Authentication/Impersonation issue with ASP.NET call to WCF Service - asp.net

Question

I have a web page that calls a WCF service that makes a sql database call using Integrated Security. I get an error saying, "Login failed for user 'CorpDomain\ServerName01$'". I want it so that it all layers will execute under the user's AD credetials (working in an intranet), ie: "CorpDomain\Albert".
On the server (Win 2008/IIS 7), I have Windows Authentication turned on and everything else off (including Anonymous) under Authentication for both the web client and the WCF service.
Here's my client web.config:
<configuration>
<system.web>
<compilation debug="true" targetFramework="4.0"/>
<authentication mode="Windows"/>
<identity impersonate="true"/>
<customErrors mode="Off"/>
</system.web>
<system.serviceModel>
<bindings>
<netTcpBinding>
<binding name="NetTcpBinding_IMyService" closeTimeout="00:01:00" openTimeout="00:01:00" receiveTimeout="00:10:00" sendTimeout="00:01:00" transactionFlow="false" transferMode="Buffered" transactionProtocol="OleTransactions" hostNameComparisonMode="StrongWildcard" listenBacklog="10" maxBufferPoolSize="524288" maxBufferSize="65536" maxConnections="10" maxReceivedMessageSize="65536">
<readerQuotas maxDepth="32" maxStringContentLength="8192" maxArrayLength="16384" maxBytesPerRead="4096" maxNameTableCharCount="16384" />
<reliableSession ordered="true" inactivityTimeout="00:10:00" enabled="false" />
<!--<security mode="Transport">
<transport clientCredentialType="Windows" protectionLevel="EncryptAndSign" />
<message clientCredentialType="Windows" />
</security>-->
</binding>
</netTcpBinding>
</bindings>
<client>
<endpoint address="net.tcp://myurladdress/MyServices/Service.svc"
binding="netTcpBinding" bindingConfiguration="NetTcpBinding_IMyService"
contract="MySvc.IMyService" name="NetTcpBinding_IMyService" />
</client>
<behaviors>
<endpointBehaviors>
<behavior name="ClientUserNameBehavior">
<clientCredentials>
<windows allowedImpersonationLevel="Impersonation"/>
</clientCredentials>
</behavior>
</endpointBehaviors>
</behaviors>
</system.serviceModel>
Here's my WCF service web.config:
<?xml version="1.0"?>
<configuration>
<system.web>
<compilation debug="true" targetFramework="4.0" />
<authentication mode="Windows"/>
<identity impersonate="true"/>
</system.web>
<connectionStrings>
<!--DB CONNECTION-->
<add name="myDB" connectionString="Integrated Security=SSPI;Persist Security Info=False;Initial Catalog=Carbon;Data Source=mydbname,10600" providerName="System.Data.SqlClient"/>
</connectionStrings>
<system.serviceModel>
<services>
<service name="WCFServices.MyService" behaviorConfiguration="MyServiceBehavior">
<host>
<baseAddresses>
<add baseAddress="net.tcp://localhost:8000/WCFServices/MyService"/>
</baseAddresses>
</host>
<endpoint address="" binding="netTcpBinding" contract="WCFServices.IMyService" bindingConfiguration="tcpWindowsSecurity" bindingNamespace="http://WCFServices.MySvc/"/>
<endpoint address="MEX" binding="mexTcpBinding" contract="IMetadataExchange"/>
</service>
</services>
<behaviors>
<serviceBehaviors>
<behavior name="MyServiceBehavior">
<serviceMetadata httpGetEnabled="false"/>
<serviceDebug includeExceptionDetailInFaults="true"/>
<serviceAuthorization impersonateCallerForAllOperations="true" />
</behavior>
</serviceBehaviors>
</behaviors>
<bindings>
<netTcpBinding>
<binding name="tcpWindowsSecurity" maxReceivedMessageSize="524288" maxBufferSize="524288">
<!--<security mode="TransportWithMessageCredential">
<transport clientCredentialType="Windows" protectionLevel="None" />
</security>-->
</binding>
</netTcpBinding>
</bindings>
<!--<serviceHostingEnvironment multipleSiteBindingsEnabled="true" >-->
<serviceHostingEnvironment >
<serviceActivations>
<add relativeAddress="~/MyService.svc" service="WCFServices.MyService"/>
</serviceActivations>
</serviceHostingEnvironment>
</system.serviceModel>
<system.webServer>
<modules runAllManagedModulesForAllRequests="true"/>
</system.webServer>
</configuration>
on the client side:
Request.ServerVariables["AUTH_USER"].ToString() = "CorpDomain\Albert"
Page.User.Identity.Name = "CorpDomain\Albert"
System.Threading.Thread.CurrentPrincipal.Identity.Name = "CorpDomain\Albert"
System.Security.Principal.WindowsIdentity.GetCurrent().Name = "NT AUTHORITY\NETWORK SERVICE"
My client code is basically:
MySvc.MyServiceClient svc = new MySvc.MyServiceClient();
svc.ClientCredentials.Windows.AllowedImpersonationLevel = TokenImpersonationLevel.Impersonation;
Response.Write(svc.GetServiceHtml());
and on the WCF side:
ServiceSecurityContext.Current.WindowsIdentity.Name = "NT AUTHORITY\NETWORK SERVICE"
server side code is:
[OperationBehavior(Impersonation = ImpersonationOption.Required)]
public string GetServcieHtml()
{
string name, link;
StringBuilder html = new StringBuilder();
html.Append(ServiceSecurityContext.Current.WindowsIdentity.Name);
try
{
using (SqlConnection conn = GetDataConnection())
{
conn.Open();
SqlCommand sqlcom = new SqlCommand("dbo.runsomeproc", conn);
sqlcom.CommandType = CommandType.StoredProcedure;
SqlDataReader sqlDataReader = sqlcom.ExecuteReader();
while (sqlDataReader.Read())
{
// ** SOME CODE HERE **
}
conn.Close();
}
}
catch (Exception ex)
{
html.AppendLine("<br><br>ERROR:" + ex.Message + " " + ex.InnerException);
return html.ToString();
}
return html.ToString();
}
Note:
The error I get is: ERROR:Login failed for user 'CorpDomain\ServerName01$'.
Any idea what I'm doing wrong?

Answer 1

Also, correct me if I'm wrong, but in your client web.config, you have a behaviour that will set impersonation level to "Impersonation", but you do not reference that behaviour in your endpoint. Eg:
<client>
<endpoint address="net.tcp://myurladdress/MyServices/Service.svc"
binding="netTcpBinding" bindingConfiguration="NetTcpBinding_IMyService"
contract="MySvc.IMyService" name="NetTcpBinding_IMyService" />
</client>
Should be:
<client>
<endpoint address="net.tcp://myurladdress/MyServices/Service.svc"
binding="netTcpBinding" bindingConfiguration="NetTcpBinding_IMyService"
contract="MySvc.IMyService" name="NetTcpBinding_IMyService"
behaviorConfiguration="ClientUserNameBehavior" />
</client>

Answer 2

You also need to enable impersonation at the WCF service level as well.
This MSDN page contains all the details.

Answer 3

I don't know if this will help anyone, but I had this problem. The problem was due to the identity setting of the Application Pool that my service was using in IIS. If you set the appropriate identity there, you should be good. In my case, the default was set to NT Authority\Network Service.