Symptoms

The adTempus service fails to start as described in article K00000222. The adTempus diagnostic log contains a line with the following error message:

Error -2147467259: Cannot generate SSPI context (source=Microsoft OLE DB Provider for SQL Server; native error=1115; SQL state=HY000)

Cause

There are two possible causes for this problem.

  1. adTempus is connecting to a SQL Server instance on the same computer, and is using the computer name or IP address in the database connection settings.
  2. adTempus is connecting to a SQL Server instance on a remote computer using integrated security, but security delegation is failing.

Resolution

First determine what database server adTempus is attempting to connect to. To do this, run the Registry Editor and navigate to the following key:

HKEY_LOCAL_MACHINE\Software\Arcana Development\adTempus\Database

Edit the "connectionString" value and look for the section that reads "server=targetserver", where targetserver is the name or IP address of the database server. The targetserver may also be set to "." or "(localhost)". It may also contain an instance name, for example, "server=.\adtempus" or "server=computername\adtempus".

  • If the targetserver contains the name or IP address of the local computer (the computer that adTempus is running on), see "Resolution for Cause 1" below. For example, if adTempus is running on a computer name "schsrv1" and the connectionString contains "server=schsrv1\adtempus", this cause applies.
  • Otherwise, see "Resolution for Cause 2" below.

Resolution for Cause 1

If the "server=" section of the connectionString value contains the name or IP address of the local computer (the same computer that adTempus is running on), replace the name or IP address with a period (".").

For example, if adTempus is running on a computer name "schsrv1" and the connectionString contains "server=schsrv1\adtempus", change it to read "server=.\adtempus".

Resolution for Cause 2

When a connection is attempted to a remote SQL Server using integrated security, the SQL Server client software uses the Security Support Provider Interface (SSPI) to delegate a security token to the remote server for authentication, but this delegation is failing.

This failure is not specific to adTempus. For a full discussion of this issue and troubleshooting suggestions, see Microsoft Knowledge Base article 811889: How to troubleshoot the "Cannot generate SSPI context" error message.

In our experience this problem often indicates that there is a problem with communication between the adTempus computer and the domain controller. In many cases, rebooting the adTempus computer will resolve the issue.