Am I in a Catch-22 situation here? My goal is to take a WCF service that I inherited, and run it on a VM and test it by calling it from my desktop PC. The VM is in a workgroup, and not in the company's domain. Basically, we need more test environments, ideally one per developer (we may have 2 to 4 people that need this). Thus the idea of the VM was that each developer could have his own web server that somewhat matches or real environment (where we actually have two websites, an external/exposed and internal). [Using VS2010 .NET 4.0]

In the internal service, each method was decorated with this attribute:

 [OperationBehavior(Impersonation = ImpersonationOption.Required)]

I'm still researching why this was needed. I think it's because a webapp calls the "internal" service, and either a) we need the credentials of the user, or b) we may doing some PrinciplePermission.Demands to see if the user is in a group. My interest is creating some ConsoleTest programs or UnitTest programs.

I changed to allowed like this:

 [OperationBehavior(Impersonation = ImpersonationOption.Allowed)]

because I was getting this error in trying to view the .svc in the browser:

The contract operation 'EditAccountFamily' requires Windows identity for automatic impersonation. A Windows identity that represents the caller is not provided by binding ('WSHttpBinding','http://tempuri.org/') for contract ('IAdminService','http://tempuri.org/'.

I don't get that error with the original bindings look like this:

However, I believe I need to turn off this security since the web service is not on the domain.

I tend to get these errors in the client:

1) The request for security token could not be satisfied because authentication failed - as an InnerException of "SecurityNegotiation was unhandled".

or

2) The caller was not authenticated by the service as an InnerException of "SecurityNegotiation was unhandled".

So can I create some configuration of code and web.config that will allow each developer to work on his own VM? Or must I join the VM to the domain?

The number of permutations seems near endless. I've started to create a Word.doc that says what to do with each error, but now I'm in the catch-22 where I'm stuck.

Thanks,

Neal

---

Server Bindings:

<bindings>
  <wsHttpBinding>
    <binding
      name="wsHttpEndpointBinding"
      maxBufferPoolSize="2147483647"
      maxReceivedMessageSize="500000000">
      <readerQuotas
        maxDepth="2147483647"
        maxStringContentLength="2147483647"
        maxArrayLength="2147483647"
        maxBytesPerRead="2147483647"
        maxNameTableCharCount="2147483647" />
      <!-- <security mode="None" />  This is one thing I tried --> 
      <security>
        <message
          clientCredentialType="Windows" />
      </security>
    </binding>
  </wsHttpBinding>
</bindings>

<behaviors>
  <serviceBehaviors>


    <behavior
      name="ABC.AdminService.AdminServiceBehavior">
      <!-- To avoid disclosing metadata information, set the value below to false and 
           remove the metadata endpoint above before deployment -->
      <serviceMetadata
        httpGetEnabled="true" />
      <!-- To receive exception details in faults for debugging purposes, set the value below to true.  
           Set to false before deployment to avoid disclosing exception information -->
      <serviceDebug
        includeExceptionDetailInFaults="true" />
      <serviceCredentials>
      </serviceCredentials>
      <!--<serviceAuthorization principalPermissionMode="UseAspNetRoles" 
            roleProviderName="AspNetWindowsTokenRoleProvider"/>-->
      <serviceAuthorization
        principalPermissionMode="UseWindowsGroups"
        impersonateCallerForAllOperations="true" />
    </behavior>


    <behavior
      name="ABC.AdminService.IAdminServiceTransportBehavior">
      <!-- To avoid disclosing metadata information, set the value below to false and 
           remove the metadata endpoint above before deployment -->
      <serviceMetadata
        httpGetEnabled="true" />
      <!-- To receive exception details in faults for debugging purposes, set the value below to true.  
           Set to false before deployment to avoid disclosing exception information -->
      <serviceDebug
        includeExceptionDetailInFaults="false" />
      <serviceCredentials>
        <clientCertificate>
          <authentication
            certificateValidationMode="PeerTrust" />
        </clientCertificate>
        <serviceCertificate
          findValue="WCfServer"
          storeLocation="LocalMachine"
          storeName="My"
          x509FindType="FindBySubjectName" />
      </serviceCredentials>
    </behavior>


  </serviceBehaviors>

</behaviors>


<serviceHostingEnvironment
  multipleSiteBindingsEnabled="true" />

CLIENT:

<system.serviceModel>
    <bindings>
        <wsHttpBinding>
            <binding name="WSHttpBinding_IAdminService" closeTimeout="00:01:00"
                openTimeout="00:01:00" receiveTimeout="00:10:00" sendTimeout="00:01:00"
                bypassProxyOnLocal="false" transactionFlow="false" hostNameComparisonMode="StrongWildcard"
                maxBufferPoolSize="524288" maxReceivedMessageSize="65536"
                messageEncoding="Text" textEncoding="utf-8" useDefaultWebProxy="true"
                allowCookies="false">
                <readerQuotas maxDepth="32" maxStringContentLength="8192" maxArrayLength="16384"
                    maxBytesPerRead="4096" maxNameTableCharCount="16384" />
                <reliableSession ordered="true" inactivityTimeout="00:10:00"
                    enabled="false" />
                <security mode="Message">
                    <transport clientCredentialType="Windows" proxyCredentialType="None"
                        realm="" />
                    <message clientCredentialType="Windows" negotiateServiceCredential="true"
                        algorithmSuite="Default" />
                </security>
            </binding>
        </wsHttpBinding>
    </bindings>
    <client>
        <endpoint address="http://192.168.159.132/EC_AdminService/AdminService.svc"
            binding="wsHttpBinding" bindingConfiguration="WSHttpBinding_IAdminService"
            contract="svcRef.IAdminService" name="WSHttpBinding_IAdminService">
            <identity>
                <dns value="localhost" />
            </identity>
        </endpoint>
    </client>
</system.serviceModel>