Re: SSPI Context

From: Jasper Smith (jasper_smith9_at_hotmail.com)
Date: 08/23/05

  • Next message: Jasper Smith: "Re: Amendment to question." 
    Date: Tue, 23 Aug 2005 22:04:37 +0100

    We tend to find they cause more trouble than they're worth and I'd actually
    advise you delete any SPN's for the server/service account unless you
    specifically need to be able to delegate. SSPI errors are generally SPN or
    DNS related. A workaround is to connect using Named Pipes as only TCP/IP is
    affected by these errors. 

    -- 
HTH
Jasper Smith (SQL Server MVP)
http://www.sqldbatips.com
I support PASS - the definitive, global
community for SQL Server professionals -
http://www.sqlpass.org
"DylanM" <DylanM@discussions.microsoft.com> wrote in message 
news:A2FBA6C8-3F82-40AB-A19F-00D3633502D8@microsoft.com...
> Thanks for reply Jasper.
>
> I've just tried to set it to the domain account using EM, the SPN that was
> previously listed is no longer there but I get SSPI Context errors again.
>
> Is this something I should just leave to the AD administrators to fix? 
> From
> what i read of the 'troubleshooting SSPI' and related articles, it seemed 
> to
> suggest one was nescessary..
>
> 'If you run the SQL Server service under the LocalSystem account, the SPN 
> is
> automatically registered and Kerberos interacts successfully with the
> computer that is running SQL Server. However, if you run the SQL Server
> service under a domain account or under a local account, the attempt to
> create the SPN will fail in most cases because the domain account and 
> local
> account do not have the right to set their own SPNs. When the SPN creation 
> is
> not successful, this means that no SPN is set up for the computer that is
> running SQL Server.'
>
> Would reference to this article (section adding an SPN to a SQL Server) be
> the correct approach?
>
> http://msdn.microsoft.com/library/default.asp?url=/library/en-us/adminsql/ad_security_2gmm.asp
>
> Thanks again
>
> "Jasper Smith" wrote:
>
>> Because its the only one running under local system. A normal domain user
>> account generally doesn't have the rights to create an SPN. They are not
>> required for NT Authentication, the only time they are really required is 
>> if
>> you want to implement Kerberos delegation for linked server calls. And 
>> you
>> should always use EM to change the service account because it also needs 
>> to
>> set file and registry permissions for SQL that doing it through services
>> won't
>>
>> -- 
>> HTH
>>
>> Jasper Smith (SQL Server MVP)
>> http://www.sqldbatips.com
>> I support PASS - the definitive, global
>> community for SQL Server professionals -
>> http://www.sqlpass.org
>>
>>
  • Next message: Jasper Smith: "Re: Amendment to question."

    Relevant Pages

    • Re: Ldap Binding + Kerbros error
      ... I was suggesting to perform an LDAP query using the exact filter a specified ... A servicePrincipalName (SPN) is the Kerberos name of a service on the ... server authenticates with the client. ... account that is used to execute the Windows process that "is" the service. ...
      (microsoft.public.windows.server.active_directory)
    • Re: Compromise?
      ... Yes, if you don't provide a password on your SA account, anybody able to run ... and connect now has complete control over your SQL Server. ... Server has. ...
      (microsoft.public.sqlserver.security)
    • Re: Windows Auth to SQL Server from ATL Web Service not working...
      ... account I'm logged on as. ... SQL on a different box from my web service in an Atl Server web ... impersonation token is not passed on to the SQL Server. ... Event Category: Account Logon ...
      (microsoft.public.vc.atl)
    • Re: Discussing 3 different strategies for deleting from multiple tables
      ... I will be using SQL Server but I am riding on top of a third party ... FYI, Account contains around 20K ... >>> This results in one parameterized query followed by two more trips to ...
      (microsoft.public.data.ado)
    • Re: SuperSocket Error 19011
      ... usually if you use domain administrator account ... as SQL Server service account, it can register the SPN successfully. ... should use DsWriteAccountSpn API call to register the SPN with Active ...
      (microsoft.public.sqlserver.security)
    • Quantcast