I have a windows service that hosts a WCF service, and a webservice on a different machine acting as a client. I have the nettcpbinding set to Transport security using Windows authentication. Am I correct to assume that the windows user the webservice is running under must have permission to access the WCF service on the other machine? If the webservice is running under NetworkService, is it possible to use it or do i need to setup a new user for it to use?
+1
A:
See http://msdn.microsoft.com/en-us/library/ms684272(VS.85).aspx for good info on networkservice. What will happen is that your WCF client will attempt to authenticate as domain\computername$ to the machine hosting the service. I personally prefer to have a specific identity for auditing purposes.
JohnW
2009-03-20 23:58:54
It's better to run as network service because it doesn't require maintaining passwords on the network. Machine account passwords change every 30 days, network account passwords tend to expire under domain policies and need to be manually changed.
Jesse Weigert
2009-03-21 02:19:54
+2
A:
Yes, you'll need to setup another user. Network service is a local user and will not exist on the WCF hosting machine. (Well it does, but it's got a different password and so is not shared)
You have a couple of choices - if both machines are in the domain you can run the web application pool as a domain user, or if you're in a workgroup you can create the same username/password combination on both machines and configure the web site to run under that account. In either case you need to assign the right privileges to the new account by issuing
aspnet_regiis -ga MachineName\AccountName
If you are in a domain and kerberos authentication then you will also need to setup an SPN for the new user account
setspn -A HTTP/webservername domain\customAccountName
setspn -A HTTP/webservername.fullyqualifieddomainname domain\customAccountName
blowdart
2009-03-21 00:15:29