title: netTCP binding Soap Security Negotiation Failed
body: <p>I am writing a WCF service requires impersonate and session.<br/></p>
  
  <p>It is ok when I tried to call it on my local machine, but on the remote machine it always failed with such error:</p>
  
  <blockquote>
    <p>Security Support Provider Interface (SSPI) authentication failed. The server may not be running in an account with identity 'host/hostname'. If the server is running in a service account (Network Service for example), specify the account's ServicePrincipalName as the identity in the EndpointAddress for the server. If the server is running in a user account, specify the account's UserPrincipalName as the identity in the EndpointAddress for the server.</p>
  </blockquote>
  
  <p>If I provided a upn, it throws an identity failed exception.</p>
  
  <p>Here is my config:</p>
  
  <p>Server Config(APP):</p>
  
  <pre><code>&lt;system.serviceModel&gt;    
      &lt;behaviors&gt;
        &lt;serviceBehaviors&gt;
          &lt;behavior name="default"&gt;
            &lt;serviceMetadata httpGetEnabled="true" /&gt;
            &lt;serviceDebug includeExceptionDetailInFaults="true" /&gt;
            &lt;serviceAuthorization impersonateCallerForAllOperations="true" /&gt;
          &lt;/behavior&gt;
        &lt;/serviceBehaviors&gt;
      &lt;/behaviors&gt;
      &lt;bindings&gt;
        &lt;netTcpBinding&gt;
          &lt;binding name="DataService.netTcpBinding"&gt;
            &lt;readerQuotas maxArrayLength="65535" maxBytesPerRead="2147483647" maxStringContentLength="2147483647"/&gt;
            &lt;reliableSession enabled="true" inactivityTimeout="24:00:00" ordered="true"/&gt;          
            &lt;security mode="TransportWithMessageCredential"&gt;
              &lt;message clientCredentialType="Windows" /&gt;
              &lt;transport clientCredentialType="Windows"/&gt;          
            &lt;/security&gt;
          &lt;/binding&gt;
        &lt;/netTcpBinding&gt;
      &lt;/bindings&gt;
      &lt;serviceHostingEnvironment aspNetCompatibilityEnabled="true" multipleSiteBindingsEnabled="true"/&gt;
      &lt;services&gt;
        &lt;service behaviorConfiguration="default" name="DataService.DataService"&gt;
          &lt;endpoint address="" binding="netTcpBinding" bindingConfiguration="DataService.netTcpBinding" 
            name="DataService.DataService" contract="DataService.IDataService"/&gt;
          &lt;endpoint address="mex" binding="mexTcpBinding" contract="IMetadataExchange" /&gt;
          &lt;host&gt;
            &lt;baseAddresses&gt;
              &lt;add baseAddress="http://address:4504/"/&gt;
              &lt;add baseAddress="net.tcp://address:4503/"/&gt;
            &lt;/baseAddresses&gt;
          &lt;/host&gt;
        &lt;/service&gt;
      &lt;/services&gt;
  &lt;/system.serviceModel&gt;
  </code></pre>
  
  <p>Client Config:</p>
  
  <pre><code>&lt;?xml version="1.0" encoding="utf-8" ?&gt;
  &lt;configuration&gt;
      &lt;system.serviceModel&gt;     
          &lt;bindings&gt;
              &lt;netTcpBinding&gt;
                  &lt;binding name="DataService.DataService" closeTimeout="00:01:00"
                      openTimeout="00:01:00" receiveTimeout="00:10:00" sendTimeout="00:01:00"
                      transactionFlow="false" transferMode="Buffered" transactionProtocol="OleTransactions"
                      hostNameComparisonMode="StrongWildcard" listenBacklog="10"
                      maxBufferPoolSize="524288" maxBufferSize="65536" maxConnections="10"
                      maxReceivedMessageSize="65536"&gt;
                      &lt;readerQuotas maxDepth="32" maxStringContentLength="8192" maxArrayLength="16384"
                          maxBytesPerRead="4096" maxNameTableCharCount="16384" /&gt;
                      &lt;reliableSession ordered="true" inactivityTimeout="24.00:00:00"
                          enabled="true" /&gt;
                      &lt;security mode="TransportWithMessageCredential"&gt;
                          &lt;transport clientCredentialType="Windows" protectionLevel="EncryptAndSign" /&gt;
                          &lt;message clientCredentialType="Windows" algorithmSuite="Default" /&gt;
                      &lt;/security&gt;
                  &lt;/binding&gt;
              &lt;/netTcpBinding&gt;
          &lt;/bindings&gt;
          &lt;client&gt;
              &lt;endpoint address="net.tcp://address:4503/" binding="netTcpBinding"
                  bindingConfiguration="DataService.DataService"
                  contract="ataService.IDataService" name="DataService.DataService"&gt;
                &lt;identity&gt;
                  &lt;dns value="DOMAIN"/&gt;                                                  
                &lt;/identity&gt;
              &lt;/endpoint&gt;
          &lt;/client&gt;
      &lt;/system.serviceModel&gt;
  &lt;/configuration&gt;
  </code></pre>
  
  <p>Any help would be greatly appreciated.</p>