title: WCF WSHttpBinding SOAP Security Negotiation Failed
body: <p>I've got a fairly simple WCF self-hosted service using the WSHttpBinding that just refuses to work. If service and client runs on the same machine there's no problem, but as soon as I move the service to the window-server 2008 the client fails the communication attempts with</p>
  
  <blockquote>
    <p>EXCEPTION</p>
    
    <p>[System.ServiceModel.Security.SecurityNegotiationException] {"SOAP security negotiation with 'http://hvw-svr-01/SIT' for target 'http://hvw-svr-01/SIT' failed. See inner exception for more details."}</p>
    
    <p>INNER EXCEPTION</p>
    
    <p>[System.ComponentModel.Win32Exception] {"The Security Support Provider Interface (SSPI) negotiation failed. The server may not be running in an account with identity 'host/hvw-svr-01'. If the server is running in a service account (Network Service for example), specify the account's ServicePrincipalName as the identity in the EndpointAddress for the server. If the server is running in a user account, specify the account's UserPrincipalName as the identity in the EndpointAddress for the server."}</p>
  </blockquote>
  
  <p>Since it's a self-hosted service I suppose I need to specify the UserPrincipalName, but no matter what I try for that property it just won't work.</p>
  
  <ul>
  <li>domain\username</li>
  <li>domain@username</li>
  <li>host/localhost</li>
  <li>host/hvw-svr-01</li>
  <li>... and so on</li>
  </ul>
  
  <p>Tried it with different user accounts aswell, including the built-in Administrator. If I try BasicHttpBinding instead of WSHttpBinding everything works as expected. I read tons of articles about that problem on google (and stackoverflow) but I still cannot figure what the problem is and how to specify that identity.</p>
  
  <p>Edit: Service App.Config</p>
  
  <pre><code>   &lt;system.serviceModel&gt;
    &lt;services&gt;
       &lt;service name="SIT.Communication.Gate"&gt;
          &lt;host&gt;
             &lt;baseAddresses&gt;
                &lt;add baseAddress="http://localhost:2323/SIT" /&gt;
             &lt;/baseAddresses&gt;
          &lt;/host&gt;
          &lt;endpoint address="" binding="wsHttpBinding" contract="SIT.Core.IGate"&gt;
             &lt;identity&gt;
                &lt;dns value="localhost"/&gt;
                &lt;userPrincipalName value="XZDom\DGrain"/&gt;
             &lt;/identity&gt;
          &lt;/endpoint&gt;
          &lt;endpoint address="mex" binding="mexHttpBinding" contract="IMetadataExchange" /&gt;
       &lt;/service&gt;
    &lt;/services&gt;
    &lt;behaviors&gt;
       &lt;serviceBehaviors&gt;
          &lt;behavior&gt;
             &lt;serviceMetadata httpGetEnabled="True"/&gt;
             &lt;serviceDebug includeExceptionDetailInFaults="True" /&gt;
          &lt;/behavior&gt;
       &lt;/serviceBehaviors&gt;
    &lt;/behaviors&gt;
  </code></pre>
  
  <p></p>
  
  <p>Edit: The Client itself is basically just this code fragment</p>
  
  <blockquote>
  <pre><code>        ChannelFactory&lt;IGate&gt; sitFactory = new ChannelFactory&lt;IGate&gt;(new WSHttpBinding(), new EndpointAddress("http://hvw-svr-01:2323/SIT"));
          IGate sitProxy = sitFactory.CreateChannel();
          bool pong = sitProxy.Ping(); &lt;------ throws exception
  </code></pre>
  </blockquote>