12

In my SharePoint 2013 environment (1 WFE, 1 APP, NTLM, Nintex Workflow, Claims to Windows NT Token Service (c2WTS) is standard with local system) are lots of (Every seconds a few) claims authentication errors in the ULS log.

Any ideas where the problem come from? Any ideas how I can fix the problem?

Thank you in advance!

ULS Log

Claims Authentication Medium:

> SPSecurityContext: Could not retrieve a valid windows identity for
> username 'DOMAIN\USER' with UPN '[email protected]'. UPN is required when
> Kerberos constrained delegation is used. Exception:
> System.ServiceModel.FaultException
> 1[System.ServiceModel.ExceptionDetail]: WTS0003: The caller is not
> authorized to access the service. (Fault Detail is equal to An
> ExceptionDetail, likely created by
> IncludeExceptionDetailInFaults=true, whose value is:
> System.UnauthorizedAccessException: WTS0003: The caller is not
> authorized to access the service.     at
> Microsoft.IdentityModel.WindowsTokenService.CallerSecurity.CheckCaller(WindowsIdentity
> callerIdentity)      at
> Microsoft.IdentityModel.WindowsTokenService.S4UServiceContract.PerformLogon(Func
> 1 logonOperation, Int32 pid)      at SyncInvokeUpnLogon(Object ,
> Object[] , Object[] )      at
> System.ServiceModel.Dispatcher.SyncMethodInvoker.Invoke(Object
> instance, Object[] inputs, Object[]& outputs)      at
> System.ServiceModel.Dispatcher.DispatchOperationRuntime.InvokeBegin(MessageRpc&
> rpc)      at
> System.ServiceModel.Dispatcher.ImmutableDispatchRuntime.ProcessMessage5(MessageRpc&
> rpc)      at
> System.ServiceModel.Dispatcher.ImmutableDispatchRuntime.ProcessMessage31(MessageRpc&
> rpc)      at System.ServiceModel.Dispatcher.MessageRpc.Process(Boolean
> isOperationContextSet))..

Claims Authentication Unexpected:

No windows identity for DOMAIN\USER.

Improve this question
3
  • 3
    could you please check if Claims to Windows Token Service is running on the server? from central admin > manager services on server
    – Waqas Sarwar MVP ♦
    Commented Apr 10, 2015 at 18:28
  • 1
    Pinging this as it is happening at my current client site. Speaking to several architects and a MSFT support person led me to believe it is a non issue. I just don't like seeing my logs spammed with this and would like to see if anyone has a resolution for it. Users don't seem to be impacted other than the logs getting filled up. I have tried the restarting of the service and it doesn't seem to make a difference and it is not stopped.
    – Richard Dufour
    Commented Aug 11, 2017 at 13:42
  • This is currently happening in a 2010 environment, same symptoms. Tons of errors, no reported impact. Bad patch?
    – Jack
    Commented Jan 16, 2018 at 17:16

1 Answer 1

Reset to default
2

As i mentioned in the comment, This error is typically due to issue with Claims to token Service.Please make sure following things

  • from central admin > manager services on server make sure CTS is running on all server in the farm.
  • if not running start it.
  • If running then restart them.
Improve this answer
7
  • And what if it is already running?
    – Emaborsa
    Commented Feb 17, 2017 at 7:03
  • Then restart them
    – Waqas Sarwar MVP ♦
    Commented Feb 17, 2017 at 11:44
  • Well, what I meant is that the service is already running and I get the error even if I restart it.
    – Emaborsa
    Commented Feb 17, 2017 at 13:40
  • could you please check the event logs and ULS, provide us more information about the error..
    – Waqas Sarwar MVP ♦
    Commented Feb 17, 2017 at 13:47
  • SPSecurityContext: Could not retrieve a valid windows identity for username 'domain\user' with UPN '[email protected]'. UPN is required when Kerberos constrained delegation is used. Exception: System.ServiceModel.FaultException`1[System.ServiceModel.ExceptionDetail]: WTS0003: The caller is not authorized to access the service. (Fault Detail is equal to An ExceptionDetail, likely created by IncludeExceptionDetailInFaults=true, whose value is: System.UnauthorizedAccessException: WTS0003: The caller is not authorized to access the service.
    – Emaborsa
    Commented Feb 17, 2017 at 14:05

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.