WCF communication across domains - wcf

Question

I have a workflow WCF service (ServiceDMZ) that is installed on a server across the firewall. This service is running under a Windows account on that server. Account name: DMZDomain\DMZUserName.
I have another workflow WCF service that is running on my development machine (ServiceDev). This is a self hosted service running under my Windows account: DevDomain\DevUserName.
ServiceDev communicates with ServiceDMZ using wsHttpContextBinding and context correlation in the Send and Recieve activities. ServiceDMZ uses a callback address to communicate back to ServiceDev when it is done completing a task.
I get this error in the Send activity of ServiceDev:
System.ServiceModel.Security.SecurityNegotiationException: The caller was not authenticated by the service. ---> System.ServiceModel.FaultException: The request for security token could not be satisfied because authentication failed. at System.ServiceModel.Security.SecurityUtils.ThrowIfNegotiationFault(Message message, EndpointAddress target) at System.ServiceModel.Security.IssuanceTokenProviderBase`1.ThrowIfFault(Message message, EndpointAddress target) at System.ServiceModel.Security.SspiNegotiationTokenProvider.GetNextOutgoingMessageBody(Message incomingMessage, SspiNegotiationTokenProviderState sspiState) --- End of inner exception stack trace --- at System.ServiceModel.Activities.InternalSendMessage.OnSendFailure(NativeActivityFaultContext context, Exception propagatedException, ActivityInstance propagatedFrom) at System.Activities.Runtime.FaultCallbackWrapper.Invoke(NativeActivityFaultContext faultContext, Exception propagatedException, ActivityInstance propagatedFrom) at System.Activities.Runtime.FaultCallbackWrapper.FaultWorkItem.Execute(ActivityExecutor executor, BookmarkManager bookmarkManager)
What should the settings be in the app.config file for ServiceDev and ServiceDMZ?
Thanks!
Hello, thanks for the comments. Here are the configuration files.
ServiceDev
<system.serviceModel>
<services>
<service name="ServiceDev" behaviorConfiguration="ServiceDevBehavior">
<host>
<baseAddresses>
<add baseAddress="http://10.204.78.16:9101/"/>
</baseAddresses>
</host>
<endpoint address="http://10.204.78.16:9101/ServiceDev" binding="wsHttpBinding" contract="IServiceDev" bindingConfiguration="ServiceDevBinding"></endpoint>
<endpoint address="http://10.204.78.16:9101/ServiceDev/mex" binding="mexHttpBinding" contract="IMetadataExchange"></endpoint>
<endpoint address="http://10.204.78.16:9101/ServiceDevCallback" binding="wsHttpContextBinding" contract="IServiceDevCallback" bindingConfiguration="ClientServiceDMZBinding"></endpoint>
</service>
</services>
<client>
<endpoint address="http://10.169.24.14:9100/ServiceDMZ" binding="wsHttpContextBinding" contract="IServiceDMZ" name="ClientServiceDMZ" bindingConfiguration="ClientServiceDMZBinding">
<identity>
<userPrincipalName value="DMZUserName#dmzsvr1.mysite.com"/>
</identity>
</endpoint>
</client>
<bindings>
<wsHttpBinding>
<binding name="ServiceDevBinding" maxReceivedMessageSize="8388608">
<security>
<transport clientCredentialType="Windows" proxyCredentialType="None" realm=""/>
<message clientCredentialType="Windows" negotiateServiceCredential="true" algorithmSuite="TripleDesRsa15" establishSecurityContext="true"/>
</security>
</binding>
</wsHttpBinding>
<wsHttpContextBinding>
<binding name="ClientServiceDMZBinding" clientCallbackAddress="http://10.204.78.16:9101/ServiceDevCallback">
<reliableSession ordered="true" inactivityTimeout="00:10:00" enabled="false" />
<security>
<message clientCredentialType="Windows" negotiateServiceCredential="true" algorithmSuite="Default"/>
<transport clientCredentialType="Windows" proxyCredentialType="None" realm=""/>
</security>
</binding>
</wsHttpContextBinding>
</bindings>
<behaviors>
<serviceBehaviors>
<behavior name="ServiceDevBehavior">
<serviceDebug includeExceptionDetailInFaults="true" httpHelpPageEnabled="true"/>
<serviceMetadata httpGetEnabled="true"/>
<sqlWorkflowInstanceStore connectionStringName="MySite.Deployment.Data.Providers.WorkflowInstanceStoreProvider" instanceCompletionAction="DeleteNothing" instanceLockedExceptionAction="BasicRetry" instanceEncodingOption="GZip" hostLockRenewalPeriod="00:01:00"/>
</behavior>
</serviceBehaviors>
</behaviors>
<standardEndpoints>
<dynamicEndpoint>
<standardEndpoint name="ClientServiceDMZDynamicEndpointConfiguration">
<discoveryClientSettings>
<endpoint kind="udpDiscoveryEndpoint" endpointConfiguration="ServiceDMZUDPDiscoveryEndpoint"></endpoint>
</discoveryClientSettings>
</standardEndpoint>
</dynamicEndpoint>
<udpDiscoveryEndpoint>
<standardEndpoint name="ServiceDMZUDPDiscoveryEndpoint" discoveryVersion="WSDiscovery11">
</standardEndpoint>
</udpDiscoveryEndpoint>
</standardEndpoints>
<serviceHostingEnvironment multipleSiteBindingsEnabled="true"/>
<diagnostics performanceCounters="All">
<messageLogging logEntireMessage="true" logMalformedMessages="true" logMessagesAtServiceLevel="true" logMessagesAtTransportLevel="true" maxMessagesToLog="30000" maxSizeOfMessageToLog="2000000">
</messageLogging>
</diagnostics>
ServiceDMZ
<system.serviceModel>
<services>
<service name="ServiceDMZ" behaviorConfiguration="ServiceDMZBehavior">
<host>
<baseAddresses>
<add baseAddress="http://10.169.24.14:9100/"/>
</baseAddresses>
</host>
<endpoint address="http://10.169.24.14:9100/ServiceDMZ" binding="wsHttpContextBinding" contract="IServiceDMZ" bindingConfiguration="ServiceDMZBinding" behaviorConfiguration="ServiceDMZEndpointBehavior" />
<endpoint address="http://10.169.24.14:9100/ServiceDMZ/mex" binding="mexHttpBinding" contract="IMetadataExchange"></endpoint>
<endpoint name="udpDiscovery" kind="udpDiscoveryEndpoint" />
</service>
</services>
<bindings>
<wsHttpContextBinding>
<binding name="ServiceDMZBinding" clientCallbackAddress="http://10.204.78.16:9101/ServiceDevCallback">
<security>
<message clientCredentialType="Windows" negotiateServiceCredential="true" algorithmSuite="Default"/>
<transport clientCredentialType="Windows" realm="" proxyCredentialType="None"/>
</security>
</binding>
</wsHttpContextBinding>
</bindings>
<behaviors>
<serviceBehaviors>
<behavior name="ServiceDMZBehavior">
<serviceDebug includeExceptionDetailInFaults="true" httpHelpPageEnabled="true"/>
<serviceMetadata httpGetEnabled="true"/>
<serviceDiscovery>
<announcementEndpoints>
<endpoint kind="udpAnnouncementEndpoint" />
</announcementEndpoints>
</serviceDiscovery>
</behavior>
</serviceBehaviors>
<endpointBehaviors>
<behavior name="ServiceDMZEndpointBehavior">
<endpointDiscovery>
<scopes>
</scopes>
</endpointDiscovery>
</behavior>
</endpointBehaviors>
</behaviors>
<standardEndpoints>
<udpDiscoveryEndpoint>
<standardEndpoint name="ServiceDMZUDPDiscoveryEndpoint" discoveryVersion="WSDiscovery11" maxResponseDelay="00:00:00.600"/>
</udpDiscoveryEndpoint>
</standardEndpoints>
<diagnostics performanceCounters="All">
<messageLogging logEntireMessage="true" logMalformedMessages="true" logMessagesAtServiceLevel="true" logMessagesAtTransportLevel="true" maxMessagesToLog="30000" maxSizeOfMessageToLog="2000000">
</messageLogging>
</diagnostics>

Answer 1

This could be is a partial trust problem. Security is WCF requires full trust for full functionality, without this it only supports a subset of the functionality, see http://msdn.microsoft.com/en-us/library/bb412186.aspx
Also if you are using windows authentication it would require trust between the domains, assuming that your machines are in different domains.