How does WCF client generates target Service's SPN dynamically to get the kerberos ticket in Spnego Use case?
For example, if the target service is running under domain machine account, SPN associated with the Service would be in the form 'host/machinename'.
If we try to call the service using wcf client, wcf client is able to get the ticket for host/machinename. I initially thought that wcf client might be using hardcoded string host/+domainname by default.
But If I change the target service to run under domain user and associate SPN named "http/machinename" with the domain user, wcf client is still able to generate the ticket for this service successfully.
How does WCF client decides whether to use prefix 'host/' or 'http/' in these scenarios.
I know that there is a way to add custom spn on the client side under endpoint element but I'm interested to know how it works by default.
The default is host/myhostname for Windows credential type. This is also the expected SPN while running the WCF service with a machine account.
Note that the WSDL will include the Identity (e.g. SPN), so the WCF client can use that information while connecting. Check the WCF Test Client Config file to see what is actually generated.
Related
UPDATE 2: Solved the first problem (note below) - reduced the complexity/scope.
NOTE: If migrating from self-hosting WCF services in Cloud Services to Service Fabric using HttpsBinding then you need to change the HostNameComparisonMode from Exact to StrongWildcard.
I have scenario where I have to open many (100+) WCF Service Hosts to receive callbacks from an external service. They have same Contract but with differing credentials (service certificates are unique to each of our customers).
I would like to know if it is possible to route all requests through a single Host/Router that could check the connecting clients expected service certificate and either a) spoof/ignore (preferably) the service certificate or forward the connection onto the correct host.
I want to avoid having to load hundreds of service hosts with different credentials (which are stored in a database) when the service fabric node first comes up so I don't receive traffic to a service that's not loaded yet. Ideally I could load them when needed or not have to load them at all (spoofing certificate or something).
Looking for someone who is a lot savvier with WCF to shed some light on the possibilities. Thanks.
I am consuming WCF service in my VS 2005 solution by adding as webreference.
Ex: Today my WCF url address is - http://'ip-001':/service
If tomorrow i deployed my service in ip-002 machine, in this case i have to add again the service reference by using the http://'ip-002':/service
or
i have to change only config file.
Note: no service changes has made from ip-001 to ip-002.
Let me know without any service changes only url is changes in this case i have to change only config will it work?
as long as you don;t have security turned on this should be fine just changing the address. If you have security enabled then there are two issues to be aware of
If they are using SSL then you need to make sure that the certificate authority they are using is trusted on the client machine
If the client is identifying the remote machine by DNS then if you want to support more than one remote mahcine you have to switch to somethinglike certificate reference
in this case only changing the config will work.
The add web reference just contacts the meta data exchange endpoint and downloads the wsdl, which it then uses to generate the client side code to comply with the contract. you don't need to do this, you could hand craft the correct client side code, or share libraries with the server to have the same client side code.
Once you have this the client and server communicate with soap messages generated from that code. It is these soap messages that are important. As long as the server recieves correctly constructed messages and the client correctly decodes the messages from the server everything will work. The fact that it is now hosted on another server is moot.
Remember your service could be called by a client which is not .net based, so all that client side code could be generated in a different language, or the messages could be sent by someone manipulating the bits with magnets
I have created a WCF service which is hosted on a windows service over NetNamedPipeBinding protocol.Now I want to provide security to this service, as in users with username and passwords known only should access this service.So how do I provide a method level authentication to users to access this service?
NetNamedPipe binding doesn't support message level security out of the box. That would require custom binding. NetNamedPipe binding works only when both service and client are running on the same machine so there is assumption that if user has permissions to log in and the service is running she have also permission to call it. If you need to restrict users who can call the service you can always use custom authorization manager or role based security.
I'm using custom basic authentication module (http://www.custombasicauth.codeplex.com) for authenticating users in WCF service. I've used a custom membership provider and in the ValidateUser method I've making a db call and returning true if the authentication succeeds. I also created a binding that uses transport security for the WCF service. Everything works fine now the problem is the client want two endpoints to be created for the WCF service and the custom basic authentication should happen for one endpoint not for the other.
Is it really possible to achieve this by using the custom authentication module or I have to try some other ways?
This is not possible when hosting your service in IIS. IIS has authentication scoped per whole virtual directory and your endpoints are exposed on the same service = single resource in single virtual directory. You must either move to self hosting and host service in windows service (you will not need that module anymore) or you must deploy the service again to different virtual directory or web application and change security configuration in each deployment separately (= every endpoint will be in separate deployed service).
I have a WCF self-hosted as a Windows Service.
When I start the service (under the NETWORK_SERVICE account), I can consume the service from my ASP.NET application on a different server.
However, the business rules have changed. Now I need to run the service under my own account. I am able to stop the service, and start it again under my account. No problem there.
Until I try to consume the service from my ASP.NET application on the other service. I get:
A call to SSPI failed, see inner exception
I'm relatively certain there's something I need to do security wise to eliminate this error, being new to all this I just don't know what.
Any help is greatly appreciated.
Thanks,
Jason
Usually this is a sign of a missing or misconfigured SPN, which gets in the way when you're using windows authentication (at the transport or message level) and Kerberos is being negotiated.
Notice that how/when the error manifests itself might depend on the way the hostname (or IP address) of the service host is used in the URL used by the client, since WCF will try, by default, to deduce the right SPN to use based on the URL information, unless you explicitly override it by setting the endpoint identity.
So likely all you need to do is register an SPN (using setspn.exe) for your new service and make sure your client uses an appropriate identity.
There's some more extra information on how WCF uses service identities here, here and here.