| Previous | Next |
| STATUS_STRONG_CRYPTO_NOT_SUPPORTED | STATUS_NO_PA_DATA |
STATUS_TOO_MANY_PRINCIPALS
Preserve the KDC reply and name-canonicalization context instead of choosing one identity arbitrarily
STATUS_TOO_MANY_PRINCIPALS is exposed by SSPI as SEC_E_TOO_MANY_PRINCIPALS. The Kerberos principal model uses structured principal names, and KDC replies carry client and service principal fields. Windows treats a reply that yields more than one principal name in a single-identity context as an authentication error.
The diagnostic focus is name resolution and canonicalization. Record the requested client and target names, realm, canonicalize option, referral history, and the principal fields returned by the KDC. Compare with a working request for the same account or service. Duplicate SPNs, ambiguous account mappings, or an unexpected KDC extension are candidates to investigate, but the status alone does not prove which one occurred.
Do not select the first principal in a parsed list or merge identities to keep the login moving. Kerberos authorization depends on binding the ticket to the intended principal. Preserve the raw protocol trace securely and determine why the KDC response does not map to the single principal expected by the Windows security package.
What to inspect
- The exact client and service principal names requested, realm, and KDC that returned the failing reply.
- Principal-name fields and canonicalization/referral data in the KDC response, compared with a successful exchange.
- Directory SPN uniqueness and account mappings relevant to the requested service, without assuming duplication until verified.
References
- Microsoft: SSPI status codes
- RFC 4120: Kerberos V5
- RFC 6806: Kerberos principal canonicalization and referrals
- Microsoft Open Specifications: Kerberos Protocol Extensions
- Microsoft Open Specifications: NTSTATUS values
Looking for a different code? Search another status or error code.