Contents
Could not connect to database Cannot generate SSPI context?
The “Cannot generate SSPI context” error is generated when SSPI uses Kerberos authentication to delegate over TCP/IP and Kerberos authentication cannot complete the necessary operations to successfully delegate the user security token to the destination computer that is running SQL Server.
What is SQL Server SPN?
A service principal name (SPN) is the name by which a client uniquely identifies an instance of a service. The Kerberos authentication service can use an SPN to authenticate a service.
Why do we need SPN for SQL Server?
SPNs are used by the authentication protocol to determine the account in which a SQL Server instance runs. If the instance account is known, Kerberos authentication can be used to provide mutual authentication by the client and server.
Why is SQL Server unable to generate SSPI context?
Therefore, any issues about how the IP address or host name is resolved to the fully qualified DNS by WinSock may cause the SQL Server driver to create an invalid SPN for the computer that is running SQL Server.
What does SSPI mean in SQL Server Driver?
The SQL Server driver performs this delegation when the user’s security token is delegated from one computer to another by using one of the following configurations: Security Support Provider Interface (SSPI) is a set of Windows APIs that allows for delegation and mutual authentication over any generic data transport layer, such as TCP/IP sockets.
Why does SQL Server 2000 Service Pack 3 fail to connect?
When you try to connect to a Microsoft SQL Server 2000 Service Pack 3 (SP3) server computer from a client computer, the connection fails with an error message if the server name cannot be resolved from the Internet Protocol (IP) address.
How is SSPI used in a TCP / IP connection?
SSPI is only used for TCP/IP connections that are made by using Windows Authentication. Windows Authentication is also known as Trusted Connections or Integrated Security. SSPI is not used by Named Pipes or multi-protocol connections. Therefore, you can avoid the problem by configuring clients to connect from a protocol other than TCP/IP.