WCF - How to configure netTcpBinding for NTLM authentication?

Question

I know how to configure basicHttpBinding for NTLM authentication, but can't figure out a way to do the same for netTcpBinding.

Does netTcpBinding support NTLM? If so, how to force WCF service to use NTLM?

BTW a well known method using identity element for some reason didn't work at all. I am looking for something like this - clientCredentialType ="Ntlm" but for tcp. Here is basicHttp setting:

<basicHttpBinding>
  <binding name="BasicHttpBinding">
  <security mode ="TransportCredentialOnly">
  <transport clientCredentialType ="Ntlm"/>
  </security>
  </binding>
</basicHttpBinding>

Answer 1

The Net TCP Binding does not support "NTLM" as a client credentials type - you have a choice of None, Windows or Certificate only (see the MSDN docs on TcpClientCredentialType).

So in your case, try this:

<netTcpBinding>
  <binding name="tcpWindows">
    <security mode ="TransportCredentialOnly">
      <transport clientCredentialType ="Windows"/>
    </security>
  </binding>
</netTcpBinding>

Any reason why this doesn't work??

Answer 2

Here is the comprehensive answer that I finally found, tested, and confirmed.

A. My WCF client used to build an EndPoint.Address dynamically as follow

EndPointAddress  myEdpintAddress = new EndPointAddress(stringURL);

But in the case of a secure transport (net.tcp) it has to be initialized as follow EndPointAddress myEdpintAddress = new EndPointAddress(new UrRL(string), myEndPointIdentity)

Without the EndPointIdentity parameters the Identity property in the EndPointAddress object is null, and generates the “...target principal name is incorrect... " error on the server side.

B. Our domain controller supports both Kerberos and Ntlm authentication. After above is done, generally there are four configuration scenarios on the client side for the net.tcp binding if security is other than “None”, and the WCF service runs as a domain account:

1. No <identity> elements in the client endpoint specified - WCF call fails

2. <identity> element provided, but with an empty value for dns, userPrioncipalName or servicePrincipalName elements - WCF call successful, but uses the Ntlm authentication

3. <identity> element provided with the a value for dsn or SPN – WCF call successfull; service uses Ntlm to authenticate.

4. <identity> element provided with the correct value for upn – WCF call successfull; service uses Kerberos for authenticate. Incorrect or missing value for upn trigger Ntlm authentication

Thanks.