Am I in a Catch-22 situation here? My goal is to take a WCF service that I inherited, and run it on a VM and test it by calling it from my desktop PC.
The VM is in a workgroup, and not in
the company's domain. Basically, we need more test environments, ideally one per
developer (we may have 2 to 4 people that need this). Thus
the idea of
the VM was that each
developer could have his own web server that somewhat matches or real environment (where we actually have two websites, an external/exposed and internal).
[Using VS2010 .NET 4.0]
In
the internal service, each method was decorated with this attribute:
[OperationBehavior(Impersonation = ImpersonationOption.Required)]
I'm still researching why this was needed. I think it's because a webapp calls
the "internal" service, and either a) we need
the credentials of
the user, or b) we may doing some PrinciplePermission.Demands to see if
the user is in a group. My interest is creating some ConsoleTest programs or UnitTest programs.
I changed to allowed like this:
[OperationBehavior(Impersonation = ImpersonationOption.Allowed)]
because I was getting this error in trying to view
the .svc in
the browser:
The contract operation 'EditAccountFamily' requires Windows identity for automatic impersonation. A Windows identity that represents
the caller is not provided by binding ('WSHttpBinding','http://tempuri.org/') for contract ('IAdminService','http://tempuri.org/'.
I don't get that error with
the original bindings look like this:
However, I believe I need to turn off this security since
the web service is not on
the domain.
I tend to get these errors in
the client:
1)
The request for security token could not be satisfied because authentication failed - as an InnerException of "SecurityNegotiation was unhandled".
or
2)
The caller was not authenticated by
the service as an InnerException of "SecurityNegotiation was unhandled".
So can I create some configuration of code and web.config that will allow each
developer to work on his own VM? Or must I join
the VM to
the domain?
The number of permutations seems near endless. I've started to create a Word.doc that says what to do with each error, but now I'm in
the catch-22 where I'm stuck.
Thanks,
Neal
Server Bindings:
<bindings>
<wsHttpBinding>
<binding
name="wsHttpEndpointBinding"
maxBufferPoolSize="2147483647"
maxReceivedMessageSize="500000000">
<readerQuotas
maxDepth="2147483647"
maxStringContentLength="2147483647"
maxArrayLength="2147483647"
maxBytesPerRead="2147483647"
maxNameTableCharCount="2147483647" />
<!-- <security mode="None" /> This is one thing I tried -->
<security>
<message
clientCredentialType="Windows" />
</security>
</binding>
</wsHttpBinding>
</bindings>
<behaviors>
<serviceBehaviors>
<behavior
name="ABC.AdminService.AdminServiceBehavior">
<!-- To avoid disclosing metadata information, set
the value below to false and
remove
the metadata endpoint above before deployment -->
<serviceMetadata
httpGetEnabled="true" />
<!-- To receive exception details in faults for debugging purposes, set
the value below to true.
Set to false before deployment to avoid disclosing exception information -->
<serviceDebug
includeExceptionDetailInFaults="true" />
<serviceCredentials>
</serviceCredentials>
<!--<serviceAuthorization principalPermissionMode="UseAspNetRoles"
roleProviderName="AspNetWindowsTokenRoleProvider"/>-->
<serviceAuthorization
principalPermissionMode="UseWindowsGroups"
impersonateCallerForAllOperations="true" />
</behavior>
<behavior
name="ABC.AdminService.IAdminServiceTransportBehavior">
<!-- To avoid disclosing metadata information, set
the value below to false and
remove
the metadata endpoint above before deployment -->
<serviceMetadata
httpGetEnabled="true" />
<!-- To receive exception details in faults for debugging purposes, set
the value below to true.
Set to false before deployment to avoid disclosing exception information -->
<serviceDebug
includeExceptionDetailInFaults="false" />
<serviceCredentials>
<clientCertificate>
<authentication
certificateValidationMode="PeerTrust" />
</clientCertificate>
<serviceCertificate
findValue="WCfServer"
storeLocation="LocalMachine"
storeName="My"
x509FindType="FindBySubjectName" />
</serviceCredentials>
</behavior>
</serviceBehaviors>
</behaviors>
<serviceHostingEnvironment
multipleSiteBindingsEnabled="true" />
CLIENT:
<system.serviceModel>
<bindings>
<wsHttpBinding>
<binding name="WSHttpBinding_IAdminService" closeTimeout="00:01:00"
openTimeout="00:01:00" receiveTimeout="00:10:00" sendTimeout="00:01:00"
bypassProxyOnLocal="false" transactionFlow="false" hostNameComparisonMode="StrongWildcard"
maxBufferPoolSize="524288" maxReceivedMessageSize="65536"
messageEncoding="Text" textEncoding="utf-8" useDefaultWebProxy="true"
allowCookies="false">
<readerQuotas maxDepth="32" maxStringContentLength="8192" maxArrayLength="16384"
maxBytesPerRead="4096" maxNameTableCharCount="16384" />
<reliableSession ordered="true" inactivityTimeout="00:10:00"
enabled="false" />
<security mode="Message">
<transport clientCredentialType="Windows" proxyCredentialType="None"
realm="" />
<message clientCredentialType="Windows" negotiateServiceCredential="true"
algorithmSuite="Default" />
</security>
</binding>
</wsHttpBinding>
</bindings>
<client>
<endpoint address="http://192.168.159.132/EC_AdminService/AdminService.svc"
binding="wsHttpBinding" bindingConfiguration="WSHttpBinding_IAdminService"
contract="svcRef.IAdminService" name="WSHttpBinding_IAdminService">
<identity>
<dns value="localhost" />
</identity>
</endpoint>
</client>
</system.serviceModel>
