How to use wsHttpBinding with message security through load balancer

Question

I have a load-balanced service that uses message protection:

<wsHttpBinding> <binding> <security mode="Message"> <message clientCredentialType="Windows" establishSecurityContext="false" /> </security> </binding> </wsHttpBinding> 

All my calls to this service open and close their own channel, so there is no use for establishing a security context.

I call the service using WSHttpBinding , which matches the service configuration:

 ws.Security.Mode = SecurityMode.Message; ws.Security.Transport.ClientCredentialType = HttpClientCredentialType.None; ws.Security.Message.ClientCredentialType = MessageCredentialType.Windows; ws.Security.Message.EstablishSecurityContext = false; 

This works sometimes, but sometimes I get errors like

The security context identifier has expired or is invalid. The message was not processed.

or

The security token request has invalid or invalid elements.

Finally, I found that setting a InstallSecurityContext to false does not actually prevent the use of security context tokens. Our load balancer does not currently use sticky sessions, and I try to avoid this route.

I found that I had to set NegotiateServiceCredential to false on the client in order to allow load balancing without sticky sessions . My service is already running under the AD account, and I see it in WSDL:

 <Upn> User@Domain </Upn> 

However, when I try to add a service identifier to my client

 EndpointIDentity.CreateUpnIdentity(" User@Domain ") 

I get the following error:

Authentication of a service running under a user account that requires multi-level Kerberos is not supported.

How do I go through this to be able to call my service through a load balancer?

Answer 1

According to the documentation for NegotiateServiceCredential, you should start the service using the SPN instead of UPN:

If this property is set to false and the binding is configured to use Windows as the client credential type, the service account must be associated with the service principal name (SPN). To do this, start the services in the NETWORK SERVICE or LOCAL SYSTEM account. Alternatively, use the SetSpn.exe tool to create the SPN for the service account. In either case, the client must use the correct SPN in the <servicePrincipalName> element or using the EndpointAddress constructor.

After you configure the SPN on which your service is running, your WSDL should display the SPN instead of UPN, then you will have to change your client so that: EndpointIdentity.CreateSpnIdentity("service_spn_name")

Update:

The following command should configure SPN correctly:

setspn -A YourSvc/host.server.com domain\AppPoolAcccountName

• YourSvc = name identifying your svc
• host.server.com = fully qualified host name of the server on which your service is hosted,

See docs for setspn