| Previous | Next |
| STATUS_CRYPTO_SYSTEM_INVALID | STATUS_MUST_BE_KDC |
STATUS_MAX_REFERRALS_EXCEEDED
A referral chain is looping or unexpectedly long; the KDC may still be generating referrals successfully
STATUS_MAX_REFERRALS_EXCEEDED is a client-side guard on Kerberos referral processing. Cross-realm referrals let a KDC direct a client toward another realm when the target service is not in the current realm. RFC 6806 specifies principal canonicalization and cross-realm referral behavior, while Windows KILE adds Microsoft implementation rules.
This status differs from STATUS_KDC_UNABLE_TO_REFER. In that case a KDC cannot construct the required referral. Here the client has already processed too many referrals. Preserve the complete sequence of realms, KDCs, referral TGTs and requested service principal; a repeated realm or alternating pair immediately points to a routing or name-canonicalization loop.
Do not simply raise an implementation limit unless the trust and realm path has been validated. Check the target SPN, DNS-derived name, trust topology, realm mapping and name-suffix routing. A typo or canonicalization change can send the client down a referral path that is valid at each individual hop but never reaches the intended service.
What to inspect
- The ordered referral chain, including each source realm, referred realm, KDC and ticket-granting service principal.
- The original target SPN and any canonicalized host or principal names observed during the sequence.
- Trust and name-suffix routing changes that coincide with the first appearance of the referral loop.
References
- RFC 6806: Kerberos principal canonicalization and referrals
- RFC 4120: Kerberos V5
- Microsoft Open Specifications: Kerberos Protocol Extensions
- Microsoft: Kerberos authentication overview
- Microsoft Open Specifications: NTSTATUS values
Looking for a different code? Search another status or error code.