WCF Win32Exception / AuthenticationException
I recently came across a weird error with a parnter that we’re working with. He was getting SSPI errors at the the client side. I had seen these previously, but only when configuring SharePoint and our product (FirstPoint) for Kerberos.
After turning on Kerberos logging, it was clear that was clear that the client and service were trying to use Kerberos and failing with the error KRB_ERR_RESPONSE_TOO_BIG. Now it’s normal for the client and service to negotiate the authentication scheme and fall back onto NTLM, but it seemed that in this case, WCF was not falling back to NTLM due to the error type.
It was pretty baffling since we did have any issues using the same configuration in our test environments.
Fortunately, I came across a listing about this issue. The solution is to simply add an invalid SPN to the service and client, which forces the usage of NTLM.
|
1 2 3 4 5 6 7 8 9 |
<span style="font-family: Courier;"><span style="color: #3040fe;"><</span><span style="color: #ff0000;">endpoint address</span><span style="color: #3040fe;">=</span><span style="color: #ff00ff;">"net.tcp://myserver/myservice"</span> <span style="color: #ff0000;">binding</span><span style="color: #3040fe;">=</span><span style="color: #ff00ff;">"netTcpBinding" </span><span style="color: #ff0000;">bindingConfiguration</span><span style="color: #3040fe;">=</span><span style="color: #ff00ff;">"DefaultTcpBinding"</span> <span style="color: #ff0000;">contract</span><span style="color: #3040fe;">=</span><span style="color: #ff00ff;">"IMyService"</span> <span style="color: #00e100;">name</span><span style="color: #3040fe;">=</span><span style="color: #ff00ff;">"NetTcpBinding_IMyService"</span><span style="color: #3040fe;">></span> <span style="color: #000000;"> </span><span style="color: #3040fe;"><</span><span style="color: #ff0000;">identity</span><span style="color: #3040fe;">></span> <span style="color: #000000;"> </span><span style="color: #808080;"><!--/// The value is left intentionally blank ///---></span> <span style="color: #000000;"> </span><span style="color: #3040fe;"><</span><span style="color: #ff0000;">servicePrincipalName value</span><span style="color: #3040fe;">=</span><span style="color: #ff00ff;">""</span><span style="color: #3040fe;">/></span> <span style="color: #000000;"> </span><span style="color: #3040fe;"></</span><span style="color: #ff0000;">identity</span><span style="color: #3040fe;">></span> <span style="color: #3040fe;"></</span><span style="color: #ff0000;">endpoint</span><span style="color: #3040fe;">></span></span> |
Lesson learned!
