Impersonate session security context error without applying impersonation

Josué Zatarain 1

Hi,

So I have an app that creates a SQL connection with MARS enabled and also impersonation, but it doesn't do calls in more than one thread (legacy system), and that app calls a service that also creates a SQL connection with MARS enabled, but without applying impersonation, and that service can run concurrent batches (multiple queries at the same time).

The thing is, that the service is getting the error: "Impersonate Session Security Context" cannot be called in this batch because a simultaneous batch has called it.

Could that be a bug with SQL server trying to join connections or something? The connections in that service are new, so it doesn't make sense to me that an impersonation error appears.

SQL server 2017 - .net framework 4

Erland Sommarskog 110.3K Reputation points

2021-01-22T22:28:57.157+00:00

I think we would need to see a repro of this to understand what is going on. Would it be possible for you to compose one?
Sean Gallardy - MSFT 1,886 Reputation points Microsoft Employee

2021-01-27T00:51:23.143+00:00

You're using MARS which stands for Multiple Active Result Sets - so without any further information it's most likely that you have another batch executing on that connection which is issuing another batch, since they are both tied to the same connection it is not letting you impersonate since another batch is already running which is or has called it.

I'd get away from MARS to be quite honest, this doesn't look like a SQL Server issue per se.
Josué Zatarain 1 Reputation point

2021-01-28T16:33:39.08+00:00

But shouldn't that batch be processed under the new connection that doesn't apply impersonation?
Sean Gallardy - MSFT 1,886 Reputation points Microsoft Employee

2021-01-28T16:58:09.76+00:00

You're assuming that it's on a new connection, which it clearly isn't.
Josué Zatarain 1 Reputation point

2021-01-28T20:50:12.983+00:00

Why wouldn't it be a new connection? I don't see sp_reset_connection being called by the framework, so I'd suppose that the connection is being re-used. And the sql profiler doesn't show an impersonated user for the queries in that connection.
Sean Gallardy - MSFT 1,886 Reputation points Microsoft Employee

2021-01-28T20:53:33.447+00:00

You're using MARS so the connection can open up multiple active outstanding batches. That's, I assume, why you're using MARS.

I don't see sp_reset_connection being called by the framework, so I'd suppose that the connection is being re-used.

Exactly. Again, it seems as though all your troubles are coming down to improper use of MARS.
Josué Zatarain 1 Reputation point

2021-01-28T21:03:06.127+00:00

is not being re-used*
Sean Gallardy - MSFT 1,886 Reputation points Microsoft Employee

2021-01-28T21:10:04.597+00:00

If you don't see a reset then it wasn't reset... so it's still on the original connection.
Erland Sommarskog 110.3K Reputation points

2021-01-28T22:02:36.53+00:00

So I asked you for a repro five days ago, so that we don't have to do guessing.

But I am in full agreement with Sean. It definitely sounds like you are running two commands on the same MARS connection; this is fully clear by the absence of sp_reset_connection.

But if you are already using Profiler - just check the SPID column.

And I also agree with Sean that ditching MARS would change your life to the better.

Share via

Impersonate session security context error without applying impersonation

Your answer