Problem Overview
The target principal name is incorrect error on a SQL Server connection is caused by an invalid Kerberos user specified by the client. This typically occurs after a user account or password is changed or with service principal name (SPN) configurations.
Impacted Audience
This guide is for developers who are encountering the target principal name is incorrect error when initiating a connection to a SQL Server instance.
Steps to Resolve
- Verify the User Principal Name (UPN) is valid.
- The User Principal Name (UPN) is a unique identifier for an identity within an Active Directory system and must match the account specified in the connection string.
- To view the UPN for an account, open the Active Directory Users and Computers (ADUC) management console and inspect the account.
- Verify the UPN has permission to connect to the SQL Server instance.
- Log in with a user that has permissions to view the SQL Server instance in ADUC and confirm the specified user account has rights to connect.
- Verify SPN configuration is correct
- For more secure deployments, customers may choose to configure SPNs. Confirm the SPN configurations are correct and activated on the server.
FAQ
Q: What are SPNs and how are they used?
A: Service Principal Names (SPNs) are a type of domain name object used to identify a service on a network. This allows the client to connect to the service via Kerberos authentication.
Q: What’s the difference between Kerberos and other authentication methods?
A: Kerberos is a secure authentication protocol used to authenticate a service requesting access to a resource. The request is sent to a Key Distribution Center (KDC), which verifies the user’s identity, and then sends a ticket granting the user access.
Q: What should I do if I'm still having problems after following the steps?
A: If you are still experiencing the issue after following the steps in the guide, there may be an issue with the domain infrastructure or server configurations. Contact your network administrator or server administrator to further troubleshoot the issue.