server which previously ran in Windows
authentication only suddenly caused "cannot generate sspi context" errors
after we switched it to mixed authentication mode.
-SQL service is running with domain account not trusted for delegation
-We have checked for invalid SPNs in the domain and there are none
registered for the SQL Service on this machine
-TCP/IP protocol is enabled on the server
-Named Pipes connections work fine
-After switching back to Windows authentication and clearing the ticket
cache the problem dissapears
If I understand correctly. The default authentication protocol used over
tcp/ip when connecting to SQL Server is Kerberos but if the client cannot
find a valid SPN for the SQL Service on the server then it should fall back
to NTLM. For some reason however, this is not happening as it should.What is SQL Server service starting as...local system, domain user or domain
admin?
Kevin Hill
3NF Consulting
http://www.3nf-inc.com/NewsGroups.htm
Real-world stuff I run across with SQL Server:
http://kevin3nf.blogspot.com
"DBA72" <DBA72@.discussions.microsoft.com> wrote in message
news:65AFAA64-4847-4034-8745-211ED18ACB0E@.microsoft.com...
> We have a situation for which I have been trying to find an explanation
> for
> over a week. A windows 2005 SP1 server which previously ran in Windows
> authentication only suddenly caused "cannot generate sspi context" errors
> after we switched it to mixed authentication mode.
> -SQL service is running with domain account not trusted for delegation
> -We have checked for invalid SPNs in the domain and there are none
> registered for the SQL Service on this machine
> -TCP/IP protocol is enabled on the server
> -Named Pipes connections work fine
> -After switching back to Windows authentication and clearing the ticket
> cache the problem dissapears
> If I understand correctly. The default authentication protocol used over
> tcp/ip when connecting to SQL Server is Kerberos but if the client cannot
> find a valid SPN for the SQL Service on the server then it should fall
> back
> to NTLM. For some reason however, this is not happening as it should.
>
over a week. A windows 2005 SP1 server which previously ran in Windows
authentication only suddenly caused "cannot generate sspi context" errors
after we switched it to mixed authentication mode.
-SQL service is running with domain account not trusted for delegation
-We have checked for invalid SPNs in the domain and there are none
registered for the SQL Service on this machine
-TCP/IP protocol is enabled on the server
-Named Pipes connections work fine
-After switching back to Windows authentication and clearing the ticket
cache the problem dissapears
If I understand correctly. The default authentication protocol used over
tcp/ip when connecting to SQL Server is Kerberos but if the client cannot
find a valid SPN for the SQL Service on the server then it should fall back
to NTLM. For some reason however, this is not happening as it should.What is SQL Server service starting as...local system, domain user or domain
admin?
Kevin Hill
3NF Consulting
http://www.3nf-inc.com/NewsGroups.htm
Real-world stuff I run across with SQL Server:
http://kevin3nf.blogspot.com
"DBA72" <DBA72@.discussions.microsoft.com> wrote in message
news:65AFAA64-4847-4034-8745-211ED18ACB0E@.microsoft.com...
> We have a situation for which I have been trying to find an explanation
> for
> over a week. A windows 2005 SP1 server which previously ran in Windows
> authentication only suddenly caused "cannot generate sspi context" errors
> after we switched it to mixed authentication mode.
> -SQL service is running with domain account not trusted for delegation
> -We have checked for invalid SPNs in the domain and there are none
> registered for the SQL Service on this machine
> -TCP/IP protocol is enabled on the server
> -Named Pipes connections work fine
> -After switching back to Windows authentication and clearing the ticket
> cache the problem dissapears
> If I understand correctly. The default authentication protocol used over
> tcp/ip when connecting to SQL Server is Kerberos but if the client cannot
> find a valid SPN for the SQL Service on the server then it should fall
> back
> to NTLM. For some reason however, this is not happening as it should.
>
Cannot Generate SSPI Context
I know there is quite a lot of posting before for this error. And I
quite confused with long explanation at Microsoft Support. My problem
is quite weird, I can connect normally to SQL Server (running Windows
Server 2003) from my PC (running Windows XP SP2) for around half to one
hour. I develop Reporting Services 2005 in VS 2005. But after certain
periode, I get error "Cannot generate SSPI Context". I also received
the same error in SQL Server Management Studio at that time. All
developer in my team receive same kind of error. I have to restart my
PC so that I can connect again, and after certain periode, I get that
error again. It keep occured until now, and it is really slow down our
development.
DC is running on the different server. Only windows authentication is
enabled in SQL Server (We can't use Views from Microsoft CRM 3.0 by
using SQL Authentication, (or can I?)). Everyone connect directly
without VPN. Is there any solution for this error?
Is there anyway I can connect to SQL Server with Windows Authentication
but different account from the account I log in (like Impersonation)?
GunadySounds like you have a Kerberos issue at the domain level more than a SQL
level
Have your network guys check to see if your Kerberos tickets are expiring
without renewing
Kevin Hill
President
3NF Consulting
www.3nf-inc.com/NewsGroups.htm
"Gunady" <Gunady@.gmail.com> wrote in message
news:1158555138.376098.39560@.b28g2000cwb.googlegroups.com...
>I know there is quite a lot of posting before for this error. And I
> quite confused with long explanation at Microsoft Support. My problem
> is quite weird, I can connect normally to SQL Server (running Windows
> Server 2003) from my PC (running Windows XP SP2) for around half to one
> hour. I develop Reporting Services 2005 in VS 2005. But after certain
> periode, I get error "Cannot generate SSPI Context". I also received
> the same error in SQL Server Management Studio at that time. All
> developer in my team receive same kind of error. I have to restart my
> PC so that I can connect again, and after certain periode, I get that
> error again. It keep occured until now, and it is really slow down our
> development.
> DC is running on the different server. Only windows authentication is
> enabled in SQL Server (We can't use Views from Microsoft CRM 3.0 by
> using SQL Authentication, (or can I?)). Everyone connect directly
> without VPN. Is there any solution for this error?
> Is there anyway I can connect to SQL Server with Windows Authentication
> but different account from the account I log in (like Impersonation)?
> Gunady
>|||Thanks Kevin,
Can you tell me where the configuration for this kerberos ticket
expiring?
Gunady
Kevin3NF wrote:[vbcol=seagreen]
> Sounds like you have a Kerberos issue at the domain level more than a SQL
> level
> Have your network guys check to see if your Kerberos tickets are expiring
> without renewing
> --
> Kevin Hill
> President
> 3NF Consulting
> www.3nf-inc.com/NewsGroups.htm
>
> "Gunady" <Gunady@.gmail.com> wrote in message
> news:1158555138.376098.39560@.b28g2000cwb.googlegroups.com...|||I *think* Kerb tickets are machine specific, so I would have your
network/security dudes look there. I'm not well versed in Kerb. Best I can
do for ya...
Kevin3NF
"Gunady" wrote:
> Thanks Kevin,
> Can you tell me where the configuration for this kerberos ticket
> expiring?
> Gunady
> Kevin3NF wrote:
>
quite confused with long explanation at Microsoft Support. My problem
is quite weird, I can connect normally to SQL Server (running Windows
Server 2003) from my PC (running Windows XP SP2) for around half to one
hour. I develop Reporting Services 2005 in VS 2005. But after certain
periode, I get error "Cannot generate SSPI Context". I also received
the same error in SQL Server Management Studio at that time. All
developer in my team receive same kind of error. I have to restart my
PC so that I can connect again, and after certain periode, I get that
error again. It keep occured until now, and it is really slow down our
development.
DC is running on the different server. Only windows authentication is
enabled in SQL Server (We can't use Views from Microsoft CRM 3.0 by
using SQL Authentication, (or can I?)). Everyone connect directly
without VPN. Is there any solution for this error?
Is there anyway I can connect to SQL Server with Windows Authentication
but different account from the account I log in (like Impersonation)?
GunadySounds like you have a Kerberos issue at the domain level more than a SQL
level
Have your network guys check to see if your Kerberos tickets are expiring
without renewing
Kevin Hill
President
3NF Consulting
www.3nf-inc.com/NewsGroups.htm
"Gunady" <Gunady@.gmail.com> wrote in message
news:1158555138.376098.39560@.b28g2000cwb.googlegroups.com...
>I know there is quite a lot of posting before for this error. And I
> quite confused with long explanation at Microsoft Support. My problem
> is quite weird, I can connect normally to SQL Server (running Windows
> Server 2003) from my PC (running Windows XP SP2) for around half to one
> hour. I develop Reporting Services 2005 in VS 2005. But after certain
> periode, I get error "Cannot generate SSPI Context". I also received
> the same error in SQL Server Management Studio at that time. All
> developer in my team receive same kind of error. I have to restart my
> PC so that I can connect again, and after certain periode, I get that
> error again. It keep occured until now, and it is really slow down our
> development.
> DC is running on the different server. Only windows authentication is
> enabled in SQL Server (We can't use Views from Microsoft CRM 3.0 by
> using SQL Authentication, (or can I?)). Everyone connect directly
> without VPN. Is there any solution for this error?
> Is there anyway I can connect to SQL Server with Windows Authentication
> but different account from the account I log in (like Impersonation)?
> Gunady
>|||Thanks Kevin,
Can you tell me where the configuration for this kerberos ticket
expiring?
Gunady
Kevin3NF wrote:[vbcol=seagreen]
> Sounds like you have a Kerberos issue at the domain level more than a SQL
> level
> Have your network guys check to see if your Kerberos tickets are expiring
> without renewing
> --
> Kevin Hill
> President
> 3NF Consulting
> www.3nf-inc.com/NewsGroups.htm
>
> "Gunady" <Gunady@.gmail.com> wrote in message
> news:1158555138.376098.39560@.b28g2000cwb.googlegroups.com...|||I *think* Kerb tickets are machine specific, so I would have your
network/security dudes look there. I'm not well versed in Kerb. Best I can
do for ya...
Kevin3NF
"Gunady" wrote:
> Thanks Kevin,
> Can you tell me where the configuration for this kerberos ticket
> expiring?
> Gunady
> Kevin3NF wrote:
>
Cannot Generate SSPI Context
I know there is quite a lot of posting before for this error. And I
quite confused with long explanation at Microsoft Support. My problem
is quite weird, I can connect normally to SQL Server (running Windows
Server 2003) from my PC (running Windows XP SP2) for around half to one
hour. I develop Reporting Services 2005 in VS 2005. But after certain
periode, I get error "Cannot generate SSPI Context". I also received
the same error in SQL Server Management Studio at that time. All
developer in my team receive same kind of error. I have to restart my
PC so that I can connect again, and after certain periode, I get that
error again. It keep occured until now, and it is really slow down our
development.
DC is running on the different server. Only windows authentication is
enabled in SQL Server (We can't use Views from Microsoft CRM 3.0 by
using SQL Authentication, (or can I?)). Everyone connect directly
without VPN. Is there any solution for this error?
Is there anyway I can connect to SQL Server with Windows Authentication
but different account from the account I log in (like Impersonation)?
Gunady
Sounds like you have a Kerberos issue at the domain level more than a SQL
level
Have your network guys check to see if your Kerberos tickets are expiring
without renewing
Kevin Hill
President
3NF Consulting
www.3nf-inc.com/NewsGroups.htm
"Gunady" <Gunady@.gmail.com> wrote in message
news:1158555138.376098.39560@.b28g2000cwb.googlegro ups.com...
>I know there is quite a lot of posting before for this error. And I
> quite confused with long explanation at Microsoft Support. My problem
> is quite weird, I can connect normally to SQL Server (running Windows
> Server 2003) from my PC (running Windows XP SP2) for around half to one
> hour. I develop Reporting Services 2005 in VS 2005. But after certain
> periode, I get error "Cannot generate SSPI Context". I also received
> the same error in SQL Server Management Studio at that time. All
> developer in my team receive same kind of error. I have to restart my
> PC so that I can connect again, and after certain periode, I get that
> error again. It keep occured until now, and it is really slow down our
> development.
> DC is running on the different server. Only windows authentication is
> enabled in SQL Server (We can't use Views from Microsoft CRM 3.0 by
> using SQL Authentication, (or can I?)). Everyone connect directly
> without VPN. Is there any solution for this error?
> Is there anyway I can connect to SQL Server with Windows Authentication
> but different account from the account I log in (like Impersonation)?
> Gunady
>
|||Thanks Kevin,
Can you tell me where the configuration for this kerberos ticket
expiring?
Gunady
Kevin3NF wrote:[vbcol=seagreen]
> Sounds like you have a Kerberos issue at the domain level more than a SQL
> level
> Have your network guys check to see if your Kerberos tickets are expiring
> without renewing
> --
> Kevin Hill
> President
> 3NF Consulting
> www.3nf-inc.com/NewsGroups.htm
>
> "Gunady" <Gunady@.gmail.com> wrote in message
> news:1158555138.376098.39560@.b28g2000cwb.googlegro ups.com...
|||I *think* Kerb tickets are machine specific, so I would have your
network/security dudes look there. I'm not well versed in Kerb. Best I can
do for ya...
Kevin3NF
"Gunady" wrote:
> Thanks Kevin,
> Can you tell me where the configuration for this kerberos ticket
> expiring?
> Gunady
> Kevin3NF wrote:
>
quite confused with long explanation at Microsoft Support. My problem
is quite weird, I can connect normally to SQL Server (running Windows
Server 2003) from my PC (running Windows XP SP2) for around half to one
hour. I develop Reporting Services 2005 in VS 2005. But after certain
periode, I get error "Cannot generate SSPI Context". I also received
the same error in SQL Server Management Studio at that time. All
developer in my team receive same kind of error. I have to restart my
PC so that I can connect again, and after certain periode, I get that
error again. It keep occured until now, and it is really slow down our
development.
DC is running on the different server. Only windows authentication is
enabled in SQL Server (We can't use Views from Microsoft CRM 3.0 by
using SQL Authentication, (or can I?)). Everyone connect directly
without VPN. Is there any solution for this error?
Is there anyway I can connect to SQL Server with Windows Authentication
but different account from the account I log in (like Impersonation)?
Gunady
Sounds like you have a Kerberos issue at the domain level more than a SQL
level
Have your network guys check to see if your Kerberos tickets are expiring
without renewing
Kevin Hill
President
3NF Consulting
www.3nf-inc.com/NewsGroups.htm
"Gunady" <Gunady@.gmail.com> wrote in message
news:1158555138.376098.39560@.b28g2000cwb.googlegro ups.com...
>I know there is quite a lot of posting before for this error. And I
> quite confused with long explanation at Microsoft Support. My problem
> is quite weird, I can connect normally to SQL Server (running Windows
> Server 2003) from my PC (running Windows XP SP2) for around half to one
> hour. I develop Reporting Services 2005 in VS 2005. But after certain
> periode, I get error "Cannot generate SSPI Context". I also received
> the same error in SQL Server Management Studio at that time. All
> developer in my team receive same kind of error. I have to restart my
> PC so that I can connect again, and after certain periode, I get that
> error again. It keep occured until now, and it is really slow down our
> development.
> DC is running on the different server. Only windows authentication is
> enabled in SQL Server (We can't use Views from Microsoft CRM 3.0 by
> using SQL Authentication, (or can I?)). Everyone connect directly
> without VPN. Is there any solution for this error?
> Is there anyway I can connect to SQL Server with Windows Authentication
> but different account from the account I log in (like Impersonation)?
> Gunady
>
|||Thanks Kevin,
Can you tell me where the configuration for this kerberos ticket
expiring?
Gunady
Kevin3NF wrote:[vbcol=seagreen]
> Sounds like you have a Kerberos issue at the domain level more than a SQL
> level
> Have your network guys check to see if your Kerberos tickets are expiring
> without renewing
> --
> Kevin Hill
> President
> 3NF Consulting
> www.3nf-inc.com/NewsGroups.htm
>
> "Gunady" <Gunady@.gmail.com> wrote in message
> news:1158555138.376098.39560@.b28g2000cwb.googlegro ups.com...
|||I *think* Kerb tickets are machine specific, so I would have your
network/security dudes look there. I'm not well versed in Kerb. Best I can
do for ya...
Kevin3NF
"Gunady" wrote:
> Thanks Kevin,
> Can you tell me where the configuration for this kerberos ticket
> expiring?
> Gunady
> Kevin3NF wrote:
>
Subscribe to:
Posts (Atom)