Question

I have 2 WCF services, (A and B), where A calls B.

WCF Service A runs using identity ServiceUserA (as set in application pool).
WCF Service B runs using identity ServiceUserB (as set in application pool).

WCF Service B needs to allow access to users in AD group ServiceBAccessGroup.
ServiceUserA is part of ServiceBAccessGroup.

When Service A tries to connect to Service B, it gives this error:

SecurityNegotiationException A call to SSPI failed, see inner exception:
“The target principal name is incorrect”

When both ServiceA and Service B were running as Network Service, this worked fine.

How do I allow users part of ServiceBAccessGroup to connect to ServiceB?

Edit: More info regarding environment:

.net 3.5, IIS 7.0 (WAS), through netTcpBinding, Windows Server 2008.

Edit (2): Yep, thx for asking Tuzo. Here is the client endpoint connection:

  <client>
      <endpoint address="net.tcp://MyServerName:812/v1_0/ServiceB.svc/ServiceB" binding="netTcpBinding" contract="IServiceB" name="ServiceBEndpoint" >
</endpoint>
 </client>

Edit (3):

Thanks for your help, it has pointed me closer to the direction of my goal.

I believe my issue is to do with Authorisation than Authentication. I do not want to authenticate as the ServiceUserB because that would defeat the purpose of our security model.

Using the following did work:

<identity>
  <serviceProviderName value="ServiceB/MyServerName:812" />
</identity>

I will give you the correct answer as it was indeed correct and helped me get to my destination.

Thanks again!

Answer 1

Try adding an identity element to your ServiceA configuration:

<client>
  <endpoint address="net.tcp://MyServerName:812/v1_0/ServiceB.svc/ServiceB" binding="netTcpBinding" contract="IServiceB" name="ServiceBEndpoint" >
      <identity>
          <userPrincipalName value="user@domain" />
      </identity>
  </endpoint>
</client>