title: WCF Authentication Access Group
body: <p>I have 2 WCF services, (A and B), where A calls B.</p>
  
  <p>WCF Service A runs using identity ServiceUserA (as set in application pool).
  WCF Service B runs using identity ServiceUserB (as set in application pool).</p>
  
  <p>WCF Service B needs to allow access to users in AD group ServiceBAccessGroup.
  ServiceUserA is part of ServiceBAccessGroup.</p>
  
  <p>When Service A tries to connect to Service B, it gives this error:</p>
  
  <p>SecurityNegotiationException A call to SSPI failed, see inner exception:
  "The target principal name is incorrect"</p>
  
  <p>When both ServiceA and Service B were running as Network Service, this worked fine.</p>
  
  <p>How do I allow users part of ServiceBAccessGroup to connect to ServiceB?</p>
  
  <p>Edit: More info regarding environment:</p>
  
  <p>.net 3.5, IIS 7.0 (WAS), through netTcpBinding, Windows Server 2008.</p>
  
  <p>Edit (2): Yep, thx for asking Tuzo. Here is the client endpoint connection:</p>
  
  <pre><code>  &lt;client&gt;
        &lt;endpoint address="net.tcp://MyServerName:812/v1_0/ServiceB.svc/ServiceB" binding="netTcpBinding" contract="IServiceB" name="ServiceBEndpoint" &gt;
  &lt;/endpoint&gt;
   &lt;/client&gt;
  </code></pre>
  
  <p>Edit (3):</p>
  
  <p>Thanks for your help, it has pointed me closer to the direction of my goal.</p>
  
  <p>I believe my issue is to do with Authorisation than Authentication.  I do not want to authenticate as the ServiceUserB because that would defeat the purpose of our security model.</p>
  
  <p>Using the following did work:</p>
  
  <pre><code>&lt;identity&gt;
    &lt;serviceProviderName value="ServiceB/MyServerName:812" /&gt;
  &lt;/identity&gt;
  </code></pre>
  
  <p>I will give you the correct answer as it was indeed correct and helped me get to my destination.</p>
  
  <p>Thanks again!</p>