CODEWITHSUNDEEP
wcfnet.tcp
Bravo
Bravo

Reputation: 3441

The server has rejected the client credentials

I have a WCF service with net.tcp binding, hosted on the server as a Windows service. I am not able to access this service. However I was able to do so, when I hosted it on my local network.

Error Recieved

Message:** The server has rejected the client credentials.

Inner Exception: 

System.Security.Authentication.InvalidCredentialException:
The server has rejected the client credentials.
---> System.ComponentModel.Win32Exception:
The logon attempt failed --- End of inner exception stack trace
--- at System.Net.Security.NegoState.ProcessAuthentication(LazyAsyncResult lazyResult)
at System.Net.Security.NegotiateStream.AuthenticateAsClient(NetworkCredential credential, ChannelBinding binding, String targetName, ProtectionLevel requiredProtectionLevel, TokenImpersonationLevel allowedImpersonationLevel)
at System.Net.Security.NegotiateStream.AuthenticateAsClient(NetworkCredential credential, String targetName, ProtectionLevel requiredProtectionLevel, TokenImpersonationLevel allowedImpersonationLevel)
at System.ServiceModel.Channels.WindowsStreamSecurityUpgradeProvider.WindowsStreamSecurityUpgradeInitiator.OnInitiateUpgrade(Stream stream, SecurityMessageProperty& remoteSecurity)

Tried searching for the solution, but found none that fits my requirements, hence posted here.

What could be the problem?

If I make my security mode to None on the client

<security mode="None"></security>

I get another error:

Error: The socket connection was aborted. This could be caused by an error processing your message or a receive timeout being exceeded by the remote host, or an underlying network resource issue. Local socket timeout was '00:00:59.5149722'.

Upvotes: 21

Views: 62776

Answers (7)

John Reilly
John Reilly

Reputation: 6269

I know this has already been answered with "turn off security". But in case anyone is interested I did manage to get WCF Transport Windows authentication using NetTcpBinding in an Intranet environment working myself after a great deal of pain.

Essentially it came down to using this configuration:

<security mode="Transport">
  <transport clientCredentialType="Windows" />
</security>

You can see a little more detail in the blog post WCF Transport Windows authentication using NetTcpBinding in an Intranet environment.

Upvotes: 4

user2871239
user2871239

Reputation: 1560

Similar to @vonbalaji, I've seen this when the account has been locked out due to having entered the password incorrectly several times.

Upvotes: 0

vonbalaji
vonbalaji

Reputation: 249

Ours is a Windows-based applicaton connecting to a WCF service within the local intranet. The security level has been set to Windows authentication. We got this error occasionally. On investigation, we found out that the Windows password had expired. After changing the password, all worked as normal...

It is a simple check if you are getting this error occasionally.

Upvotes: 2

Sagar Bhat
Sagar Bhat

Reputation: 121

The second error you got that "Socket connection was aborted" usually comes when you try to pump too much of data from your service.

I recommend user impersonation to get the credentials working right first, then think about the reminder of the issue.

You can find some useful information about impersonation in How to: Impersonate a Client on a Service.

Upvotes: 0

Anand
Anand

Reputation: 14915

It seems the client request is not authenticated on the server. You could find useful information here and here.

Upvotes: 1

spinner_den_g
spinner_den_g

Reputation: 941

I just had this same issue trying to get a server in the DMZ talking to a service inside my network. The solution that fixed it for me was to add the following to the app.config:

Note the security node.

<bindings>
  <netTcpBinding>
    <binding name="customTcpBinding" maxReceivedMessageSize="20480000" transferMode="Streamed" >
      <security mode="None"></security>
    </binding>
  </netTcpBinding>
</bindings>

Upvotes: 27

Shiraz Bhaiji
Shiraz Bhaiji

Reputation: 65391

The error is a TokenImpersonation error.

What appear to be happening is that the call comes in, some code on the server side requires that the user is impersonated by the server code.

The server code is running as the local system account, it is therefore not able to impersonate a domain user.

You have 2 basic options:

  • Run the service in the security context of a user that is allowed to impersonate another user
  • Rewrite your application such that impersonation is not required

Upvotes: 6

Related Questions