expected identity upn connecting to service as network service,
- by Jim
Hi,
We have a web application, running in an application pool as 'NETWORK SERVICE'.
The web application connects to a service (.svc) on another web server. The other web server also has the service hosted as 'NETWORK SERVICE'. I believe this is the default.
The following endpoint, when run anywhere else works perfectly.
<endpoint address="http://server123/UnitTrustService/UnitTrustService.svc"
binding="wsHttpBinding" bindingConfiguration="WSHttpBinding_UnitTrustService"
contract="UnitTrustServiceReference.UnitTrustService" name="WSHttpBinding_UnitTrustService">
<identity>
<servicePrincipalName value="server123" />
</identity>
</endpoint>
Unfortunately when executed from the web site, we get the following error.
System.ServiceModel.Security.MessageSecurityException:
The identity check failed for the outgoing message.
The expected identity is 'identity(http://schemas.xmlsoap.org/ws/2005/05/identity/right/possessproperty: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/upn)'
for the 'http://server123/UnitTrustService/UnitTrustService.svc' target endpoint.
Server stack trace: at System.ServiceModel.Security.IdentityVerifier.EnsureIdentity(EndpointAddress serviceReference, AuthorizationContext authorizationContext, String errorString)...
Any ideas?
I have tried running this as local system on the web server machine with exactly the same configuration and it works perfectly.
It has something to do with IIS?
Regards
Craig.
