将Windows身份传递给WCF从ASP.NET

Question

我有一个WCF服务托管在IIS中，启用了集成的Windows身份验证并禁用了匿名身份验证。当我尝试从ASP.NET调用此服务时，出现以下MessageSecurityException：

“HTTP请求未经授权，客户端身份验证方案'Negotiate'。从服务器收到的身份验证头是'Negotiate，NTLM ']“

任何想法？

这是我的服务配置：

<system.serviceModel> 
<bindings> 
    <basicHttpBinding> 
    <binding name="CalculatorServiceBasicHttpBinding"> 
     <security mode="TransportCredentialOnly"> 
     <transport clientCredentialType="Windows" /> 
     </security> 
    </binding> 
    </basicHttpBinding> 
</bindings> 
<services> 
    <service name="Service.CalculatorService" 
      behaviorConfiguration="CalculatorServiceBehavior"> 
    <endpoint name="BasicHttpEndpoint" 
       address="" 
       binding="basicHttpBinding" 
       bindingConfiguration="CalculatorServiceBasicHttpBinding" 
       contract="Framework.ICalculatorService"> 
    </endpoint> 
    </service> 
</services> 
<behaviors> 
    <serviceBehaviors> 
    <behavior name="CalculatorServiceBehavior"> 
     <serviceMetadata httpGetEnabled="true"/> 
     <serviceDebug includeExceptionDetailInFaults="true"/> 
    </behavior> 
    </serviceBehaviors> 
</behaviors> 
<serviceHostingEnvironment multipleSiteBindingsEnabled="true" /> 
</system.serviceModel> 

这是我如何调用该服务：

var basicHttpBinding = new BasicHttpBinding(); 
basicHttpBinding.Security.Mode = BasicHttpSecurityMode.TransportCredentialOnly; 
basicHttpBinding.Security.Transport.ClientCredentialType = HttpClientCredentialType.Windows; 
var factory = new ChannelFactory<Framework.ICalculatorService>(basicHttpBinding, new EndpointAddress("http://localhost/CalculatorService/CalculatorService.svc")); 
factory.Credentials.Windows.ClientCredential = CredentialCache.DefaultNetworkCredentials; 
var proxy = factory.CreateChannel(); 
var emailAddress = proxy.GetMyEmailAddress(); 
((ICommunicationObject)proxy).Close(); 
factory.Close(); 

Answer 1

你的WCF配置适用于我，所以最有可能你没有IIS配置正确为您的WCF服务（可能还有您的ASP.NET客户端）。确保托管您的服务的IIS站点按照此TechNet article for IIS 7.中所述进行配置，开箱即用，IIS 7未启用Windows身份验证。如果您使用的是IIS 6，那么您需要搜索以查看它是如何配置用于Windows身份验证的。

为您的服务正确设置IIS后，需要配置调用服务的ASP.NET站点。默认情况下，Web站点的ASP.NET AppPool将使用本地计算机帐户（ApplicationPoolIdentity或可能的NetworkService）。您需要将该帐户更改为适当的域帐户。您还需要确保您的服务允许该域帐户通过在IIS管理器中添加授权规则或更新TechNet文章中所述的web.config文件服务来访问它。