Databases
StackOverflow2013
Postsdbo
POAuthentication/Impersonation issue with ASP.NET call to WCF Service
Body
 

Note that there are some explanatory texts on larger screens.

plurals
  1. POAuthentication/Impersonation issue with ASP.NET call to WCF Service
    text
    copied!<p>I have a web page that calls a WCF service that makes a sql database call using Integrated Security. I get an error saying, "Login failed for user 'CorpDomain\ServerName01$'". I want it so that it all layers will execute under the user's AD credetials (working in an intranet), ie: "CorpDomain\Albert".</p> <p>On the server (Win 2008/IIS 7), I have Windows Authentication turned on and everything else off (including Anonymous) under Authentication for both the web client and the WCF service. </p> <p>Here's my client web.config:</p> <pre><code>&lt;configuration&gt; &lt;system.web&gt; &lt;compilation debug="true" targetFramework="4.0"/&gt; &lt;authentication mode="Windows"/&gt; &lt;identity impersonate="true"/&gt; &lt;customErrors mode="Off"/&gt; &lt;/system.web&gt; &lt;system.serviceModel&gt; &lt;bindings&gt; &lt;netTcpBinding&gt; &lt;binding name="NetTcpBinding_IMyService" closeTimeout="00:01:00" openTimeout="00:01:00" receiveTimeout="00:10:00" sendTimeout="00:01:00" transactionFlow="false" transferMode="Buffered" transactionProtocol="OleTransactions" hostNameComparisonMode="StrongWildcard" listenBacklog="10" maxBufferPoolSize="524288" maxBufferSize="65536" maxConnections="10" maxReceivedMessageSize="65536"&gt; &lt;readerQuotas maxDepth="32" maxStringContentLength="8192" maxArrayLength="16384" maxBytesPerRead="4096" maxNameTableCharCount="16384" /&gt; &lt;reliableSession ordered="true" inactivityTimeout="00:10:00" enabled="false" /&gt; &lt;!--&lt;security mode="Transport"&gt; &lt;transport clientCredentialType="Windows" protectionLevel="EncryptAndSign" /&gt; &lt;message clientCredentialType="Windows" /&gt; &lt;/security&gt;--&gt; &lt;/binding&gt; &lt;/netTcpBinding&gt; &lt;/bindings&gt; &lt;client&gt; &lt;endpoint address="net.tcp://myurladdress/MyServices/Service.svc" binding="netTcpBinding" bindingConfiguration="NetTcpBinding_IMyService" contract="MySvc.IMyService" name="NetTcpBinding_IMyService" /&gt; &lt;/client&gt; &lt;behaviors&gt; &lt;endpointBehaviors&gt; &lt;behavior name="ClientUserNameBehavior"&gt; &lt;clientCredentials&gt; &lt;windows allowedImpersonationLevel="Impersonation"/&gt; &lt;/clientCredentials&gt; &lt;/behavior&gt; &lt;/endpointBehaviors&gt; &lt;/behaviors&gt; &lt;/system.serviceModel&gt; </code></pre> <p></p> <p>Here's my WCF service web.config:</p> <pre><code>&lt;?xml version="1.0"?&gt; &lt;configuration&gt; &lt;system.web&gt; &lt;compilation debug="true" targetFramework="4.0" /&gt; &lt;authentication mode="Windows"/&gt; &lt;identity impersonate="true"/&gt; &lt;/system.web&gt; &lt;connectionStrings&gt; &lt;!--DB CONNECTION--&gt; &lt;add name="myDB" connectionString="Integrated Security=SSPI;Persist Security Info=False;Initial Catalog=Carbon;Data Source=mydbname,10600" providerName="System.Data.SqlClient"/&gt; &lt;/connectionStrings&gt; &lt;system.serviceModel&gt; &lt;services&gt; &lt;service name="WCFServices.MyService" behaviorConfiguration="MyServiceBehavior"&gt; &lt;host&gt; &lt;baseAddresses&gt; &lt;add baseAddress="net.tcp://localhost:8000/WCFServices/MyService"/&gt; &lt;/baseAddresses&gt; &lt;/host&gt; &lt;endpoint address="" binding="netTcpBinding" contract="WCFServices.IMyService" bindingConfiguration="tcpWindowsSecurity" bindingNamespace="http://WCFServices.MySvc/"/&gt; &lt;endpoint address="MEX" binding="mexTcpBinding" contract="IMetadataExchange"/&gt; &lt;/service&gt; &lt;/services&gt; &lt;behaviors&gt; &lt;serviceBehaviors&gt; &lt;behavior name="MyServiceBehavior"&gt; &lt;serviceMetadata httpGetEnabled="false"/&gt; &lt;serviceDebug includeExceptionDetailInFaults="true"/&gt; &lt;serviceAuthorization impersonateCallerForAllOperations="true" /&gt; &lt;/behavior&gt; &lt;/serviceBehaviors&gt; &lt;/behaviors&gt; &lt;bindings&gt; &lt;netTcpBinding&gt; &lt;binding name="tcpWindowsSecurity" maxReceivedMessageSize="524288" maxBufferSize="524288"&gt; &lt;!--&lt;security mode="TransportWithMessageCredential"&gt; &lt;transport clientCredentialType="Windows" protectionLevel="None" /&gt; &lt;/security&gt;--&gt; &lt;/binding&gt; &lt;/netTcpBinding&gt; &lt;/bindings&gt; &lt;!--&lt;serviceHostingEnvironment multipleSiteBindingsEnabled="true" &gt;--&gt; &lt;serviceHostingEnvironment &gt; &lt;serviceActivations&gt; &lt;add relativeAddress="~/MyService.svc" service="WCFServices.MyService"/&gt; &lt;/serviceActivations&gt; &lt;/serviceHostingEnvironment&gt; &lt;/system.serviceModel&gt; &lt;system.webServer&gt; &lt;modules runAllManagedModulesForAllRequests="true"/&gt; &lt;/system.webServer&gt; &lt;/configuration&gt; </code></pre> <p>on the <strong>client side</strong>:</p> <p>Request.ServerVariables["AUTH_USER"].ToString() = "CorpDomain\Albert"</p> <p>Page.User.Identity.Name = "CorpDomain\Albert"</p> <p>System.Threading.Thread.CurrentPrincipal.Identity.Name = "CorpDomain\Albert"</p> <p>System.Security.Principal.WindowsIdentity.GetCurrent().Name = "NT AUTHORITY\NETWORK SERVICE"</p> <p>My client code is basically:</p> <pre><code>MySvc.MyServiceClient svc = new MySvc.MyServiceClient(); svc.ClientCredentials.Windows.AllowedImpersonationLevel = TokenImpersonationLevel.Impersonation; Response.Write(svc.GetServiceHtml()); </code></pre> <p>and on the <strong>WCF side</strong>:</p> <p>ServiceSecurityContext.Current.WindowsIdentity.Name = "NT AUTHORITY\NETWORK SERVICE"</p> <p>server side code is:</p> <pre><code>[OperationBehavior(Impersonation = ImpersonationOption.Required)] public string GetServcieHtml() { string name, link; StringBuilder html = new StringBuilder(); html.Append(ServiceSecurityContext.Current.WindowsIdentity.Name); try { using (SqlConnection conn = GetDataConnection()) { conn.Open(); SqlCommand sqlcom = new SqlCommand("dbo.runsomeproc", conn); sqlcom.CommandType = CommandType.StoredProcedure; SqlDataReader sqlDataReader = sqlcom.ExecuteReader(); while (sqlDataReader.Read()) { // ** SOME CODE HERE ** } conn.Close(); } } catch (Exception ex) { html.AppendLine("&lt;br&gt;&lt;br&gt;ERROR:" + ex.Message + " " + ex.InnerException); return html.ToString(); } return html.ToString(); } </code></pre> <p><strong>Note:</strong> The error I get is: ERROR:Login failed for user 'CorpDomain\ServerName01$'. </p> <p>Any idea what I'm doing wrong?</p>
 

Querying!

 
Guidance
An individual column

Larger individual text columns get their own page to allow for proper reading.

SQuiL has stopped working due to an internal error.

If you are curious you may find further information in the browser console, which is accessible through the devtools (F12).

Reload