| Previous | Next |
| SEC_I_RENEGOTIATE | SEC_I_SIGNATURE_NEEDED |
SEC_I_NO_LSA_CONTEXT
Security context has no associated LSA-mode context
SEC_I_NO_LSA_CONTEXT is HRESULT 590627 (0x00090323) from winerror.h. AllStat describes it as “There is no LSA mode context associated with this context.” The severity bit indicates a nonfailure result, but the value carries a specific condition that must not be collapsed into plain S_OK.
In the SSPI authentication or message-protection state machine, this result means that there is no LSA mode context associated with this context. Before reporting completion for this HRESULT, the caller must reconcile the code-specific state transition and every usable output.
What must be true before accepting it
Verify that the requested operation truly does not require an LSA-mode representation of the context. Without that proof, this result can mask a caller error even though HRESULT failure severity is not set.
Reconcile side effects associated with this result before compensation or a second invocation is attempted.
Where the status is encountered
- This result can be returned during InitializeSecurityContext or AcceptSecurityContext loops; log the exact method and object state instead of interpreting the constant outside that contract.
- It can be returned during Schannel or another security package; log the exact method and object state instead of interpreting the constant outside that contract.
- It can be returned during message signing, fragmentation, or asynchronous SSPI processing; log the exact method and object state instead of interpreting the constant outside that contract.
Because it is informational, a language binding may expose it as success and hide the symbolic distinction. Keep the original HRESULT available until the code-specific branch has run.
Evidence and telemetry
- preserve security package and mode.
- preserve context handle generation.
- preserve requested LSA-dependent operation.
- preserve token or credential outputs.
- preserve package attributes.
Also record sec_i_no_lsa_context_operation, sec_i_no_lsa_context_state_before, sec_i_no_lsa_context_state_after, UTC time, process and thread identifiers, component version, and a correlation ID. Telemetry for this HRESULT should omit credentials while retaining nonsecret object identities and version data.
Correct handling and recovery
Continue only along the user-mode path supported by the security package. Do not call APIs that require an LSA context until the package establishes one.
Retry it only when a documented input or state has changed. An unchanged retry after it is useful only when the API explicitly advances through repeated calls.
Practical scenario
A custom security package completes a user-mode operation but has no LSA context for token queries. The caller skips the LSA-only step and records the package mode.
A regression test should reproduce it, assert the relevant outputs and state, then change only the decisive condition and verify the expected neighboring result or ordinary completion.
Difference from nearby results
It must be distinguished from ordinary S_OK and from failure-severity values in the same API family; its documented state changes control the next action.
Correctly separating it from neighboring values selects the proper continuation and cleanup path.
References
- Microsoft: SSPI status codes — official Microsoft material used to interpret it.
- Microsoft: SSPI context semantics
- Microsoft: InitializeSecurityContext
- Microsoft: DecryptMessage
- Microsoft: HRESULT values
Looking for a different code? Search another status or error code.