5

I am reading the Microsoft article How to troubleshoot the "Cannot generate SSPI context" error message

The two quotes imply that if I know what a domain is I should know what a forest is, but I don't. I have googled around and everything I find, is either not related ("can't see the forest for the trees") or or the term is not explained.

Consider an SPN as a domain or forest unique identifier of some instance in a server resource.

-

3.Check whether the domain that the server belongs to and the domain account that you use to connect are in the same forest. This is required for SSPI to work.

Hannah Vernon
  • 70,928
  • 22
  • 177
  • 323
James Jenkins
  • 6,318
  • 6
  • 49
  • 88

1 Answers1

5

An Active Directory domain is an organizational unit within a Forest. A forest is simply a collection of domains that allows the domains be managed as a unit.

Consider an SPN as a domain or forest unique identifier of some instance in a server resource.

The above means the SPN (service principal name) should be unique across the entire organization. This is enforced because no two domains in a forest can have the same name, therefore, no two SPNs in a forest can have the same name.

3.Check whether the domain that the server belongs to and the domain account that you use to connect are in the same forest. This is required for SSPI to work.

The above would only be an issue if you were attempting Kerberos authentication across domains that are not part of the same forest; this might happen from two corporations being merged without their Active Directory domains being moved into a single, unified, forest.

See technet for more details about Forests and Domains.

Hannah Vernon
  • 70,928
  • 22
  • 177
  • 323