Sharepoint 2013 / error 8306

Question

We began to see this error in our SP 2013 farm a few days ago.
No configuration changes have been made in the farm or Active Directory.

Event 8306:
An exception occurred when trying to issue security token: The HTTP request is unauthorized with client authentication scheme 'Negotiate'. The authentication header received from the server was 'Negotiate,NTLM'..

Steps taken without success:

1. Restart SecurityToken app pool in IIS in all farm servers
2. We ran this but it failed:
   $hostSvc = Get-SPServiceHostconfig
   $hostSvc.Provision()
   $SecToken=Get-SPServiceApplication | where { $_.TypeName -Like “Security Token*”}
   $SecToken.provision()
3. SecurityToken URL loads successfully:
   http://localhost:32843/SecurityTokenServiceApplication/securitytoken.svc
4. .NET trust level for the secure token service is set to "Full" in IIS

So it seems the SecurityToken service is up, but for some reason is unable to issue tokens.
Please provide some guidance on this.
Thank you in advance!

Answer 1

what do you mean by SP 2013 farm

Answer 2

Hi @De Rada Sancibrian, Javier ,

Per my undersatnding, here is a checklist:

1.Check whether all servers can SecurityToken URL loads successfully.

2.Check whether the Identity of the Security Token Service application affected is the same as that of the normal server. If it is not the same, change it to the correct Identity. And restart to make sure the information is correct.

3.Use this script to detect some services that interact with the Security Token Service.

Add-PSSnapin *sharepoint*  
$farm = [Microsoft.SharePoint.Administration.SPFarm]::Local   
$webServiceCollection = new-object Microsoft.SharePoint.Administration.SPWebServiceCollection($farm)   
foreach ($service in $webServiceCollection)   
{ foreach ($webApp in $service.WebApplications)   
{ $firstWebApp = $webApp  
#Get the context   
$context = $firstWebApp.GetResponseUri([Microsoft.SharePoint.Administration.SPUrlZone]::Default)   
Write-Host "Web Application Context:" $context.AbsoluteUri   
#Call the token generator function   
$token = [Microsoft.SharePoint.SPSecurityContext]::SecurityTokenForContext($context)   
Write-Host "Token:" $token.InternalTokenReference   
Write-Host "**************************" } }  

Under normal circumstances, there should be no issue after running:

You could refer to this post for more information:
SharePoint: Troubleshooting the Security Token Service

Note: Microsoft is providing this information as a convenience to you. The sites are not controlled by Microsoft. Microsoft cannot make any representations regarding the quality, safety, or suitability of any software or information found there. Please make sure that you completely understand the risk before retrieving any suggestions from the above link.

---

If the answer is helpful, please click "Accept Answer" and upvote it.

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.