WCF windows credentials

Question

Hi there,
my client on server A calls a service on B which calls a service on C.
In order to get the call working from B->C I have to do this:

channel.Credentials.Windows.ClientCredential = 
   new System.Net.NetworkCredential("WndowsUserName", "WindowsPassWord");  
IService1 service = channel.CreateChannel();

etc...

the user name and password are the windows credentials used from A->B Of course I do not want to hardcode this so how can I do this without hardcoding?

I tried, with no luck:

WindowsIdentity callerWindowsIdentity = 
    ServiceSecurityContext.Current.WindowsIdentity;  
using (callerWindowsIdentity.Impersonate())

Answer 1

Perhaps the class

System.Net.CredentialCache

could be helpfull ... It has the DefaultCredentials and DefaultNetworkCredentials properties that you can use. Offcourse, you will have to make sure that your application runs under the credentials that you want (that is , the credentials of the current user). This can be done by calling

AppDomain.CurrentDomain.SetPrincipalPolicy (PrincipalPolicy.WindowsPrincipal);

At the start of your program.

Then, when you initialize the WCF service, you can use the DefaultNetworkCredentials provided by the CredentialCache.

channel.Credentials.Windows.ClientCredential = CredentialCache.DefaultNetworkCredentials;
IService1 service = channel.CreateChannel();

Answer 2

Use

System.Net.CredentialCache.DefaultNetworkCredentials

property. It represents the authentication credentials for the current security context in which the application is running. Details can be found here.

Answer 3

It seems to be a "double hop" authentication problem. In short, NTLM doesn't alllow more than one "hop" with it's credentials (token). So user authenticates on server 1 with it's token, and in turn, server 1 tries to send the token to server 2. This won't work, unless Kerberos deleguation is allowed between server 1 and 2.

More details here : http://weblogs.asp.net/owscott/archive/2008/08/22/iis-windows-authentication-and-the-double-hop-issue.aspx And here : http://blogs.msdn.com/nunos/archive/2004/03/12/88468.aspx