11

In my SharePoint 2013 environment (1 WFE, 1 APP, NTLM, Nintex Workflow, Claims to Windows NT Token Service (c2WTS) is standard with local system) are lots of (Every seconds a few) claims authentication errors in the ULS log.

Any ideas where the problem come from? Any ideas how I can fix the problem?

Thank you in advance!

ULS Log

Claims Authentication Medium:

> SPSecurityContext: Could not retrieve a valid windows identity for
> username 'DOMAIN\USER' with UPN 'USER@DOMAIN.DE'. UPN is required when
> Kerberos constrained delegation is used. Exception:
> System.ServiceModel.FaultException
> 1[System.ServiceModel.ExceptionDetail]: WTS0003: The caller is not
> authorized to access the service. (Fault Detail is equal to An
> ExceptionDetail, likely created by
> IncludeExceptionDetailInFaults=true, whose value is:
> System.UnauthorizedAccessException: WTS0003: The caller is not
> authorized to access the service.     at
> Microsoft.IdentityModel.WindowsTokenService.CallerSecurity.CheckCaller(WindowsIdentity
> callerIdentity)      at
> Microsoft.IdentityModel.WindowsTokenService.S4UServiceContract.PerformLogon(Func
> 1 logonOperation, Int32 pid)      at SyncInvokeUpnLogon(Object ,
> Object[] , Object[] )      at
> System.ServiceModel.Dispatcher.SyncMethodInvoker.Invoke(Object
> instance, Object[] inputs, Object[]& outputs)      at
> System.ServiceModel.Dispatcher.DispatchOperationRuntime.InvokeBegin(MessageRpc&
> rpc)      at
> System.ServiceModel.Dispatcher.ImmutableDispatchRuntime.ProcessMessage5(MessageRpc&
> rpc)      at
> System.ServiceModel.Dispatcher.ImmutableDispatchRuntime.ProcessMessage31(MessageRpc&
> rpc)      at System.ServiceModel.Dispatcher.MessageRpc.Process(Boolean
> isOperationContextSet))..

Claims Authentication Unexpected:

No windows identity for DOMAIN\USER.

  • 3
    could you please check if Claims to Windows Token Service is running on the server? from central admin > manager services on server – Waqas Sarwar MVP Apr 10 '15 at 18:28
  • 1
    Pinging this as it is happening at my current client site. Speaking to several architects and a MSFT support person led me to believe it is a non issue. I just don't like seeing my logs spammed with this and would like to see if anyone has a resolution for it. Users don't seem to be impacted other than the logs getting filled up. I have tried the restarting of the service and it doesn't seem to make a difference and it is not stopped. – Richard Dufour Aug 11 '17 at 13:42
  • This is currently happening in a 2010 environment, same symptoms. Tons of errors, no reported impact. Bad patch? – Jack Jan 16 '18 at 17:16
2

As i mentioned in the comment, This error is typically due to issue with Claims to token Service.Please make sure following things

  • from central admin > manager services on server make sure CTS is running on all server in the farm.
  • if not running start it.
  • If running then restart them.
  • And what if it is already running? – Emaborsa Feb 17 '17 at 7:03
  • Then restart them – Waqas Sarwar MVP Feb 17 '17 at 11:44
  • Well, what I meant is that the service is already running and I get the error even if I restart it. – Emaborsa Feb 17 '17 at 13:40
  • could you please check the event logs and ULS, provide us more information about the error.. – Waqas Sarwar MVP Feb 17 '17 at 13:47
  • SPSecurityContext: Could not retrieve a valid windows identity for username 'domain\user' with UPN 'user@domain.local'. UPN is required when Kerberos constrained delegation is used. Exception: System.ServiceModel.FaultException`1[System.ServiceModel.ExceptionDetail]: WTS0003: The caller is not authorized to access the service. (Fault Detail is equal to An ExceptionDetail, likely created by IncludeExceptionDetailInFaults=true, whose value is: System.UnauthorizedAccessException: WTS0003: The caller is not authorized to access the service. – Emaborsa Feb 17 '17 at 14:05

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.