WCF, Clientcredentials, multiple hop, kerberos and windows authentication - how to get working

Question

I have a web app running on Server A that calls a WCF service (K2 Workflow) on Server B that requires impersonation/delegation to run as the calling user. If I run the web app from Server A, the app works great. If I run the app from my local PC in debug, it also works great. If I hit the app from a browser on my PC to Server A, I get the following error:

The HTTP request is unauthorized with client authentication scheme 'Ntlm'. The authentication header received from the server was 'Ntlm,Negotiate'. System.Net.WebException: The remote server returned an error: (401) Unauthorized. at System.Net.HttpWebRequest.GetResponse() at System.ServiceModel.Channels.HttpChannelFactory`1.HttpRequestChannel.HttpChannelRequest.WaitForReply(TimeSpan timeout).

I use the following code to run the service:

SvcWorklist.ClientCredentials.Windows.AllowedImpersonationLevel = System.Security.Principal.TokenImpersonationLevel.Delegation;
SvcWorklist.ClientCredentials.Windows.ClientCredential = System.Net.CredentialCache.DefaultNetworkCredentials;

I feel like I've done everything, here is a list of what I've tried:

Setup a SPN (including port) with by Server A App pool domain user to Server B (NETBIOS and FQDN)
1. Set the same domain user as the app pool user on Server A and B
2. Ensure the app pool user is allowed to delegate in Active directory
3. Ensure both servers are allowed to delegate in AD
4. Set authentication to windows and impersonate=true in web.config on Server A
5. Ensured Thread.CurrentPrincipal.Identity.Name has my user ID
6. Ensured IIS is set for windows and impersonation
7. Tried restricting the IIS configuration on server A and B to only Ntlm and/or Negotiate

Any help or ideas are truly appreciated.

It looks like you have a similar issue as described here http://stackoverflow.com/questions/14928350/how-can-i-fix-the-kerberos-double-hop-issue — rene, Sep 18 '13 at 19:07
Yep, I read that. Add (8) set useapppoolcreditials=true and (9) I don't have a load balancer. — user2762765, Sep 18 '13 at 20:14
Not that it helps but I'm facing the same issue so I'm monitoring this question to see if an answer pops-up... — rene, Sep 18 '13 at 21:40
Well, if you figure it out, tell me please!!! I will do the same I promise. — user2762765, Sep 19 '13 at 12:46

score 0 · Answer 1 · answered Oct 09 '13 at 20:35

0

For the dude who had the same issue - I figured it out. I had the SPN set on the target service, not the service it's hosting. I also needed to set sharepoint to use negotiate versus ntlm.

answered Oct 09 '13 at 20:35

Jman

31
4

WCF, Clientcredentials, multiple hop, kerberos and windows authentication - how to get working

1 Answers1