WCF TCP Windows 身份验证问题

Question

我有两台机器。

• 机器A
• 机器 B

机器 B 上的客户端成功连接到机器 A 上的主机。

机器 B 上的客户端成功连接到机器 B 上的主机。

机器 A 上的客户端成功连接到机器 B 上的主机。

机器 A 上的客户端无法连接到机器 A 上的主机。 - System.ServiceModel.Security.SecurityNegotiationException: 服务器拒绝了客户端凭据。

我正在使用 Windows 身份验证。

客户：

        var netTcpBinding = new NetTcpBinding()
        {
            Security = new NetTcpSecurity()
            {
                Mode = SecurityMode.Transport,
                Transport = new TcpTransportSecurity()
                {
                    ClientCredentialType = TcpClientCredentialType.Windows,
                }
            },
            TransferMode = TransferMode.Streamed,
            MaxReceivedMessageSize = long.MaxValue,
            MaxBufferSize = int.MaxValue,
            MaxBufferPoolSize = long.MaxValue,
            ReaderQuotas = new System.Xml.XmlDictionaryReaderQuotas()
            {
                MaxDepth = int.MaxValue,
                MaxArrayLength = int.MaxValue,
                MaxStringContentLength = int.MaxValue
            },
            SendTimeout = TimeSpan.MaxValue,
            ReceiveTimeout = TimeSpan.MaxValue
        };

        string endpointAddress;
        if (port == 0)
            endpointAddress = string.Format("net.tcp://{0}/Configuration", host);
        else
            endpointAddress = string.Format("net.tcp://{0}:{1}/Configuration", host, port);

        Console.WriteLine("Endpoint: {0}", endpointAddress);

        var factory = new ChannelFactory<IMyChannel>(netTcpBinding);
        factory.Endpoint.Address = new EndpointAddress(new Uri(endpointAddress), new DnsEndpointIdentity("MyDns"));

        //Do not verify
        factory.Credentials.ServiceCertificate.Authentication.CertificateValidationMode = System.ServiceModel.Security.X509CertificateValidationMode.None;

        factory.Credentials.Windows.ClientCredential.Domain = domain;
        factory.Credentials.Windows.ClientCredential.UserName = username;
        factory.Credentials.Windows.ClientCredential.Password = password;

        //Console.WriteLine("Opening Channel Factory ... ");
        factory.Open();

主持人：

    #region INIT

    //Set configuration file just once
    if (ChannelServices.RegisteredChannels.Length == 0)
    {
        RemotingConfiguration.Configure(AppDomain.CurrentDomain.SetupInformation.ConfigurationFile, false);
    }

    _serviceHost = null;
    _serviceHost = new ServiceHost(typeof(MyChannel));
    _serviceHost.AddDefaultEndpoints();

    // build list with local IP addresses to bind to
    var localIpAddresses = new List<IPAddress>(Dns.GetHostAddresses(Dns.GetHostName()));
    if (IPAddress.Loopback != null)
        localIpAddresses.Add(IPAddress.Loopback);
    localIpAddresses.RemoveAll(i => i.AddressFamily != AddressFamily.InterNetwork);

    // enable metadata exchange bahaviour
    // add metadatabehaviour in case HTTP is not enabled
    var metadataBehaviour = _serviceHost.Description.Behaviors.Find<ServiceMetadataBehavior>();
    if (metadataBehaviour == null)
    {
        metadataBehaviour = new ServiceMetadataBehavior();
        _serviceHost.Description.Behaviors.Add(metadataBehaviour);
    }

    var credentialsBehaviour = _serviceHost.Description.Behaviors.Find<ServiceCredentials>();
    if (credentialsBehaviour == null)
    {
        credentialsBehaviour = new ServiceCredentials();
        _serviceHost.Description.Behaviors.Add(credentialsBehaviour);
    }

    var serviceDebug = _serviceHost.Description.Behaviors.Find<ServiceDebugBehavior>();
    if (serviceDebug == null)
    {
        serviceDebug = new ServiceDebugBehavior();
        _serviceHost.Description.Behaviors.Add(serviceDebug);
    }
    serviceDebug.IncludeExceptionDetailInFaults = true;

    var tcpPort = "9096";

    _log.Info("tcpPort - {0}", tcpPort);

    var netTcpBinding = new NetTcpBinding()
    {
        Security = new NetTcpSecurity()
        {
            Mode = SecurityMode.Transport,
            Transport = new TcpTransportSecurity()
            {
                ClientCredentialType = TcpClientCredentialType.Windows,
            }
        },
        TransferMode = TransferMode.Streamed,
        MaxReceivedMessageSize = long.MaxValue,
        MaxBufferSize = int.MaxValue,
        MaxBufferPoolSize = long.MaxValue,
        ReaderQuotas = new System.Xml.XmlDictionaryReaderQuotas()
        {
            MaxDepth = int.MaxValue,
            MaxArrayLength = int.MaxValue,
            MaxStringContentLength = int.MaxValue
        },
        SendTimeout = TimeSpan.MaxValue,
        ReceiveTimeout = TimeSpan.MaxValue
    };

    var endpoint = _serviceHost.AddServiceEndpoint(
        typeof(IMyChannel),
        netTcpBinding,
        new Uri(string.Format("net.tcp://0:{0}/Configuration", tcpPort)));

    ServiceSecurityAuditBehavior newAudit = new ServiceSecurityAuditBehavior();
    newAudit.AuditLogLocation = AuditLogLocation.Application;
    newAudit.MessageAuthenticationAuditLevel = AuditLevel.SuccessOrFailure;
    newAudit.ServiceAuthorizationAuditLevel = AuditLevel.SuccessOrFailure;
    newAudit.SuppressAuditFailure = false;

    _serviceHost.AddServiceEndpoint(ServiceMetadataBehavior.MexContractName,
        MetadataExchangeBindings.CreateMexTcpBinding(),
        string.Format("net.tcp://localhost:{0}/Configuration/mex", tcpPort));

    _serviceHost.Description.Behaviors.Remove<ServiceSecurityAuditBehavior>();
    _serviceHost.Description.Behaviors.Add(newAudit);

    _serviceHost.Opening += (sender, eventArgs) => _log.Info("Opening Connection ...");
    _serviceHost.Opened += (sender, eventArgs) => _log.Info("Opened Connection ...");

    _serviceHost.Closing += (sender, eventArgs) => _log.Info("Closing connection ...");
    _serviceHost.Closed += (sender, eventArgs) => _log.Info("Closed connection ...");

    _serviceHost.Faulted += (sender, eventArgs) => _log.Error("Fault detected on WCF host");

    _serviceHost.Open();
    #endregion

这是我的完整堆栈跟踪：

System.ServiceModel.Security.SecurityNegotiationException：服务器 已拒绝客户端凭据。 ---> System.Security.Authentication.InvalidCredential 异常：服务器 已拒绝客户端凭据。 ---> 系统.组件 Model.Win32Exception: 登录尝试失败 --- End of inner 异常堆栈跟踪 --- 在 System.Net.Security.NegoState.ProcessReceivedBlob（字节 [] 消息， LazyAsyn cResultlazyResult) 在 System.Net.Security.NegoState.StartSendBlob（字节 [] 消息， LazyAsyncResult tlazyResult) 在 System.Net.Security.NegoState.CheckCompletionBeforeNextSend（字节[] 消息，LazyAsyncResultlazyResult) 在 System.Net.Security.NegoState.ProcessReceivedBlob（字节 [] 消息， LazyAsyn cResultlazyResult) 在 System.Net.Security.NegoState.StartSendBlob（字节 [] 消息， LazyAsyncResult tlazyResult) 在 System.Net.Security.NegoState.ProcessAuthentication（LazyAsyncResult 懒惰结果）在 System.Net.Security.NegotiateStream.AuthenticateAsClient(NetworkCredential 凭据、字符串目标名称、保护级别 requiredProtectionLevel, TokenImpersonationLevel allowedImpersonationLevel) 在 System.ServiceModel.Channels.WindowsStreamSecurityUpgradeProvider.WindowsS treamSecurityUpgradeInitiator.OnInitiateUpgrade（流流， SecurityMessagePro operty&remoteSecurity) --- 内部结束 异常堆栈跟踪---

服务器堆栈跟踪：在 System.ServiceModel.Channels.WindowsStreamSecurityUpgradeProvider.WindowsS treamSecurityUpgradeInitiator.OnInitiateUpgrade（流流， SecurityMessagePro 操作和远程安全）在 System.ServiceModel.Channels.StreamSecurityUpgradeInitiatorBase.InitiateUp 等级（流）在 System.ServiceModel.Channels.ConnectionUpgradeHelper.InitiateUpgrade（Strea mUpgradeInitiator upgradeInitiator，IConnection&连接， ClientFramingDecode r 解码器，IDefaultCommunicationTimeouts defaultTimeouts, TimeoutHelper & timeout Helper) 在 System.ServiceModel.Channels.StreamedFramingRequestChannel.SendPreamble（IC onnection 连接，TimeoutHelper& timeoutHelper， ClientFramingDecoder 解码器，SecurityMessageProperty& 远程安全）在 System.ServiceModel.Channels.StreamedFramingRequestChannel.StreamedConnect ionPoolHelper.AcceptPooledConnection(IConnection 连接， TimeoutHelper&timeoutHelper) 在 System.ServiceModel.Channels.ConnectionPoolHelper.EstablishConnection（时间 跨度超时）在 System.ServiceModel.Channels.StreamedFramingRequestChannel.StreamedFraming Request.SendRequest（消息消息，TimeSpan 超时）在 System.ServiceModel.Channels.RequestChannel.Request（消息消息， TimeS 平移超时）在 System.ServiceModel.Channels.ServiceChannel.Call（字符串动作， eway 上的布尔值，ProxyOperationRuntime 操作，Object[] ins， Object[] 出局，TimeSpan 出局）在 System.ServiceModel.Channels.ServiceChannelProxy.InvokeService（IMethodCall 消息方法调用，ProxyOperationRuntime 操作）在 System.ServiceModel.Channels.ServiceChannelProxy.Invoke（IMessage 留言）

在 [0] 处重新抛出异常：在 System.Runtime.Remoting.Proxies.RealProxy.HandleReturnMessage（IMessage req Msg, IMessage retMsg) 在 System.Runtime.Remoting.Proxies.RealProxy.PrivateInvoke（消息数据& msgData，Int32 类型）在 MyProject.TestConnection() 在 d:\Source\MyProject\Program.cs:line 中的 MyProject.Program.ManualInput() 84

这没有任何意义。

任何帮助将不胜感激！

谢谢！

K

Answer 1

解决了！

这个问题是 Windows 身份验证不需要 DnsEndpointIdentity :)