The server has rejected the client credentials

Question

I have a WCF service with net.tcp binding, hosted on the server as a Windows service. I am not able to access this service. However I was able to do so, when I hosted it on my local network.

Error Recieved

Message:** The server has rejected the client credentials.

Inner Exception:

System.Security.Authentication.InvalidCredentialException:
The server has rejected the client credentials.
---> System.ComponentModel.Win32Exception:
The logon attempt failed --- End of inner exception stack trace
--- at System.Net.Security.NegoState.ProcessAuthentication(LazyAsyncResult lazyResult)
at System.Net.Security.NegotiateStream.AuthenticateAsClient(NetworkCredential credential, ChannelBinding binding, String targetName, ProtectionLevel requiredProtectionLevel, TokenImpersonationLevel allowedImpersonationLevel)
at System.Net.Security.NegotiateStream.AuthenticateAsClient(NetworkCredential credential, String targetName, ProtectionLevel requiredProtectionLevel, TokenImpersonationLevel allowedImpersonationLevel)
at System.ServiceModel.Channels.WindowsStreamSecurityUpgradeProvider.WindowsStreamSecurityUpgradeInitiator.OnInitiateUpgrade(Stream stream, SecurityMessageProperty& remoteSecurity)

Tried searching for the solution, but found none that fits my requirements, hence posted here.

What could be the problem?

If I make my security mode to None on the client

<security mode="None"></security>

I get another error:

Error: The socket connection was aborted. This could be caused by an error processing your message or a receive timeout being exceeded by the remote host, or an underlying network resource issue. Local socket timeout was '00:00:59.5149722'.

Answer 1

I just had this same issue trying to get a server in the DMZ talking to a service inside my network. The solution that fixed it for me was to add the following to the app.config:

Note the security node.

<bindings>   <netTcpBinding>     <binding name="customTcpBinding" maxReceivedMessageSize="20480000" transferMode="Streamed" >       <security mode="None"></security>     </binding>   </netTcpBinding> </bindings> 

Answer 2

The error is a TokenImpersonation error.

What appear to be happening is that the call comes in, some code on the server side requires that the user is impersonated by the server code.

The server code is running as the local system account, it is therefore not able to impersonate a domain user.

You have 2 basic options:

• Run the service in the security context of a user that is allowed to impersonate another user
• Rewrite your application such that impersonation is not required

Answer 3

I know this has already been answered with "turn off security". But in case anyone is interested I did manage to get WCF Transport Windows authentication using NetTcpBinding in an Intranet environment working myself after a great deal of pain.

Essentially it came down to using this configuration:

<security mode="Transport">
  <transport clientCredentialType="Windows" />
</security>

You can see a little more detail in the blog post WCF Transport Windows authentication using NetTcpBinding in an Intranet environment.

Answer 4

Ours is a Windows-based applicaton connecting to a WCF service within the local intranet. The security level has been set to Windows authentication. We got this error occasionally. On investigation, we found out that the Windows password had expired. After changing the password, all worked as normal...

It is a simple check if you are getting this error occasionally.