c# - WCF security failing -
i self-hosting wcf service. service should provide custom authentication method can used authenticate our customer applications connect it. have written custom username/password validator, don't think it's being used. when attempt call service, message "the local security authority cannot contacted."
app.config:
<system.servicemodel> <behaviors> <servicebehaviors> <behavior name="basichttpbehavior"> <servicemetadata httpgetenabled="true" httpgeturl="http://win8drewdev:8001/testservice/mex"/> <servicecredentials> <servicecertificate findvalue="0e 99 26 9b 04 20 93 86 5e 65 ad bb 7e 6d ea 62 8a 8a 07 7a" storelocation="currentuser" storename="my" x509findtype="findbyserialnumber"/> <usernameauthentication usernamepasswordvalidationmode="custom" customusernamepasswordvalidatortype="simpletestvalidator.wcfvalidator, simpletestvalidator"/> </servicecredentials> </behavior> </servicebehaviors> </behaviors> <bindings> <nettcpbinding> <binding name="simpleauthbinding"> <security mode="transportwithmessagecredential"> <transport clientcredentialtype="none" /> <message clientcredentialtype="username"/> </security> </binding> </nettcpbinding> </bindings> <services> <service name="simpletestserver.testservice" behaviorconfiguration="basichttpbehavior"> <endpoint address="net.tcp://win8drewdev:8000/testservice" binding="nettcpbinding" bindingconfiguration="simpleauthbinding" contract="simpletestserver.itestservice" /> </service> </services> </system.servicemodel> any thoughts on i'm doing wrong?
per answer below, i'm attaching trace log of when problem happens. appear indicate happening on client side, i'm still not sure leaves me.
<e2etraceevent xmlns="http://schemas.microsoft.com/2004/06/e2etraceevent"> <system xmlns="http://schemas.microsoft.com/2004/06/windows/eventlog/system"> <eventid>131075</eventid> <type>3</type> <subtype name="error">0</subtype> <level>2</level> <timecreated systemtime="2014-09-11t12:13:38.0193252z" /> <source name="system.servicemodel" /> <correlation activityid="{3c51d0c7-20ae-4401-b57b-771ebdbb8f83}" /> <execution processname="simpletestserver.vshost" processid="1572" threadid="18" /> <channel /> <computer>win8drewdev</computer> </system> <applicationdata> <tracedata> <dataitem> <tracerecord xmlns="http://schemas.microsoft.com/2004/10/e2etraceevent/tracerecord" severity="error"> <traceidentifier>http://msdn.microsoft.com/en-us/library/system.servicemodel.diagnostics.throwingexception.aspx</traceidentifier> <description>throwing exception.</description> <appdomain>simpletestserver.vshost.exe</appdomain> <exception> <exceptiontype>system.servicemodel.communicationexception, system.servicemodel, version=4.0.0.0, culture=neutral, publickeytoken=b77a5c561934e089</exceptiontype> <message>the socket connection aborted. caused error processing message or receive timeout being exceeded remote host, or underlying network resource issue. local socket timeout '00:10:00'.</message> <stacktrace> @ system.servicemodel.channels.socketconnection.endread() @ system.servicemodel.channels.delegatingconnection.endread() @ system.servicemodel.channels.tracingconnection.endread() @ system.servicemodel.channels.connectionstream.readasyncresult.handleio(iconnection connection) @ system.servicemodel.channels.connectionstream.ioasyncresult.onasynciocomplete(object state) @ system.servicemodel.channels.tracingconnection.tracingconnectionstate.executecallback() @ system.servicemodel.channels.tracingconnection.waitcallback(object state) @ system.servicemodel.channels.socketconnection.finishread() @ system.servicemodel.channels.socketconnection.onreceiveasync(object sender, socketasynceventargs eventargs) @ system.servicemodel.channels.socketconnection.onreceiveasynccompleted(object sender, socketasynceventargs e) @ system.net.sockets.socketasynceventargs.oncompleted(socketasynceventargs e) @ system.net.sockets.socketasynceventargs.finishoperationasyncfailure(socketerror socketerror, int32 bytestransferred, socketflags flags) @ system.net.sockets.socketasynceventargs.completionportcallback(uint32 errorcode, uint32 numbytes, nativeoverlapped* nativeoverlapped) @ system.threading._iocompletioncallback.performiocompletioncallback(uint32 errorcode, uint32 numbytes, nativeoverlapped* poverlap) </stacktrace> <exceptionstring>system.servicemodel.communicationexception: socket connection aborted. caused error processing message or receive timeout being exceeded remote host, or underlying network resource issue. local socket timeout '00:10:00'. ---&gt; system.net.sockets.socketexception: existing connection forcibly closed remote host @ system.servicemodel.channels.socketconnection.handlereceiveasynccompleted() @ system.servicemodel.channels.socketconnection.onreceiveasync(object sender, socketasynceventargs eventargs) --- end of inner exception stack trace ---</exceptionstring> <innerexception> <exceptiontype>system.net.sockets.socketexception, system, version=4.0.0.0, culture=neutral, publickeytoken=b77a5c561934e089</exceptiontype> <message>an existing connection forcibly closed remote host</message> <stacktrace> @ system.servicemodel.channels.socketconnection.handlereceiveasynccompleted() @ system.servicemodel.channels.socketconnection.onreceiveasync(object sender, socketasynceventargs eventargs)</stacktrace> <exceptionstring>system.net.sockets.socketexception (0x80004005): existing connection forcibly closed remote host @ system.servicemodel.channels.socketconnection.handlereceiveasynccompleted() @ system.servicemodel.channels.socketconnection.onreceiveasync(object sender, socketasynceventargs eventargs)</exceptionstring> <nativeerrorcode>2746</nativeerrorcode> </innerexception> </exception> </tracerecord> </dataitem> </tracedata> </applicationdata> </e2etraceevent> here's trace activity client:
<e2etraceevent xmlns="http://schemas.microsoft.com/2004/06/e2etraceevent"> <system xmlns="http://schemas.microsoft.com/2004/06/windows/eventlog/system"> <eventid>131075</eventid> <type>3</type> <subtype name="error">0</subtype> <level>2</level> <timecreated systemtime="2014-09-11t12:53:17.8882554z" /> <source name="system.servicemodel" /> <correlation activityid="{b3316328-1b82-4aa3-b45c-ba8e7fd42c20}" /> <execution processname="simplewcfclient.vshost" processid="1816" threadid="9" /> <channel /> <computer>ussdev08ws02</computer> </system> <applicationdata> <tracedata> <dataitem> <tracerecord xmlns="http://schemas.microsoft.com/2004/10/e2etraceevent/tracerecord" severity="error"> <traceidentifier>http://msdn.microsoft.com/en-us/library/system.servicemodel.diagnostics.throwingexception.aspx</traceidentifier> <description>throwing exception.</description> <appdomain>simplewcfclient.vshost.exe</appdomain> <exception> <exceptiontype>system.servicemodel.security.securitynegotiationexception, system.servicemodel, version=4.0.0.0, culture=neutral, publickeytoken=b77a5c561934e089</exceptiontype> <message>a call sspi failed, see inner exception.</message> <stacktrace> @ system.servicemodel.channels.sslstreamsecurityupgradeinitiator.oninitiateupgrade(stream stream, securitymessageproperty&amp; remotesecurity) @ system.servicemodel.channels.streamsecurityupgradeinitiatorbase.initiateupgrade(stream stream) @ system.servicemodel.channels.connectionupgradehelper.initiateupgrade(streamupgradeinitiator upgradeinitiator, iconnection&amp; connection, clientframingdecoder decoder, idefaultcommunicationtimeouts defaulttimeouts, timeouthelper&amp; timeouthelper) @ system.servicemodel.channels.clientframingduplexsessionchannel.sendpreamble(iconnection connection, arraysegment`1 preamble, timeouthelper&amp; timeouthelper) @ system.servicemodel.channels.clientframingduplexsessionchannel.duplexconnectionpoolhelper.acceptpooledconnection(iconnection connection, timeouthelper&amp; timeouthelper) @ system.servicemodel.channels.connectionpoolhelper.establishconnection(timespan timeout) @ system.servicemodel.channels.clientframingduplexsessionchannel.onopen(timespan timeout) @ system.servicemodel.channels.communicationobject.open(timespan timeout) @ system.servicemodel.channels.servicechannel.onopen(timespan timeout) @ system.servicemodel.channels.communicationobject.open(timespan timeout) @ system.runtimemethodhandle.invokemethod(object target, object[] arguments, signature sig, boolean constructor) @ system.reflection.runtimemethodinfo.unsafeinvokeinternal(object obj, object[] parameters, object[] arguments) @ system.reflection.runtimemethodinfo.invoke(object obj, bindingflags invokeattr, binder binder, object[] parameters, cultureinfo culture) @ system.servicemodel.channels.servicechannelproxy.executemessage(object target, imethodcallmessage methodcall) @ system.servicemodel.channels.servicechannelproxy.invokechannel(imethodcallmessage methodcall) @ system.servicemodel.channels.servicechannelproxy.invoke(imessage message) @ system.runtime.remoting.proxies.realproxy.privateinvoke(messagedata&amp; msgdata, int32 type) @ system.servicemodel.icommunicationobject.open(timespan timeout) @ system.servicemodel.channels.securitychannelfactory`1.clientsecuritychannel`1.onopen(timespan timeout) @ system.servicemodel.channels.communicationobject.open(timespan timeout) @ system.servicemodel.security.securitysessionsecuritytokenprovider.dooperation(securitysessionoperation operation, endpointaddress target, uri via, securitytoken currenttoken, timespan timeout) @ system.servicemodel.security.securitysessionsecuritytokenprovider.gettokencore(timespan timeout) @ system.identitymodel.selectors.securitytokenprovider.gettoken(timespan timeout) @ system.servicemodel.security.securitysessionclientsettings`1.clientsecuritysessionchannel.onopen(timespan timeout) @ system.servicemodel.channels.communicationobject.open(timespan timeout) @ system.servicemodel.channels.servicechannel.onopen(timespan timeout) @ system.servicemodel.channels.communicationobject.open(timespan timeout) @ system.servicemodel.channels.servicechannel.callopenonce.system.servicemodel.channels.servicechannel.icallonce.call(servicechannel channel, timespan timeout) @ system.servicemodel.channels.servicechannel.calloncemanager.callonce(timespan timeout, calloncemanager cascade) @ system.servicemodel.channels.servicechannel.ensureopened(timespan timeout) @ system.servicemodel.channels.servicechannel.call(string action, boolean oneway, proxyoperationruntime operation, object[] ins, object[] outs, timespan timeout) @ system.servicemodel.channels.servicechannelproxy.invokeservice(imethodcallmessage methodcall, proxyoperationruntime operation) @ system.servicemodel.channels.servicechannelproxy.invoke(imessage message) @ system.runtime.remoting.proxies.realproxy.privateinvoke(messagedata&amp; msgdata, int32 type) @ simplewcfclient.testservice.itestservice.hello() @ simplewcfclient.program.main(string[] args) @ system.appdomain._nexecuteassembly(runtimeassembly assembly, string[] args) @ system.appdomain.executeassembly(string assemblyfile, evidence assemblysecurity, string[] args) @ microsoft.visualstudio.hostingprocess.hostproc.runusersassembly() @ system.threading.threadhelper.threadstart_context(object state) @ system.threading.executioncontext.runinternal(executioncontext executioncontext, contextcallback callback, object state, boolean preservesyncctx) @ system.threading.executioncontext.run(executioncontext executioncontext, contextcallback callback, object state, boolean preservesyncctx) @ system.threading.executioncontext.run(executioncontext executioncontext, contextcallback callback, object state) @ system.threading.threadhelper.threadstart() </stacktrace> <exceptionstring> system.servicemodel.security.securitynegotiationexception: call sspi failed, see inner exception. ---&gt; system.security.authentication.authenticationexception: call sspi failed, see inner exception. ---&gt; system.componentmodel.win32exception: local security authority cannot contacted --- end of inner exception stack trace --- @ system.net.security.sslstate.startsendauthresetsignal(protocoltoken message, asyncprotocolrequest asyncrequest, exception exception) @ system.net.security.sslstate.checkcompletionbeforenextreceive(protocoltoken message, asyncprotocolrequest asyncrequest) @ system.net.security.sslstate.startsendblob(byte[] incoming, int32 count, asyncprotocolrequest asyncrequest) @ system.net.security.sslstate.processreceivedblob(byte[] buffer, int32 count, asyncprotocolrequest asyncrequest) @ system.net.security.sslstate.startreadframe(byte[] buffer, int32 readbytes, asyncprotocolrequest asyncrequest) @ system.net.security.sslstate.startreceiveblob(byte[] buffer, asyncprotocolrequest asyncrequest) @ system.net.security.sslstate.checkcompletionbeforenextreceive(protocoltoken message, asyncprotocolrequest asyncrequest) @ system.net.security.sslstate.startsendblob(byte[] incoming, int32 count, asyncprotocolrequest asyncrequest) @ system.net.security.sslstate.forceauthentication(boolean receivefirst, byte[] buffer, asyncprotocolrequest asyncrequest) @ system.net.security.sslstate.processauthentication(lazyasyncresult lazyresult) @ system.net.security.sslstream.authenticateasclient(string targethost, x509certificatecollection clientcertificates, sslprotocols enabledsslprotocols, boolean checkcertificaterevocation) @ system.servicemodel.channels.sslstreamsecurityupgradeinitiator.oninitiateupgrade(stream stream, securitymessageproperty&amp; remotesecurity) --- end of inner exception stack trace --- </exceptionstring> <innerexception> <exceptiontype>system.security.authentication.authenticationexception, system, version=4.0.0.0, culture=neutral, publickeytoken=b77a5c561934e089</exceptiontype> <message>a call sspi failed, see inner exception.</message> <stacktrace> @ system.net.security.sslstate.startsendauthresetsignal(protocoltoken message, asyncprotocolrequest asyncrequest, exception exception) @ system.net.security.sslstate.checkcompletionbeforenextreceive(protocoltoken message, asyncprotocolrequest asyncrequest) @ system.net.security.sslstate.startsendblob(byte[] incoming, int32 count, asyncprotocolrequest asyncrequest) @ system.net.security.sslstate.processreceivedblob(byte[] buffer, int32 count, asyncprotocolrequest asyncrequest) @ system.net.security.sslstate.startreadframe(byte[] buffer, int32 readbytes, asyncprotocolrequest asyncrequest) @ system.net.security.sslstate.startreceiveblob(byte[] buffer, asyncprotocolrequest asyncrequest) @ system.net.security.sslstate.checkcompletionbeforenextreceive(protocoltoken message, asyncprotocolrequest asyncrequest) @ system.net.security.sslstate.startsendblob(byte[] incoming, int32 count, asyncprotocolrequest asyncrequest) @ system.net.security.sslstate.forceauthentication(boolean receivefirst, byte[] buffer, asyncprotocolrequest asyncrequest) @ system.net.security.sslstate.processauthentication(lazyasyncresult lazyresult) @ system.net.security.sslstream.authenticateasclient(string targethost, x509certificatecollection clientcertificates, sslprotocols enabledsslprotocols, boolean checkcertificaterevocation) @ system.servicemodel.channels.sslstreamsecurityupgradeinitiator.oninitiateupgrade(stream stream, securitymessageproperty&amp; remotesecurity) </stacktrace> <exceptionstring> system.security.authentication.authenticationexception: call sspi failed, see inner exception. ---&gt; system.componentmodel.win32exception: local security authority cannot contacted --- end of inner exception stack trace --- @ system.net.security.sslstate.startsendauthresetsignal(protocoltoken message, asyncprotocolrequest asyncrequest, exception exception) @ system.net.security.sslstate.checkcompletionbeforenextreceive(protocoltoken message, asyncprotocolrequest asyncrequest) @ system.net.security.sslstate.startsendblob(byte[] incoming, int32 count, asyncprotocolrequest asyncrequest) @ system.net.security.sslstate.processreceivedblob(byte[] buffer, int32 count, asyncprotocolrequest asyncrequest) @ system.net.security.sslstate.startreadframe(byte[] buffer, int32 readbytes, asyncprotocolrequest asyncrequest) @ system.net.security.sslstate.startreceiveblob(byte[] buffer, asyncprotocolrequest asyncrequest) @ system.net.security.sslstate.checkcompletionbeforenextreceive(protocoltoken message, asyncprotocolrequest asyncrequest) @ system.net.security.sslstate.startsendblob(byte[] incoming, int32 count, asyncprotocolrequest asyncrequest) @ system.net.security.sslstate.forceauthentication(boolean receivefirst, byte[] buffer, asyncprotocolrequest asyncrequest) @ system.net.security.sslstate.processauthentication(lazyasyncresult lazyresult) @ system.net.security.sslstream.authenticateasclient(string targethost, x509certificatecollection clientcertificates, sslprotocols enabledsslprotocols, boolean checkcertificaterevocation) @ system.servicemodel.channels.sslstreamsecurityupgradeinitiator.oninitiateupgrade(stream stream, securitymessageproperty&amp; remotesecurity) </exceptionstring> <innerexception> <exceptiontype>system.componentmodel.win32exception, system, version=4.0.0.0, culture=neutral, publickeytoken=b77a5c561934e089</exceptiontype> <message>the local security authority cannot contacted</message> <stacktrace> @ system.servicemodel.channels.sslstreamsecurityupgradeinitiator.oninitiateupgrade(stream stream, securitymessageproperty&amp; remotesecurity) @ system.servicemodel.channels.streamsecurityupgradeinitiatorbase.initiateupgrade(stream stream) @ system.servicemodel.channels.connectionupgradehelper.initiateupgrade(streamupgradeinitiator upgradeinitiator, iconnection&amp; connection, clientframingdecoder decoder, idefaultcommunicationtimeouts defaulttimeouts, timeouthelper&amp; timeouthelper) @ system.servicemodel.channels.clientframingduplexsessionchannel.sendpreamble(iconnection connection, arraysegment`1 preamble, timeouthelper&amp; timeouthelper) @ system.servicemodel.channels.clientframingduplexsessionchannel.duplexconnectionpoolhelper.acceptpooledconnection(iconnection connection, timeouthelper&amp; timeouthelper) @ system.servicemodel.channels.connectionpoolhelper.establishconnection(timespan timeout) @ system.servicemodel.channels.clientframingduplexsessionchannel.onopen(timespan timeout) @ system.servicemodel.channels.communicationobject.open(timespan timeout) @ system.servicemodel.channels.servicechannel.onopen(timespan timeout) @ system.servicemodel.channels.communicationobject.open(timespan timeout) @ system.runtimemethodhandle.invokemethod(object target, object[] arguments, signature sig, boolean constructor) @ system.reflection.runtimemethodinfo.unsafeinvokeinternal(object obj, object[] parameters, object[] arguments) @ system.reflection.runtimemethodinfo.invoke(object obj, bindingflags invokeattr, binder binder, object[] parameters, cultureinfo culture) @ system.servicemodel.channels.servicechannelproxy.executemessage(object target, imethodcallmessage methodcall) @ system.servicemodel.channels.servicechannelproxy.invokechannel(imethodcallmessage methodcall) @ system.servicemodel.channels.servicechannelproxy.invoke(imessage message) @ system.runtime.remoting.proxies.realproxy.privateinvoke(messagedata&amp; msgdata, int32 type) @ system.servicemodel.icommunicationobject.open(timespan timeout) @ system.servicemodel.channels.securitychannelfactory`1.clientsecuritychannel`1.onopen(timespan timeout) @ system.servicemodel.channels.communicationobject.open(timespan timeout) @ system.servicemodel.security.securitysessionsecuritytokenprovider.dooperation(securitysessionoperation operation, endpointaddress target, uri via, securitytoken currenttoken, timespan timeout) @ system.servicemodel.security.securitysessionsecuritytokenprovider.gettokencore(timespan timeout) @ system.identitymodel.selectors.securitytokenprovider.gettoken(timespan timeout) @ system.servicemodel.security.securitysessionclientsettings`1.clientsecuritysessionchannel.onopen(timespan timeout) @ system.servicemodel.channels.communicationobject.open(timespan timeout) @ system.servicemodel.channels.servicechannel.onopen(timespan timeout) @ system.servicemodel.channels.communicationobject.open(timespan timeout) @ system.servicemodel.channels.servicechannel.callopenonce.system.servicemodel.channels.servicechannel.icallonce.call(servicechannel channel, timespan timeout) @ system.servicemodel.channels.servicechannel.calloncemanager.callonce(timespan timeout, calloncemanager cascade) @ system.servicemodel.channels.servicechannel.ensureopened(timespan timeout) @ system.servicemodel.channels.servicechannel.call(string action, boolean oneway, proxyoperationruntime operation, object[] ins, object[] outs, timespan timeout) @ system.servicemodel.channels.servicechannelproxy.invokeservice(imethodcallmessage methodcall, proxyoperationruntime operation) @ system.servicemodel.channels.servicechannelproxy.invoke(imessage message) @ system.runtime.remoting.proxies.realproxy.privateinvoke(messagedata&amp; msgdata, int32 type) @ simplewcfclient.testservice.itestservice.hello() @ simplewcfclient.program.main(string[] args) @ system.appdomain._nexecuteassembly(runtimeassembly assembly, string[] args) @ system.appdomain.executeassembly(string assemblyfile, evidence assemblysecurity, string[] args) @ microsoft.visualstudio.hostingprocess.hostproc.runusersassembly() @ system.threading.threadhelper.threadstart_context(object state) @ system.threading.executioncontext.runinternal(executioncontext executioncontext, contextcallback callback, object state, boolean preservesyncctx) @ system.threading.executioncontext.run(executioncontext executioncontext, contextcallback callback, object state, boolean preservesyncctx) @ system.threading.executioncontext.run(executioncontext executioncontext, contextcallback callback, object state) @ system.threading.threadhelper.threadstart() </stacktrace> <exceptionstring>system.componentmodel.win32exception (0x80004005): local security authority cannot contacted</exceptionstring> <nativeerrorcode>80090304</nativeerrorcode> </innerexception> </innerexception> </exception> </tracerecord> </dataitem> </tracedata> </applicationdata> </e2etraceevent> for stumbles across post, i've found answer , wasn't in of above. creating own certificates use it's closed system, don't want purchase certificates every machine involved , locations of machines prohibit using windows certificate authority. reason (that i'm still trying fathom), when request certificate 1 machine, sign on , store on original machine can't find private key associated certificate. i'm not sure why that's happening, causing problem wcf can't use key encrypt/decrypt data.
there couple of things done.
first of all,
try removing spaces in findvalue="0e 99 26 9b 04 20 93 86 5e 65 ad bb 7e 6d ea 62 8a 8a 07 7a"
second,
make following changes in behaviour of client app.config , install service certificate in trustedpeople store of client machine.
<behavior name="clientcertificatebehavior"> <datacontractserializer maxitemsinobjectgraph="2147483647" /> <clientcredentials> <servicecertificate> <defaultcertificate x509findtype="findbythumbprint" storename="trustedpeople" storelocation="localmachine" findvalue="9d4c41cde9d2b82d751a5416fd2eb6df98d3b7545"/> <authentication certificatevalidationmode ="peerorchaintrust"/> </servicecertificate> </clientcredentials> </behavior> third, use custom binding in service config , app config
<custombinding> <binding name="usernamecertificate" receivetimeout="00:10:00" sendtimeout="00:10:00"> <reliablesession ordered="true" inactivitytimeout="01:00:00" maxpendingchannels="128" flowcontrolenabled="true" /> <binarymessageencoding> <readerquotas maxdepth="32" maxstringcontentlength="2147483647" maxarraylength="2147483647" maxbytesperread="4096" maxnametablecharcount="16384" /> </binarymessageencoding> <security authenticationmode="secureconversation" requirederivedkeys ="true"> <secureconversationbootstrap authenticationmode="usernameforcertificate" /> </security> <tcptransport maxpendingconnections="100" listenbacklog="100" hostnamecomparisonmode="strongwildcard" transfermode="buffered" maxbufferpoolsize="1073741824" maxbuffersize="1073741824" maxreceivedmessagesize="1073741824" /> </binding> </custombinding> finally, if problem still persists try switching off security none , check if works. if does, domain issue. (don't forget add tcp port firewall exceptions.)
start wcf tracing give more insight on actual problem. refer link
Comments
Post a Comment