| Previous | Next |
| STATUS_TOO_MANY_PRINCIPALS | STATUS_PKINIT_NAME_MISMATCH |
STATUS_NO_PA_DATA
The missing object is structured Kerberos pre-authentication data, not an arbitrary application parameter
STATUS_NO_PA_DATA is exposed by SSPI when the Kerberos package expects PA-DATA that helps it determine which encryption type or pre-authentication mechanism to use. RFC 4120 defines the PA-DATA structure and allows KDC error data to carry pre-authentication information; RFC 6113 extends the pre-authentication framework and describes how pre-authentication and typed data are encoded.
Capture the AS exchange and identify the KDC error or response that preceded the status. Check whether the client asked for a normal password-based AS exchange, PKINIT, FAST, or another pre-authentication path. The useful evidence is the padata type list and encryption-type list, not just the final NTSTATUS.
Do not repair the failure by randomly enabling every Kerberos encryption type. Missing PA-DATA can indicate an incompatible KDC implementation, proxy or middlebox damage, an unexpected protocol path, or a client/KDC version mismatch. Compare a working AS exchange against the failing one and determine which expected padata element disappeared or changed.
What to inspect
- The KRB-ERROR or KDC reply immediately before the status, including e-data and all PA-DATA type identifiers.
- The client encryption-type list and the pre-authentication mechanism actually being attempted.
- Whether a Kerberos proxy, non-Windows KDC, compatibility layer, or security appliance alters the AS exchange.
References
- RFC 4120: Kerberos V5
- RFC 6113: Kerberos pre-authentication framework
- Microsoft Open Specifications: Kerberos Protocol Extensions
- Microsoft: SSPI status codes
- Microsoft Open Specifications: NTSTATUS values
Looking for a different code? Search another status or error code.