(401) Error no autorizado: seguridad/enlace WCF

Question

Tengo un servicio web WCF y un cliente ambos en la misma máquina. Acceder al servicio web de WCF directamente usando el navegador funciona, pero el cliente no se puede conectar; mensaje de error a continuación. ¿Algunas ideas? La autenticación integrada de Windows en IIS se usa tanto para el cliente como para el servidor.

The remote server returned an error: (401) Unauthorized. 
Description: An unhandled exception occurred during the execution of the current web request. Please review the stack trace for more information about the error and where it originated in the code. 

Exception Details: System.Net.WebException: The remote server returned an error: (401) Unauthorized. 

Source Error: 

An unhandled exception was generated during the execution of the current web request. Information regarding the origin and location of the exception can be identified using the exception stack trace below. 

Stack Trace: 

[WebException: The remote server returned an error: (401) Unauthorized.] 
    System.Net.HttpWebRequest.GetResponse() +5313085 
    System.ServiceModel.Channels.HttpChannelRequest.WaitForReply(TimeSpan timeout) +54 

[MessageSecurityException: The HTTP request is unauthorized with client authentication scheme 'Negotiate'. The authentication header received from the server was 'Negotiate,NTLM'.] 
    System.Runtime.Remoting.Proxies.RealProxy.HandleReturnMessage(IMessage reqMsg, IMessage retMsg) +7594687 
    System.Runtime.Remoting.Proxies.RealProxy.PrivateInvoke(MessageData& msgData, Int32 type) +275 
    HRPaysService.IService1.GetAlert() +0 
    HRPaysService.Service1Client.GetAlert() +15 
    _Default.Page_Load(Object sender, EventArgs e) +138 
    System.Web.Util.CalliHelper.EventArgFunctionCaller(IntPtr fp, Object o, Object t, EventArgs e) +14 
    System.Web.Util.CalliEventHandlerDelegateProxy.Callback(Object sender, EventArgs e) +35 
    System.Web.UI.Control.OnLoad(EventArgs e) +99 
    System.Web.UI.Control.LoadRecursive() +50 
    System.Web.UI.Page.ProcessRequestMain(Boolean includeStagesBeforeAsyncPoint, Boolean includeStagesAfterAsyncPoint) +627 

Cliente:

<system.serviceModel> 
    <bindings> 
     <basicHttpBinding> 
      <binding name="basicBinding"> 
       <security mode="TransportCredentialOnly"> 
        <transport clientCredentialType="Windows" 
          proxyCredentialType="Windows" realm="" /> 
        <message clientCredentialType="UserName" 
          algorithmSuite="Default" /> 
       </security> 
      </binding> 
     </basicHttpBinding> 
    </bindings> 
    <client> 
     <endpoint 
      address="http://hrpaysservice/service1.svc" 
      binding="basicHttpBinding" 
      bindingConfiguration="basicBinding" 
      contract="HRPaysService.IService1"> 
     </endpoint> 
    </client> 
    </system.serviceModel> 

Servidor:

<system.serviceModel> 
    <bindings> 
     <basicHttpBinding> 
     <binding name="basicBinding"> 
      <security mode="TransportCredentialOnly"> 
       <transport clientCredentialType="Windows" 
          proxyCredentialType="Windows" realm="" /> 
       <message clientCredentialType="UserName" 
         algorithmSuite="Default" /> 
      </security> 
     </binding> 
     </basicHttpBinding> 
    </bindings> 
    <client> 
     <endpoint 
      address="http://hrpaysservice/service1.svc" 
      binding="basicHttpBinding" 
      bindingConfiguration="basicBinding" 
      contract="HRPaysService.IService1"> 
     </endpoint> 
</client> 
</system.serviceModel> 

Answer 1

Cliente:

<system.serviceModel> 
    <bindings> 
     <wsHttpBinding> 
       <binding name="WSHttpBinding_IService1" closeTimeout="00:01:00" 
        openTimeout="00:01:00" receiveTimeout="00:10:00" sendTimeout="00:01:00" 
        bypassProxyOnLocal="false" transactionFlow="false" hostNameComparisonMode="StrongWildcard" 
        maxBufferPoolSize="524288" maxReceivedMessageSize="65536" messageEncoding="Text" 
        textEncoding="utf-8" useDefaultWebProxy="true" allowCookies="false"> 
         <readerQuotas maxDepth="32" maxStringContentLength="8192" maxArrayLength="16384" 
         maxBytesPerRead="4096" maxNameTableCharCount="16384" /> 
         <reliableSession ordered="true" inactivityTimeout="00:10:00" 
         enabled="false" /> 
        <security mode="Message"> 
         <transport clientCredentialType="Windows" proxyCredentialType="None" 
         realm="" /> 
         <message clientCredentialType="Windows" negotiateServiceCredential="true" 
         algorithmSuite="Default" establishSecurityContext="true" /> 
        </security> 
       </binding> 
     </wsHttpBinding> 
    </bindings> 
    <client> 
     <endpoint address="http://localhost:3097/Service1.svc" binding="wsHttpBinding" 
      bindingConfiguration="WSHttpBinding_IService1" contract="HRPaysService.IService1" 
      name="WSHttpBinding_IService1"> 
       <identity> 
        <dns value="localhost" /> 
       </identity> 
     </endpoint> 
    </client> 
</system.serviceModel> 

Servidor:

<system.serviceModel> 
     <bindings> 
     <basicHttpBinding> 
        <binding name="basicBinding"> 
        <security mode="TransportCredentialOnly"> 
          <transport clientCredentialType="Windows"/> 
        </security> 
       </binding> 
      </basicHttpBinding> 
     </bindings> 
    <services> 
      <service behaviorConfiguration="basicBehavior" name="WcfService1.Service1"> 
       <endpoint address="" binding="basicHttpBinding" contract="WcfService1.IService1" bindingConfiguration="basicBinding" /> 
       <endpoint address="mex" binding="basicHttpBinding" contract="IMetadataExchange" bindingConfiguration="basicBinding" /> 
     </service> 
    </services> 
    <behaviors> 
      <serviceBehaviors> 
       <behavior name="basicBehavior"> 
        <serviceMetadata httpGetEnabled="true" /> 
       </behavior> 
      </serviceBehaviors> 
     </behaviors> 
</system.serviceModel> 

Answer 2

¿Tiene un documento crossdomain.xml establecido en su aplicación web servicios? Si no es así, crear uno con el siguiente contenido -

<?xml version="1.0"?> 
<!DOCTYPE cross-domain-policy SYSTEM "http://www.macromedia.com/xml/dtds/cross-domain-policy.dtd"> 
<cross-domain-policy> 
    <allow-http-request-headers-from domain="*" headers="*"/> 
</cross-domain-policy> 

Answer 3

Si el directorio virtual de servicios WCF no está configurado para acceso anónimo, entonces el punto final "mex" debe ser eliminado.

Has publicado 2 conjuntos diferentes de configuraciones y parece que no coinciden. ¿Podría publicar las configuraciones que están causando el error?

Su primera (la mayoría) configuración del cliente y la última configuración del servidor (sin la parte mex) debería funcionar.

Answer 4

Encontré el mismo error cuando intenté acceder a un servicio WCF alojado en IIS agregando un "Service Reference" a mi aplicación Windows Forms. Pero cuando el cliente pulsó una llamada para obtener un método de servicio, obtuve la "excepción 401 no autorizada". Aquí está mi solución a este problema:

(1) que estaba usando [wsHttpBinding] cambiarlo a ser [basicHttpBinding] como sigue en el archivo de servicio WCF config:

<system.serviceModel> 
     <bindings> 
      <basicHttpBinding> 
       <binding name="BasicHttpEndpointBinding"> 
        <security mode="TransportCredentialOnly"> 
         <transport clientCredentialType="Windows" /> 
        </security> 
       </binding> 
      </basicHttpBinding> 
     </bindings> 
     <services> 
     <service behaviorConfiguration="ServiceBehavior" name="IService1"> 
      <endpoint address="" binding="basicHttpBinding" 
      bindingConfiguration="BasicHttpEndpointBinding" 
      name="BasicHttpEndpoint" contract="IService1"> 
       <identity> 
        <dns value="localhost" /> 
       </identity> 
      </endpoint> 
      <endpoint address="mex" binding="mexHttpBinding" 
       contract="IMetadataExchange" /> 
     </service> 
    </services> 
    <serviceHostingEnvironment aspNetCompatibilityEnabled="true" 
    multipleSiteBindingsEnabled="true" /> 

(2) Agregue una "Referencia de servicio" desde su aplicación cliente y asígnele un nombre (usaremos ese nombre en el siguiente paso como "ProxyCalssName")

(3) ajustamos el archivo app.config de la aplicación cliente como sigue:

<system.serviceModel> 
    <client> 
     <endpoint address="your service URL" 
      binding="basicHttpBinding" bindingConfiguration="basic" contract="ProxyClassName.ServiceName" 
      name="default" /> 
    </client> 
    <bindings> 
     <basicHttpBinding> 
      <binding name="basic"> 
       <security mode="TransportCredentialOnly"> 
        <transport clientCredentialType="Windows" proxyCredentialType="None" 
         realm="" /> 
        <message clientCredentialType="UserName" algorithmSuite="Default" /> 
       </security> 
      </binding> 
     </basicHttpBinding> 
    </bindings> 
</system.serviceModel> 

(4) En el código detrás de la aplicación cliente:

 ProxyClassName.MyServiceName srv = new ProxyClassName.MyServiceName("default"); 
//default is the name of the endpoint in the app.config file as we did. 
    srv.ClientCredentials.Windows.AllowedImpersonationLevel = System.Security.Principal.TokenImpersonationLevel.Impersonation; 

buena suerte, DigitalFox