Databases
StackOverflow2013
Postsdbo
POService does not receive client credentials
Body
 

Note that there are some explanatory texts on larger screens.

plurals
  1. POService does not receive client credentials
    text
    copied!<p>I cannot seem to authorize service contract operations based on the credentials of the user who is calling my WCF service.</p> <p>Service Web.Config</p> <pre><code>&lt;system.serviceModel&gt; &lt;services&gt; &lt;service name="WCFService.Service" behaviorConfiguration="DefaultServiceBehavior"&gt; &lt;host&gt; &lt;baseAddresses&gt; &lt;add baseAddress="net.tcp://localhost:8080/WCFService"/&gt; &lt;/baseAddresses&gt; &lt;/host&gt; &lt;!-- Net.Tcp EndPoints--&gt; &lt;endpoint address="" binding="netTcpBinding" contract="WCFService.IService" bindingConfiguration="NetTcp_Secured"/&gt; &lt;endpoint address="mex" binding="mexTcpBinding" contract="IMetadataExchange" /&gt; &lt;/service&gt; &lt;/services&gt; &lt;bindings&gt; &lt;netTcpBinding&gt; &lt;binding name="NetTcp_Secured"&gt; &lt;security mode="Transport"&gt; &lt;message clientCredentialType="Windows" /&gt; &lt;transport clientCredentialType="Windows" protectionLevel="EncryptAndSign" /&gt; &lt;/security&gt; &lt;/binding&gt; &lt;/netTcpBinding&gt; &lt;/bindings&gt; &lt;behaviors&gt; &lt;serviceBehaviors&gt; &lt;behavior name="DefaultServiceBehavior"&gt; &lt;serviceMetadata httpGetEnabled="false" /&gt; &lt;/behavior&gt; &lt;/serviceBehaviors&gt; &lt;/behaviors&gt; &lt;/system.serviceModel&gt; </code></pre> <p>Client Web.Config</p> <pre><code>&lt;system.serviceModel&gt; &lt;behaviors&gt; &lt;endpointBehaviors&gt; &lt;behavior name="DefaultClientBehavior"&gt; &lt;clientCredentials&gt; &lt;windows allowNtlm="true" allowedImpersonationLevel="Delegation" /&gt; &lt;httpDigest impersonationLevel="Impersonation"/&gt; &lt;/clientCredentials&gt; &lt;/behavior&gt; &lt;/endpointBehaviors&gt; &lt;/behaviors&gt; &lt;bindings&gt; &lt;netTcpBinding&gt; &lt;binding name="NetTcpBinding"&gt; &lt;security mode="Transport"&gt; &lt;transport clientCredentialType="Windows" protectionLevel="EncryptAndSign" /&gt; &lt;message clientCredentialType="Windows"/&gt; &lt;/security&gt; &lt;/binding&gt; &lt;/netTcpBinding&gt; &lt;/bindings&gt; &lt;client&gt; &lt;endpoint address="net.tcp://localhost:8080/WCFService/Service.svc" binding="netTcpBinding" bindingConfiguration="NetTcpBinding" behaviorConfiguration="DefaultClientBehavior" contract="TestWcfService.IService" name="NetTcpBinding_IService"&gt; &lt;/endpoint&gt; &lt;/client&gt; &lt;/system.serviceModel&gt; </code></pre> <p>Service Code...</p> <pre><code>[OperationBehavior(Impersonation = ImpersonationOption.Required)] public string GetCurrentPrinciple() { return "Windows Identity: " + WindowsIdentity.GetCurrent().Name + " \\ " + "Thread Identity: " + System.Threading.Thread.CurrentPrincipal.Identity.Name; } </code></pre> <p>I believe this is the reason why this attribute causes a security exception...</p> <pre><code>[PrincipalPermission(SecurityAction.Demand, Name = @"DOMAIN_NAME\User")] </code></pre> <p>The method can be called just fine across the service which makes me think that the security settings are ok. However, the above code, which runs in the service, always returns the name of the App Pool identity and not the identity of the user who called the service. </p> <p>Doing the following in the immediate window of the service in a break point gives the following...</p> <pre><code>? WindowsIdentity.GetCurrent() {System.Security.Principal.WindowsIdentity} AuthenticationType: "Negotiate" Groups: {System.Security.Principal.IdentityReferenceCollection} ImpersonationLevel: Impersonation IsAnonymous: false IsAuthenticated: true IsGuest: false IsSystem: false Name: "IIS APPPOOL\\DefaultAppPool" Owner: {S-1-5-SAME-AS-BELOW-} Token: 2300 User: {S-1-5-SAME-AS-ABOVE-} </code></pre> <p>So I <em>am</em> authenticated - I just don't have the callers name!</p> <p>Both service and client are set to Windows Authentication. If I do this in the client...</p> <pre><code>protected void Page_Load(object sender, EventArgs e) { lblCurrentUser.Text = "Current Website User: " + HttpContext.Current.User.Identity.Name; } </code></pre> <p>... it returns the correct domain and and username so I know the client has correctly ascertained my Windows credentials via the browser.</p> <p>I am just not sure what I am missing here as to why the service does not report the client credentials.</p>
 

Querying!

 
Guidance
An individual column

Larger individual text columns get their own page to allow for proper reading.

SQuiL has stopped working due to an internal error.

If you are curious you may find further information in the browser console, which is accessible through the devtools (F12).

Reload