The target principal name is incorrect. Cannot generate SSPI context. (Microsoft SQL Server)

Question

we have an issue connecting remotely to SQL Server via SSMS with Azure AD users. Any attempt to log in to a SQL Server instance in AWS with Windows Authentication throws an SSPI error. We've tried the Kerberos Configuration Manager to diagnose the root cause but that throws an error every time. The only solutions we've found are connecting to our old VPN before SQL login (which is not a viable long-term solution) or running SSMS as a different user and using our domain user. Since we're on 2016.

Popup error message:

Cannot connect to x.x.x.x.
Additional information:
The target principal name is incorrect. Cannot generate SSPI context. (Microsoft SQL Server)

Error message details:

===================================
Cannot connect to x.x.x.x.
===================================
The target principal name is incorrect.  Cannot generate SSPI context. (.Net SqlClient Data Provider)

For help, click: http://go.microsoft.com/fwlink?ProdName=Microsoft%20SQL%20Server&EvtSrc=MSSQLServer&EvtID=0&LinkId=20476

Server Name: x.x.x.x
Error Number: 0
Severity: 11
State: 0
Procedure: GenClientContext

Program Location:
at System.Data.SqlClient.SqlInternalConnectionTds..ctor(DbConnectionPoolIdentity identity, SqlConnectionString connectionOptions, SqlCredential credential, Object providerInfo, String newPassword, SecureString newSecurePassword, Boolean redirectedUserInstance, SqlConnectionString userConnectionOptions, SessionData reconnectSessionData, DbConnectionPool pool, String accessToken, Boolean applyTransientFaultHandling, SqlAuthenticationProviderManager sqlAuthProviderManager)
   at System.Data.SqlClient.SqlConnectionFactory.CreateConnection(DbConnectionOptions options, DbConnectionPoolKey poolKey, Object poolGroupProviderInfo, DbConnectionPool pool, DbConnection owningConnection, DbConnectionOptions userOptions)
   at System.Data.ProviderBase.DbConnectionFactory.CreateNonPooledConnection(DbConnection owningConnection, DbConnectionPoolGroup poolGroup, DbConnectionOptions userOptions)
   at System.Data.ProviderBase.DbConnectionFactory.TryGetConnection(DbConnection owningConnection, TaskCompletionSource1 retry, DbConnectionOptions userOptions, DbConnectionInternal oldConnection, DbConnectionInternal&amp; connection) at System.Data.ProviderBase.DbConnectionInternal.TryOpenConnectionInternal(DbConnection outerConnection, DbConnectionFactory connectionFactory, TaskCompletionSource1 retry, DbConnectionOptions userOptions)
   at System.Data.ProviderBase.DbConnectionClosed.TryOpenConnection(DbConnection outerConnection, DbConnectionFactory connectionFactory, TaskCompletionSource1 retry, DbConnectionOptions userOptions) at System.Data.SqlClient.SqlConnection.TryOpenInner(TaskCompletionSource1 retry)
   at System.Data.SqlClient.SqlConnection.TryOpen(TaskCompletionSource`1 retry)
   at System.Data.SqlClient.SqlConnection.Open()
   at Microsoft.SqlServer.Management.SqlStudio.Explorer.ObjectExplorerService.ValidateConnection(UIConnectionInfo ci, IServerType server)
   at Microsoft.SqlServer.Management.UI.ConnectionDlg.Connector.ConnectionThreadUser()

Please not we were able to connect to the sql user with an old vpn but with aws VPN.

Any insights and solution higly appreciated.

We tried to solve using below documentation and no luck so far

https://dba.stackexchange.com/questions/241051/the-target-principal-name-is-incorrect-cannot-generate-sspi-context-sql-or-ad

score 1 · Answer 1 · answered Mar 02 '23 at 17:02

For those of you that run across this issue, the fix is to download the Kerberos configuration manager and run the autofix. You can find that tool at the following.

https://learn.microsoft.com/en-us/troubleshoot/sql/database-engine/connect/using-kerberosmngr-sqlserver

The target principal name is incorrect. Cannot generate SSPI context. (Microsoft SQL Server)

1 Answers1