Diagnostic Server - Federation Communication Failure (4278891)

After federating, the Diagnostic Server throws the following error:

   Diagnostic Server - Federation Communication Failure

   Communications fo the configuration Diagnsotic Server failed:HttpsConnection 

   (https://<DS host name>/api/service/federation/transactions?

   fromds=<Traget DS host name>%3A3843&version=27.0&version=27.0&since=20000101010203004).readingString failed:

   Authentication failure

1. Port 40403 has to be opened between the Configuration Diagnostic Server and Member Diagnostic Server.  A telnet test can be done to validate this from Configuration Server to Member Server and vis versa.

   - telnet <Diagnostic Server Host> 40403

2. A secure channel has to be established between the computer and the domain controller, or else the computer will no longer able to authenticate to the domain. The Test-ComputerSecureChannel can validate if the channel between the local computer and its domain is working correctly by checking the status of its trust relationships. If the channel is working correctly, it returns $True and $False if it is not.  Open a PowerShell CMD line and run "Test-ComputerSecureChannel" at the prompt.

3. Make sure the service accounts (or account if both Diagnostic Servers use the same) associated with the Diagnostic Servers are member of the Local Admin Group and at least one of the Spotlight Groups - i.e. Spotlight Diagnostic Administrators, Spotlight Diagnostic Users, or Spotlight Diagnostic Read-Only Users group. 

4. In proxy environment make sure, that there are added exceptions in the Internet Explorer proxy settings for the federated servers. Login to the Diagnostic Server host with Diagnostic Server owner account and perform the following steps;

- Open Internet Options, Connections, LAN Setting
- Click Advanced
- Add DS host name in Exceptions