Am I
in a Catch-22 situation here? My goal is
to take a WCF service that I inherited, and run it on a VM and test it by calling it from my desktop PC. The VM is
in a workgroup, and not
in the company's domain. Basically, we need more test environments, ideally one per developer (we may have 2
to 4 people that need this). Thus the idea of the VM was that each developer could have his own
web server that somewhat matches or real environment (where we actually have two websites, an external/exposed and internal).
[Using VS2010 .
NET 4.0]
In the internal service, each method was decorated with this attribute:
[OperationBehavior(Impersonation = ImpersonationOption.Required)]
I'm still researching why this was needed. I think it's because a webapp calls the "internal" service, and either a) we need the credentials of the user, or b) we may doing some PrinciplePermission.Demands
to see if the user is
in a group. My interest is creating some ConsoleTest programs or UnitTest programs.
I changed
to allowed like this:
[OperationBehavior(Impersonation = ImpersonationOption.Allowed)]
because I was getting this error
in trying
to view the .svc
in the browser:
The contract operation 'EditAccountFamily' requires Windows identity for automatic impersonation. A Windows identity that represents the caller is not provided by binding ('WSHttpBinding','http://tempuri.org/') for contract ('IAdminService','http://tempuri.org/'.
I don't
get that error with the original bindings look like this:
However, I believe I need
to turn off this security since the
web service is not on the domain.
I tend
to get these errors
in the client:
1) The request for security token could not be satisfied because authentication failed - as an InnerException of "SecurityNegotiation was unhandled".
or
2) The caller was not authenticated by the service as an InnerException of "SecurityNegotiation was unhandled".
So can I create some configuration of code and
web.config that will allow each developer
to work on his own VM? Or must I join the VM
to the domain?
The number of permutations seems near endless. I've started
to create a Word.doc that says what
to do with each error, but now I'm
in the catch-22 where I'm stuck.
Thanks,
Neal
Server Bindings:
<bindings>
<wsHttpBinding>
<binding
name="wsHttpEndpointBinding"
maxBufferPoolSize="2147483647"
maxReceivedMessageSize="500000000">
<readerQuotas
maxDepth="2147483647"
maxStringContentLength="2147483647"
maxArrayLength="2147483647"
maxBytesPerRead="2147483647"
maxNameTableCharCount="2147483647" />
<!-- <security mode="None" /> This is one thing I tried -->
<security>
<message
clientCredentialType="Windows" />
</security>
</binding>
</wsHttpBinding>
</bindings>
<behaviors>
<serviceBehaviors>
<behavior
name="ABC.AdminService.AdminServiceBehavior">
<!--
To avoid disclosing metadata information, set the value below
to false and
remove the metadata endpoint above before deployment -->
<serviceMetadata
httpGetEnabled="true" />
<!--
To receive exception details
in faults for debugging purposes, set the value below
to true.
Set
to false before deployment
to avoid disclosing exception information -->
<serviceDebug
includeExceptionDetailInFaults="true" />
<serviceCredentials>
</serviceCredentials>
<!--<serviceAuthorization principalPermissionMode="UseAspNetRoles"
roleProviderName="AspNetWindowsTokenRoleProvider"/>-->
<serviceAuthorization
principalPermissionMode="UseWindowsGroups"
impersonateCallerForAllOperations="true" />
</behavior>
<behavior
name="ABC.AdminService.IAdminServiceTransportBehavior">
<!--
To avoid disclosing metadata information, set the value below
to false and
remove the metadata endpoint above before deployment -->
<serviceMetadata
httpGetEnabled="true" />
<!--
To receive exception details
in faults for debugging purposes, set the value below
to true.
Set
to false before deployment
to avoid disclosing exception information -->
<serviceDebug
includeExceptionDetailInFaults="false" />
<serviceCredentials>
<clientCertificate>
<authentication
certificateValidationMode="PeerTrust" />
</clientCertificate>
<serviceCertificate
findValue="WCfServer"
storeLocation="LocalMachine"
storeName="My"
x509FindType="FindBySubjectName" />
</serviceCredentials>
</behavior>
</serviceBehaviors>
</behaviors>
<serviceHostingEnvironment
multipleSiteBindingsEnabled="true" />
CLIENT:
<system.serviceModel>
<bindings>
<wsHttpBinding>
<binding name="WSHttpBinding_IAdminService" closeTimeout="00:01:00"
openTimeout="00:01:00" receiveTimeout="00:10:00" sendTimeout="00:01:00"
bypassProxyOnLocal="false" transactionFlow="false" hostNameComparisonMode="StrongWildcard"
maxBufferPoolSize="524288" maxReceivedMessageSize="65536"
messageEncoding="Text" textEncoding="utf-8" useDefaultWebProxy="true"
allowCookies="false">
<readerQuotas maxDepth="32" maxStringContentLength="8192" maxArrayLength="16384"
maxBytesPerRead="4096" maxNameTableCharCount="16384" />
<reliableSession ordered="true" inactivityTimeout="00:10:00"
enabled="false" />
<security mode="Message">
<transport clientCredentialType="Windows" proxyCredentialType="None"
realm="" />
<message clientCredentialType="Windows" negotiateServiceCredential="true"
algorithmSuite="Default" />
</security>
</binding>
</wsHttpBinding>
</bindings>
<client>
<endpoint address="http://192.168.159.132/EC_AdminService/AdminService.svc"
binding="wsHttpBinding" bindingConfiguration="WSHttpBinding_IAdminService"
contract="svcRef.IAdminService" name="WSHttpBinding_IAdminService">
<identity>
<dns value="localhost" />
</identity>
</endpoint>
</client>
</system.serviceModel>
