| Previous | Next |
| SEC_I_CONTINUE_NEEDED_MESSAGE_OK | CRYPT_I_NEW_PROTECTION_REQUIRED |
SEC_I_ASYNC_CALL_PENDING
Asynchronous SSPI work is pending
SEC_I_ASYNC_CALL_PENDING is HRESULT 590696 (0x00090368) from winerror.h. AllStat describes it as “An asynchronous SSPI routine has been called and the work is pending completion.” The severity bit indicates a nonfailure result, but the value carries a specific condition that must not be collapsed into plain S_OK.
In the SSPI authentication or message-protection state machine, this result means that an asynchronous SSPI routine has been called and the work is pending completion. The high-level request can be considered complete after it only when its documented postcondition has been checked.
Where the status is encountered
- InitializeSecurityContext or AcceptSecurityContext loops; log the exact method and object state instead of interpreting the constant outside that contract.
- Schannel or another security package; log the exact method and object state instead of interpreting the constant outside that contract.
- Message signing, fragmentation, or asynchronous SSPI processing; log the exact method and object state instead of interpreting the constant outside that contract.
Because it is informational, a language binding may expose it as success and hide the symbolic distinction. Keep the original HRESULT available until the code-specific branch has run.
What must be true before accepting it
Verify that the callback or completion object remains valid and no caller consumes outputs before the package completes the operation. The verification prevents it from being promoted to broader success than the producing API promised.
The component may have changed durable or in-memory state before returning it; inspect that state first.
Evidence and telemetry
- preserve async call identifier.
- preserve credential and context handles.
- preserve input and output SecBuffers.
- preserve completion callback state.
- preserve final status and cancellation result.
Also record sec_i_async_call_pending_operation, sec_i_async_call_pending_state_before, sec_i_async_call_pending_state_after, UTC time, process and thread identifiers, component version, and a correlation ID. Protect user data in logs and keep only the identifiers required to reproduce component state.
Difference from nearby results
It must be distinguished from ordinary S_OK and from failure-severity values in the same API family; its documented state changes control the next action.
The nearby-status comparison controls whether outputs are usable and whether more work is expected.
Correct handling and recovery
Keep credentials, context, buffers, and completion state alive. Observe the async completion, handle cancellation once, and use the final security status rather than this interim value.
Retry it only when a documented input or state has changed. Retry policy must follow the owning state machine rather than a generic transient-error loop.
Practical scenario
An asynchronous credential operation returns pending. The server retains the context and request buffers, then resumes the handshake from the completion callback.
A regression test should reproduce it, assert the relevant outputs and state, then change only the decisive condition and verify the expected neighboring result or ordinary completion.
References
- Microsoft: SSPI status codes — official Microsoft material used to interpret it.
- Microsoft: SSPI context semantics
- Microsoft: InitializeSecurityContext
- Microsoft: DecryptMessage
- Microsoft: HRESULT values
Looking for a different code? Search another status or error code.