Service Bus for Windows Server - Security/Permissions - servicebus

Question

I've been experimenting with Service Bus for Windows Server.
First some information about my environment.
I have two Windows 7 boxes (let's call them Host and Client). They both belong to a workgroup (no domain). Each machine has two user accounts (let's call them Admin and User) and the passwords match. On Host the Admin account is disabled and User is a member of the Administrators group. Service Bus for Windows Server is installed on Host. It was installed by the User account. The service runs under the User account credentials and User is listed as the ManageUser for the ServiceBusDefaultNamespace.
I've managed to get a simple Sender and Receiver working (hacked from the Azure Service Bus examples) when I run them both on the same machine under the same account that Service Bus was installed.
Then I tried copying the Sender to Client and running it. I had some problems with certificates but I've gotten past those. If I log onto Client as User the sender works. If I log onto Client as Admin the sender gives me a (401) Unauthorized. If I enable the Admin account on Host, then the Sender works.
All of the above makes a certain amount of sense. Host is trying to authenticate the request and when it finds the corresponding Admin account disabled it denies the request but it seems to create a slight inconvenience in that it requires me to have active accounts on all machines.
After a bit more digging, it seemed like I should be able to specify the account. When creating the MessagingFactory I'm creating a TokenProvider, and the TokenProvider allows me to specify a different set of credentials.
MessagingFactorySettings mfSettings = new MessagingFactorySettings()
{
TokenProvider = TokenProvider.CreateWindowsTokenProvider(
new List<Uri>() { rootAddressManagement },
new NetworkCredential( "Host\\User", "<User's Password>" ) )
};
But I still get the 401.
I guess I'm trying to figure out how to run (potentially) multiple Senders on different machines without requiring every account that a Sender might run under having an active account on the Host machine. Even in a domain-based environment it seems I'd run into this issue if the domain account under which the sender is running doesn't have privileges to access the host machine.

Answer 1

For workgroup machines, when specifying the network credential, don't add the host name, only the user. That should let your request be properly authenticated:
MessagingFactorySettings mfSettings = new MessagingFactorySettings()
{
TokenProvider = TokenProvider.CreateWindowsTokenProvider(
new List<Uri>() { rootAddressManagement },
new NetworkCredential( "User", "<User's Password>" ) )
};
This other thread has more information on the setup, if you still run into problems.