Question

I have a Windows Service that is self hosting a Wcf service, this Wcf service has a tcpBinding with default settings. The Windows service is running as LocalSystem.

The Wcf Service is referenced (default settings) by a Web application that is running in IIS 7.5 integrated pipeline within it’s own application pool with its own identity.

Both are running on the same machine.

All is working fine, except that when in the Wcf Service when I check the identity of the current thread with:

Thread.CurrentPrincipal.Identity.Name

It returns the user of the Application Pool of the Web Application.. this is not what I expect. It looks like some sort of impersonation is going on in the Wcf service.

Is this standard behavior? I can’t find any documentation on this.
And does it mean that when I try to access a database in the Wcf service i’m introducing a identity hop?

Edit, the config on service side:

        Type serviceType = typeof(WcfService);
        host = new ServiceHost(serviceType);

        Binding tcpBinding = new NetTcpBinding( );

        Uri tcpBaseAddress = new Uri("net.tcp://localhost:8001/Test");
        host.AddServiceEndpoint(typeof (WcfService), tcpBinding, tcpBaseAddress);

        host.Open();

On the client side:

            NetTcpBinding tcpBinding = new NetTcpBinding(SecurityMode.Transport);
        windowsService = new WindowsService.WcfServiceClient(tcpBinding, new EndpointAddress("net.tcp://localhost:8001/Test"));

Answer 1

To clearify:

I was checking the wrong property here. Because code would be executed under the WindowsIdentity.GetCurrent() identity.

By default this is NOT the same as the caller (which is in Thread.CurrentPrincipal.Identity). If you want this behaviour you can control this with:

host.Authorization.ImpersonateCallerForAllOperations = true;

and

[OperationBehavior(Impersonation = ImpersonationOption.Required)]