Return
-
Title
Diagnostic Server Federation Communications Failure "Failed to negotiate login" -
Description
Gettgin error below:
Diagnostic Server on XXXXX.prod.local • Diagnostic Server - Federation Communications Failure Communications to the configuration Diagnostic Server failed : Connecting to URL https://XXXXX.prod.local:40403/api/service/federation/transactions failed : Failed to negotiate login
-
Resolution
WORKAROUND 1
1. Port 40403 has to be opened between the Configuration Diagnostic Server and Member Diagnostic Server. A telnet test can be done to validate this from Configuration Server to Member Server and vis versa.- telnet 404032. A secure channel has to be established between the computer and the domain controller, or else the computer will no longer able to authenticate to the domain. The Test-ComputerSecureChannel can validate if the channel between the local computer and its domain is working correctly by checking the status of its trust relationships. If the channel is working correctly, it returns $True and $False if it is not. Open a PowerShell CMD line and run "Test-ComputerSecureChannel" at the prompt.3. Make sure the service accounts (or account if both Diagnostic Servers use the same) associated with the Diagnostic Servers are member of the Local Admin Group and at least one of the Spotlight Groups - i.e. Spotlight Diagnostic Administrators, Spotlight Diagnostic Users, or Spotlight Diagnostic Read-Only Users group.4. If 1 to 3 checks out, then do a force un-federation by copying the FederationService.xml from {Diagnostic Server dir}\agent\conf\ServiceDefaults to {Diagnostic Server dir}\agent\conf\Service and restart both Diagnostic Servers.
WORKAROUND 2
In one case the problem was that the internet options had an old server name in the exceptions.
After updatred this and restarting all the Diagnostic Servers, the issue was fixed.