| Previous | Next |
| SEC_E_DELEGATION_REQUIRED | SEC_E_MULTIPLE_ACCOUNTS |
SEC_E_BAD_BINDINGS
SEC_E_BAD_BINDINGS means that the client supplied SSPI channel-binding information that does not match the authenticated TLS channel. It is an Extended Protection for Authentication check, designed to make credential forwarding to a different TLS connection fail.
What channel binding protects
Channel binding cryptographically associates an authentication exchange with the TLS channel on which it was intended to run. A TLS-terminating proxy, mismatched client capability, or stale binding data can therefore cause this error even when ordinary credentials are valid.
What to inspect
- Whether client and service both support and require Extended Protection.
- Whether a load balancer terminates TLS and changes the channel visible to the service.
- How the client obtains the binding information from its Schannel context.
Microsoft: Supporting Extended Protection for Authentication · SSPI Status Codes
Looking for a different code? Search another status or error code.