I have 2 wcf services both hosted on IIS on the same machine.
Service A is called by a client and uses BasicHttpBinding
with transport security and NTLM credentialtype
.
Service A needs to call service B which is also hosted on IIS but uses WsHttpBinding
with transport security and NTLM credentialtype
.
IIS is configured to use integrated windows authentication.
The first attempt I got a 403 forbidden message:
System.ServiceModel.Security.MessageSecurityException : The HTTP request was forbidden with client authentication scheme 'Ntlm'.
System.Net.WebException: The remote server returned an error: (403) Forbidden.
This is normal because when I make a call from service A to service B the identity of the application pool is used.
In my second attempt I tried to impersonate the call to service B but then the problem is all code in the operation is executed under the callers account. This account has no ACL permissions on the server and providing these permissions is not an option. The following error is logged:
System.IO.FileLoadException : Could not load file or assembly 'System.Core, Version=3.5.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089' or one of its dependencies. The handle is invalid. (Exception from HRESULT: 0x80070006 (E_HANDLE))
How could I solve this without changing security the ACL's or the application pool identity?
Check this out: http://blogs.msdn.com/b/securitytools/archive/2009/11/04/double-hop-windows-authentication-with-iis-hosted-wcf-service.aspx. Found the above link here: http://go4answers.webhost4life.com/Example/calling-wcf-service-another-wcf-service-204170.aspx
User contributions licensed under CC BY-SA 3.0