Who is this article for?

Users of the desktop application.

IT Administrator permissions are required.

This article explains how to troubleshoot the "Security Support Provider Interface (SSPI) negotiation failed" error.

1. Issue

When authentication negotiation fails during application start, this error will occur. You will see a SecurityNegotiationException message indicating that SSPI negotiation failed. 

EXCEPTION: SecurityNegotiationException
message:   SOAP security negotiation with 'http://server.domain.com/PentanaPRD/Service/TngService.svc' 
for target ' http://server.domain.com/PentanaPRD/Service/TngService.svc' failed. See inner exception for more details.
source:    mscorlib
target:    Void HandleReturnMessage(System.Runtime.Remoting.Messaging.IMessage, System.Runtime.Remoting.Messaging.IMessage)
stack:    
[…] 
message:   The Security Support Provider Interface (SSPI) negotiation failed.
source:    System.ServiceModel
target:    Byte[] GetOutgoingBlob(Byte[], System.Security.Authentication.ExtendedProtection.ChannelBinding, System.Security.Authentication.ExtendedProtection.ExtendedProtectionPolicy)
stack:        at System.ServiceModel.Security.WindowsSspiNegotiation.GetOutgoingBlob(Byte[] incomingBlob, ChannelBinding channelbinding, ExtendedProtectionPolicy protectionPolicy)
   at System.ServiceModel.Security.SspiNegotiationTokenProvider.GetNextOutgoingMessageBody(Message incomingMessage, SspiNegotiationTokenProviderState sspiState)
   at System.ServiceModel.Security.IssuanceTokenProviderBase`1.GetNextOutgoingMessage(Message incomingMessage, T negotiationState)
   at System.ServiceModel.Security.IssuanceTokenProviderBase`1.DoNegotiation(TimeSpan timeout)

This error occurs during authentication negotiation. Although often linked to SPN issues, clock skew, or DNS problems, it is frequently caused by password policy changes conflicting with an existing service account password that no longer meets the new requirements.

2. Resolution

To resolve this error:

1. Change the password for the Windows user account associated with the service application pool.
2. Update the cached copy in IIS Manager.
3. Update the password for the Robot service.
4. Restart the application pool.
5. Test accessing the application.

If the above does not work, investigate the other common causes of this error:

• Check the app server clock time to ensure it is in sync with the rest of the domain.
• Purge the Kerberos cache.
• Verify that DNS resolution is working correctly.
• Check Event Viewer on the app server and on the domain controllers for Kerberos errors.