I have a cross domain situation where the SQL Server 2008 R2 server sits in one domain and the client in another. There is a one-way trust between the domains. The SQL Server runs on a domain account. The domain account used on the client has been granted "Allowed To Authenticate" on the SQL Server machine and has been granted "Access this machine from the network" in the local machine policy on the SQL Server machine.
SSMS on the client connects just fine. However, when trying to connect with Embarcadero Change Manager, which uses the Microsoft JBDC driver, this exception is passed back to the client from the SQL Server:
SSPI handshake failed with error code 0x80090308, state 14 while establishing a connection with integrated security, the connection has been closed. Reason: AcceptSecurityContect failed. The Windows error code indicates the cause of the failure.
Login failed. The login is from an untrusted domain and cannot be used with Windows authentication.
My best guess is that there is some quirk with the Micorsoft JDBC driver causing this. The network traffic is not clear text so I can't readily see what's being sent over to the SQL Server.