title: WCF settings with client credentials beyond config
body: <p>So I have a WCF service with netTcp binding</p>
  
  <pre><code>&lt;netTcpBinding&gt;
      &lt;binding name="VpNetTcpBinding" portSharingEnabled="true"  closeTimeout="00:02:00" openTimeout="00:02:00"
               receiveTimeout="00:22:00" sendTimeout="00:24:00" maxReceivedMessageSize="131072" &gt;
        &lt;reliableSession enabled="false" inactivityTimeout="00:50:00"/&gt;
        &lt;security mode="Transport"  &gt;
          &lt;transport clientCredentialType="Windows" /&gt;
        &lt;/security&gt;
      &lt;/binding&gt;
    &lt;/netTcpBinding&gt;
  </code></pre>
  
  <p>and a WPF client that connects to said service </p>
  
  <pre><code>&lt;security mode="Transport"&gt;
          &lt;transport clientCredentialType="Windows" protectionLevel="EncryptAndSign" /&gt;
          &lt;message clientCredentialType="Windows" /&gt;
        &lt;/security&gt;
  </code></pre>
  
  <p>I've used these setting in two different DEV enviroments. In one I had to connect to the service through a VPN connection with credentials so I had to impersonate these credentials (because they tried to pass the local credentials from another domain) the service wouldn't accept.</p>
  
  <pre><code>client.ClientCredentials.Windows.ClientCredential = new System.Net.NetworkCredential("name", "password", "domain.local");
  </code></pre>
  
  <p>This was only neccesary for me, the devoloper because others where on the same domain as the service.</p>
  
  <p>Now when I setup the same way on another location I always get this error</p>
  
  <pre><code>System.Security.Authentication.InvalidCredentialException: The server has rejected the client credentials. ---&gt; System.ComponentModel.Win32Exception: The logon attempt failed
  </code></pre>
  
  <p>I'm running the client on the same computer as the service is running, I'm remoting in but assuming the service is getting the credentials I remoted in as. I tried to impersonate those credentials the same way as before but no luck.</p>
  
  <p>As the config is basically the same as in previous successful attempts I'm assuming it is some other setting here that is bothering me.</p>
  
  <p>Problem is that I have no proper idea how Windows authentication works. So here are a few things I would like to suggest as possible problems without knowing or questions I would need answered to help me solve this problem.</p>
  
  <p>1) When I set this security mode what am I asking precisely. As I understand I'm just asking the server if he can validate that my credentials actually exist and are trusted by the Domain. I don't have full privilege on this domain but I'm not requesting to be part of any group in the config. This is just authentication right, not authorization?</p>
  
  <p>2) I'm passing in my own credentials from my own domain, I doubt this is the case as I'm running the client from within the remote and I've also tried to manually enter the credential info (impersonating).</p>
  
  <p>3) Some setting in local policy. I've already set "Access this computer from the network" to authenticated users.</p>
  
  <p>4) HTTP WCF activation is possibly turned off, but it shouldn't matter as this is a netTcp binding and that is turned on.</p>
  
  <p>Anyone have a educated guess what could actually be the problem. Sadly WCF binding config isn't my strong suit so I could be making some very basic mistake so assume the worst.</p>
  
  <p><strong>EDIT</strong></p>
  
  <p>Here is some stack trace. Doesn't seem helpful</p>
  
  <pre><code>10/14/2013 12:26:44 
  ErrorHandler
  System.ServiceModel.Security.SecurityNegotiationException: The server has rejected the client credentials. ---&gt; System.Security.Authentication.InvalidCredentialException: The server has rejected the client credentials. ---&gt; System.ComponentModel.Win32Exception: The logon attempt failed
     --- End of inner exception stack trace ---
     at System.Net.Security.NegoState.StartSendAuthResetSignal(LazyAsyncResult lazyResult, Byte[] message, Exception exception)
     at System.Net.Security.NegoState.StartSendBlob(Byte[] message, LazyAsyncResult lazyResult)
     at System.Net.Security.NegoState.CheckCompletionBeforeNextSend(Byte[] message, LazyAsyncResult lazyResult)
     at System.Net.Security.NegoState.ProcessReceivedBlob(Byte[] message, LazyAsyncResult lazyResult)
     at System.Net.Security.NegoState.StartSendBlob(Byte[] message, LazyAsyncResult lazyResult)
     at System.Net.Security.NegoState.CheckCompletionBeforeNextSend(Byte[] message, LazyAsyncResult lazyResult)
     at System.Net.Security.NegoState.ProcessReceivedBlob(Byte[] message, LazyAsyncResult lazyResult)
     at System.Net.Security.NegoState.ProcessAuthentication(LazyAsyncResult lazyResult)
     at System.Net.Security.NegotiateStream.AuthenticateAsServer(NetworkCredential credential, ProtectionLevel requiredProtectionLevel, TokenImpersonationLevel requiredImpersonationLevel)
     at System.ServiceModel.Channels.WindowsStreamSecurityUpgradeProvider.WindowsStreamSecurityUpgradeAcceptor.OnAcceptUpgrade(Stream stream, SecurityMessageProperty&amp; remoteSecurity)
     --- End of inner exception stack trace ---
     at System.ServiceModel.Channels.WindowsStreamSecurityUpgradeProvider.WindowsStreamSecurityUpgradeAcceptor.OnAcceptUpgrade(Stream stream, SecurityMessageProperty&amp; remoteSecurity)
     at System.ServiceModel.Channels.StreamSecurityUpgradeAcceptorBase.AcceptUpgrade(Stream stream)
     at System.ServiceModel.Channels.InitialServerConnectionReader.UpgradeConnection(IConnection connection, StreamUpgradeAcceptor upgradeAcceptor, IDefaultCommunicationTimeouts defaultTimeouts)
     at System.ServiceModel.Channels.ServerSessionPreambleConnectionReader.ServerFramingDuplexSessionChannel.OnOpen(TimeSpan timeout)
     at System.ServiceModel.Channels.CommunicationObject.Open(TimeSpan timeout)
     at System.ServiceModel.Dispatcher.ChannelHandler.OpenAndEnsurePump()
  
  10/14/2013 12:26:44 
  ErrorHandler-Message
  The server has rejected the client credentials.
  
  10/14/2013 12:26:44 
  ErrorHandler-InnerException
  System.Security.Authentication.InvalidCredentialException: The server has rejected the client credentials. ---&gt; System.ComponentModel.Win32Exception: The logon attempt failed
     --- End of inner exception stack trace ---
     at System.Net.Security.NegoState.StartSendAuthResetSignal(LazyAsyncResult lazyResult, Byte[] message, Exception exception)
     at System.Net.Security.NegoState.StartSendBlob(Byte[] message, LazyAsyncResult lazyResult)
     at System.Net.Security.NegoState.CheckCompletionBeforeNextSend(Byte[] message, LazyAsyncResult lazyResult)
     at System.Net.Security.NegoState.ProcessReceivedBlob(Byte[] message, LazyAsyncResult lazyResult)
     at System.Net.Security.NegoState.StartSendBlob(Byte[] message, LazyAsyncResult lazyResult)
     at System.Net.Security.NegoState.CheckCompletionBeforeNextSend(Byte[] message, LazyAsyncResult lazyResult)
     at System.Net.Security.NegoState.ProcessReceivedBlob(Byte[] message, LazyAsyncResult lazyResult)
     at System.Net.Security.NegoState.ProcessAuthentication(LazyAsyncResult lazyResult)
     at System.Net.Security.NegotiateStream.AuthenticateAsServer(NetworkCredential credential, ProtectionLevel requiredProtectionLevel, TokenImpersonationLevel requiredImpersonationLevel)
     at System.ServiceModel.Channels.WindowsStreamSecurityUpgradeProvider.WindowsStreamSecurityUpgradeAcceptor.OnAcceptUpgrade(Stream stream, SecurityMessageProperty&amp; remoteSecurity)
  </code></pre>
  
  <p><strong>Solution</strong></p>
  
  <p>For some reason I can't explain running the client on the same computer as the WCF service was messing with it. It worked fine if ran from elsewhere.</p>