| Previous | Next |
| SEC_I_MESSAGE_FRAGMENT | SEC_I_ASYNC_CALL_PENDING |
SEC_I_CONTINUE_NEEDED_MESSAGE_OK
Security context must continue although early message use is allowed
SEC_I_CONTINUE_NEEDED_MESSAGE_OK is HRESULT 590694 (0x00090366) from winerror.h. AllStat describes it as “The function completed successfully, but must be called again to complete the context; Early start can be used.” The severity bit indicates a nonfailure result, but the value carries a specific condition that must not be collapsed into plain S_OK.
In the SSPI authentication or message-protection state machine, this result means that the function completed successfully, but must be called again to complete the context; Early start can be used. Consumers of it must decide from the API contract whether to stop, wait, continue, or expose a reduced outcome.
Where the status is encountered
- InitializeSecurityContext or AcceptSecurityContext loops; log the exact method and object state instead of interpreting the constant outside that contract.
- Schannel or another security package; log the exact method and object state instead of interpreting the constant outside that contract.
- Message signing, fragmentation, or asynchronous SSPI processing; log the exact method and object state instead of interpreting the constant outside that contract.
Because it is informational, a language binding may expose it as success and hide the symbolic distinction. Keep the original HRESULT available until the code-specific branch has run.
What must be true before accepting it
Verify that the application separates early permitted data from authentication completion and still performs every remaining handshake call. Checking the boundary keeps it from hiding stale data, pending work, or a deliberately reduced result.
Do not compensate for it until the caller knows which sub-operations actually occurred.
Evidence and telemetry
- preserve context attributes and early-start flag.
- preserve token sent and next token expected.
- preserve early message identity.
- preserve authorization deferred until completion.
- preserve final context status.
Also record sec_i_continue_needed_message_ok_operation, sec_i_continue_needed_message_ok_state_before, sec_i_continue_needed_message_ok_state_after, UTC time, process and thread identifiers, component version, and a correlation ID. A diagnostic bundle for it should preserve correlation fields without copying tokens, keys, or private media.
Correct handling and recovery
Process only data explicitly allowed by early-start semantics, call the context routine again with the next token, and defer final authorization until the context is complete.
Retry it only when a documented input or state has changed. Continuation after it may be appropriate, but an identical restart is not automatically recovery.
Difference from nearby results
It must be distinguished from ordinary S_OK and from failure-severity values in the same API family; its documented state changes control the next action.
The practical value of distinguishing it is choosing the right wait, stop, retry, or user-notification behavior.
Practical scenario
A client receives this status after sending early application data. The server buffers privileged operations and completes the SSPI exchange before committing them.
A regression test should reproduce it, assert the relevant outputs and state, then change only the decisive condition and verify the expected neighboring result or ordinary completion.
References
- Microsoft: SSPI status codes — official Microsoft material used to interpret it.
- Microsoft: SSPI context semantics
- Microsoft: InitializeSecurityContext
- Microsoft: DecryptMessage
- Microsoft: HRESULT values
Looking for a different code? Search another status or error code.