SL 4 and WCF DataService: InvalidOperationException -> SecurityException

Question

Hello,

you will think: "This problem has been solved many, many times. So why doesn't he use Google?" Please, believe me, I tried everything. I'm dealing with this problem since last week. I read many blogs and searched the MSDN. But I don't get it.

So here is the problem. There is one Silverlight 4 app and a WCF DataService, both are running on localhost.

This is the code. Nothing special I guess.

     private void InitializeData()
        {
            var query = (from item in ObjCtx.TestTgt
                             select item) as DataServiceQuery<TestTgt>;
            Debug.Assert(query != null, "'query' is null");

            query.BeginExecute(OnLoadDataFinished, query);
        }

        private void OnLoadDataFinished(IAsyncResult ar)
        {
            try
            {
                var query = ar.AsyncState as DataServiceQuery<TestTgt>;
                Debug.Assert(query != null, "'query' is null");

                var res = query.EndExecute(ar).ToList();
                Data.Data = new ObservableCollection<TestTgt>(res);
            }
            catch(Exception ex)
            {
                Data.StateDescription = String.Format("Exception occured.{0}{0}{1}", Environment.NewLine, AgExMsgFormatter.GetExText(ex));
            }
        }

In OnLoadData at this line: var res = query.EndExecute(ar).ToList(); the following exception occures.

Exception occured.

[EXCEPTION]
[TYPE:] 'InvalidOperationException'
[MESSAGE:] 'An error occurred while processing this request.'
[CALLSTACK:]
at System.Data.Services.Client.BaseAsyncResult.EndExecute[T](Object source, String method, IAsyncResult asyncResult)
at System.Data.Services.Client.QueryResult.EndExecute[TElement](Object source, IAsyncResult asyncResult)
at System.Data.Services.Client.DataServiceRequest.EndExecute[TElement](Object source, DataServiceContext context, IAsyncResult asyncResult)
at System.Data.Services.Client.DataServiceQuery`1.EndExecute(IAsyncResult asyncResult)
at SimpleGrid.SimpleGridVm.OnLoadDataFinished(IAsyncResult ar)

[INNEREXCEPTION]
[TYPE:] 'SecurityException'
[MESSAGE:] ''
[CALLSTACK:]
at System.Net.Browser.AsyncHelper.BeginOnUI(SendOrPostCallback beginMethod, Object state)
at System.Net.Browser.ClientHttpWebRequest.EndGetResponse(IAsyncResult asyncResult)
at System.Data.Services.Http.ClientHttpWebRequest.EndGetResponse(IAsyncResult asyncResult)
at System.Data.Services.Client.QueryResult.AsyncEndGetResponse(IAsyncResult asyncResult)

[INNEREXCEPTION]
[TYPE:] 'SecurityException'
[MESSAGE:] 'Security error.'
[CALLSTACK:]
at System.Net.Browser.ClientHttpWebRequest.InternalEndGetResponse(IAsyncResult asyncResult)
at System.Net.Browser.ClientHttpWebRequest.<>c_DisplayClass5.b_4(Object sendState)
at System.Net.Browser.AsyncHelper.<>c_DisplayClass2.b_0(Object sendState)
[/INNEREXCEPTION]
[/INNEREXCEPTION]
[/EXCEPTION]

As authentication mode I want to use Windows. Both are configured for this in IIS. The web service is running and is delivering the correct data.

So what am I missing? I thought that this should work. Any help would be appreciated.

Regards

Answer 1

Hmm, ok that's suprising but I got it. The problem is not the authentication or something like this. It's the debugger. The web service is not hosted on the web site of the Silverlight application. So the web service calls are failing.

When loading the deployed site in a browser everything works absolutly fine. For me, it appears somekind of strange, but perhaps someone can give me a good explanation for this behavior.

But this brings up another problem. How do I debug a Silverlight application, when it references an external web service. Perhaps I will open a seperate thread for this.

Regards

Answer 2

You probarly need to start Visual Studio as Administrator

Answer 3

your issue looks like a cross domain error: A silverlight app is not allowed to perform cross domain webservice calls by default. It means that if your cassini hosted SL app (domain localhost:4314 for example) attempts to access a WCF service on the domain localhost, the call will fail with a security exception.

You can easily catch the issue by using fiddler or the network tab of firebug (on firefox): The app first attempt to access a file named "clientaccesspolicy.xml" on the webservice domain root. This file defines a policy on the WCF server which authorize cross domain calls on the server.

Here is an exemple of crossdomain policy file, which allow any SL apps to access any webservices on this domain:

<?xml version="1.0" encoding="utf-8"?>
  <access-policy>
    <cross-domain-access>
      <policy>
        <allow-from http-request-headers="SOAPAction">
          <domain uri="*"/>
        </allow-from>
        <grant-to>
          <resource path="/" include-subpaths="true"/>
        </grant-to>
     </policy>
    <policy >
      <allow-from http-methods="*">
        <domain uri="*"/>
      </allow-from>
      <grant-to>
        <resource path="/" include-subpaths="true"/>
      </grant-to>
   </policy>
  </cross-domain-access>
</access-policy>

However You can be a little more specific. More information is available on MSDN: