The remote server did not satisfy the mutual authentication requirement  
Author Message
Bobby2006





PostPosted: Windows Communication Foundation ("Indigo"), The remote server did not satisfy the mutual authentication requirement Top

I am trying to write a Client/Server program which needs mutual authentication between the server and client via Kerbros.

Therefore I did the following:

On Server side:
Config file:

< xml version="1.0" encoding="utf-8" >
<configuration>
<system.serviceModel>
<services>
<service name="Com.Service" behaviorConfiguration="ServiceBehaviorConfig">
<host>
<baseAddresses>
<add baseAddress="net.tcp://tako:8020/Com/"/>
</baseAddresses>
</host>
<endpoint address=""
binding="netTcpBinding"
bindingConfiguration="MyNetTCPBinding"
contract="Com.IService">
</endpoint>
<endpoint address="mex"
binding="mexTcpBinding"
contract="IMetadataExchange">
</endpoint>
</service>
</services>
<behaviors>
<serviceBehaviors>
<behavior name="ServiceBehaviorConfig">
<serviceMetadata/>
<serviceDebug includeExceptionDetailInFaults="false"/>
</behavior>
</serviceBehaviors>
</behaviors>
<bindings>
<netTcpBinding>
<binding name="MyNetTCPBinding">
<security mode ="Transport">
<transport clientCredentialType="Windows" protectionLevel="EncryptAndSign"/>
</security>
</binding>
</netTcpBinding>
</bindings>
</system.serviceModel>
</configuration>

On Client side
Config file:

< xml version="1.0" encoding="utf-8" >
<configuration>
<system.serviceModel>
<bindings>
<netTcpBinding>
<binding name="NetTcpBinding_IService" closeTimeout="00:01:00"
openTimeout="00:01:00" receiveTimeout="00:10:00" sendTimeout="00:01:00"
transactionFlow="false" transferMode="Buffered" transactionProtocol="OleTransactions"
hostNameComparisonMode="StrongWildcard" listenBacklog="10"
maxBufferPoolSize="524288" maxBufferSize="65536" maxConnections="10"
maxReceivedMessageSize="65536">
<readerQuotas maxDepth="32" maxStringContentLength="8192" maxArrayLength="16384"
maxBytesPerRead="4096" maxNameTableCharCount="16384" />
<reliableSession ordered="true" inactivityTimeout="00:10:00"
enabled="false" />
<security mode="Transport">
<transport clientCredentialType="Windows" protectionLevel="EncryptAndSign" />
<message clientCredentialType="Windows" />
</security>
</binding>
</netTcpBinding>
</bindings>
<client>
<endpoint address="net.tcp://tako:8020/Com/" binding="netTcpBinding"
bindingConfiguration="NetTcpBinding_IService" contract="IService"
name="NetTcpBinding_IService">
<identity>
<userPrincipalName value="EMail@HideDomain.com" />
</identity>
</endpoint>
</client>
</system.serviceModel>
</configuration>

set the following to disable fallback to Ntlm
service.ClientCredentials.Windows.AllowNtlm = false;

But when I run the server and client, as soon as the client try to call any method in the server object, I receive the following error:

System.ServiceModel.Security.SecurityNegotiationException: The remote server did not satisfy the mutual authentication requirement

I am running both the client and server on the same machine and I am sure my user principal name is correct as as my machine is in AD, Kerbros should be enabled, what else can I check or have I missed out What else may have caused this

Many thanks,

Bobby



Visual Studio 200837  
 
 
Todd West





PostPosted: Windows Communication Foundation ("Indigo"), The remote server did not satisfy the mutual authentication requirement Top

This error means SSPI wasn't able to use Kerberos and is falling back to NTLM. My initial guess would be the client isn't running as a domain user and so user to user Kerberos authentication isn't possible (I'm assuming the service is in a domain user account based on form of the UPN given above); if that's not it, can you provide more details about the OS and client and server accounts


 
 
Bobby2006





PostPosted: Windows Communication Foundation ("Indigo"), The remote server did not satisfy the mutual authentication requirement Top

Thanks for the reply.

I am running both client and server on the same machine using my domain account and I think Kerberos is enabled in my network.

Yes, the service is running under my domain account so I specify a user principal name for the client to authenticate my service.


 
 
Todd West





PostPosted: Windows Communication Foundation ("Indigo"), The remote server did not satisfy the mutual authentication requirement Top

If you've a Windows domain with a Windows 2000 or 2003 DC the domain supports user to user Kerberos. Barring a Windows NT DC (U2U is, I believe, a Windows 2000 feature), it's most likely the UPN identity specified on the client is incorrect. It looks like you started with some client config from svcutil so the client config should contain the correct UPN. But it wouldn't hurt to turn on http metadata and take a look at the service WSDL in a browser to see what UPN the service thinks it has.