SP2013: SPSecurityContext: Could not retrieve a valid windows identity for username 'DOMAIN\USER' with UPN '[email protected]'

Question

I have the following SSOM in a console app

    using (SPSite site = new SPSite("http://localhost"))
    {
        using(SPWeb web = site.OpenWeb())
        {
            Console.WriteLine(web.Title);
            TaxonomySession TaxonomySession = new TaxonomySession(site);
            TermStore termstore = TaxonomySession.DefaultKeywordsTermStore;
            var termGroup = termstore.GetSiteCollectionGroup(site, true);
        }
    }

When I run this I get this from the Claims to Windows token service:

STS Call Claims Windows: Successfully requested sign-in claim identity for user 'DOMAIN\USER'.

When I do the same in CSOM code in the same console app

        using (var clientContext = new ClientContext(new Uri("http://localhost")))
        {

            try
            {
                var siteCol = clientContext.Site;
                var web = siteCol.RootWeb;
                clientContext.Load(siteCol);
                clientContext.Load(web, w => w.Title);
                clientContext.ExecuteQuery();
                TaxonomySession session = TaxonomySession.GetTaxonomySession(clientContext);
                TermStore store = session.GetDefaultKeywordsTermStore();
                TermGroupCollection groups = store.Groups;
                clientContext.Load(session, s => s.TermStores);
                clientContext.Load(store, s => s.Groups);
                clientContext.ExecuteQuery();
            }
            catch (System.Net.WebException wEx)
            {
                Console.WriteLine("Error: " + wEx.Message);
            }
            catch (Microsoft.SharePoint.Client.ServerException sEx)
            {
                Console.WriteLine("Error: " + sEx.Message);
            }
        }

I get this error in my ULS

SPSecurityContext: Could not retrieve a valid windows identity for username 'DOMAIN\USER' with UPN '[email protected]'. UPN is required when Kerberos constrained delegation is used. Exception: System.ComponentModel.Win32Exception (0x80004005): Access is denied    Server stack trace:     
 at System.ServiceModel.Channels.AppContainerInfo.GetCurrentProcessToken()    
 at System.ServiceModel.Channels.AppContainerInfo.RunningInAppContainer()    
 at System.ServiceModel.Channels.AppContainerInfo.get_IsRunningInAppContainer()    
 at System.ServiceModel.Channels.PipeSharedMemory.BuildPipeName(String pipeGuid)    
 at System.ServiceModel.Channels.PipeSharedMemory.get_PipeName()    
 at System.ServiceModel.Channels.PipeConnectionInitiator.GetPipeName(Uri uri, IPipeTransportFactorySettings transportFactorySettings)    
 at System.ServiceModel.Channels.NamedPipeConnectionPoolRegistry.NamedPipeConnectionPool.GetPoolKey(EndpointAddress address, Uri via)    
 at System.ServiceModel.Channels.CommunicationPool`2.TakeConnection(EndpointAddress address, Uri via, TimeSpan timeout, TKey& key)    
 at System.ServiceModel.Channels.ConnectionPoolHelper.EstablishConnection(TimeSpan timeout)    
 at System.ServiceModel.Channels.ClientFramingDuplexSessionChannel.OnOpen(TimeSpan timeout)    
 at System.ServiceModel.Channels.CommunicationObject.Open(TimeSpan timeout)    
 at System.ServiceModel.Channels.ServiceChannel.OnOpen(TimeSpan timeout)    
 at System.ServiceModel.Channels.CommunicationObject.Open(TimeSpan timeout)    
 at System.ServiceModel.Channels.ServiceChannel.CallOpenOnce.System.ServiceModel.Channels.ServiceChannel.ICallOnce.Call(ServiceChannel channel, TimeSpan timeout)    
 at System.ServiceModel.Channels.ServiceChannel.CallOnceManager.CallOnce(TimeSpan timeout, CallOnceManager cascade)    
 at System.ServiceModel.Channels.ServiceChannel.EnsureOpened(TimeSpan timeout)    
 at System.ServiceModel.Channels.ServiceChannel.Call(String action, Boolean oneway, ProxyOperationRuntime operation, Object[] ins, Object[] outs, TimeSpan timeout)    
 at System.ServiceModel.Channels.ServiceChannelProxy.InvokeService(IMethodCallMessage methodCall, ProxyOperationRuntime operation)    
 at System.ServiceModel.Channels.ServiceChannelProxy.Invoke(IMessage message)    Exception rethrown
 at [0]:     
 at System.Runtime.Remoting.Proxies.RealProxy.HandleReturnMessage(IMessage reqMsg, IMessage retMsg)    
 at System.Runtime.Remoting.Proxies.RealProxy.PrivateInvoke(MessageData& msgData, Int32 type)    
 at Microsoft.IdentityModel.WindowsTokenService.S4UClient.IS4UService_dup.UpnLogon(String upn, Int32 pid)    
 at Microsoft.IdentityModel.WindowsTokenService.S4UClient.CallService(Func`2 contractOperation)    
 at Microsoft.SharePoint.SPSecurityContext.GetWindowsIdentity().

and a unexpected error

No windows identity for domain\user.

Strange thing is, that I also see this error for the content access account when the crawler is active.

When I make the user that is running te console app local admin the error is gone. When I open the web.config for my webapplication and set aspnet:AllowAnonymousImpersonation to false

<add key="aspnet:AllowAnonymousImpersonation" value="false" />

the error is also gone but I don't see the message

STS Call Claims Windows: Successfully requested sign-in claim identity for user 'DOMAIN\USER'.

My config for the claims to windows token service has all accounts allowed

<allowedCallers>
  <clear />
  <add value="IIS_IUSRS" />
  <add value="NT AUTHORITY\IUSR" />
  <add value="WSS_WPG" />
  <add value="NT AUTHORITY\Authenticated Users" />    
</allowedCallers>

Answer 1

SharePoint server is trying to establish named pipes connection to Claims to Windows Token Service using account which doesn't have necessary permissions. This is a false positive and most likely doesn't have to do anything with your original error. Since CSOM doesn't allow you to run the code with elevated privileges, this error can't avoided by using CSOM alone. If you were to use SSOM the workaround would be (under the assumption you don't need Claims to Windows Token Service) to run this code before:

typeof(SPSecurityContext).GetProperty("ClaimsToWindowsTokenServiceEnabled", BindingFlags.NonPublic | BindingFlags.Static).SetValue(null, false);