title: expected identity upn connecting to service as network service,
body: <p>We have a web application, running in an application pool as 'NETWORK SERVICE'.
  The web application connects to a service (.svc) on another web server. The other web server also has the service hosted as 'NETWORK SERVICE'. I believe this is the default.</p>
  
  <p>The following endpoint, when run anywhere else works perfectly.</p>
  
  <pre><code>&lt;endpoint address="http://server123/UnitTrustService/UnitTrustService.svc"
    binding="wsHttpBinding" bindingConfiguration="WSHttpBinding_UnitTrustService"
    contract="UnitTrustServiceReference.UnitTrustService" name="WSHttpBinding_UnitTrustService"&gt;
   &lt;identity&gt;
    &lt;servicePrincipalName value="server123" /&gt;
   &lt;/identity&gt;
  &lt;/endpoint&gt;
  </code></pre>
  
  <p>Unfortunately when executed from the web site, we get the following error.</p>
  
  <pre><code>        System.ServiceModel.Security.MessageSecurityException: 
      The identity check failed for the outgoing message. 
      The expected identity is 'identity(http://schemas.xmlsoap.org/ws/2005/05/identity/right/possessproperty: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/upn)' 
  for the 'http://server123/UnitTrustService/UnitTrustService.svc' target endpoint. 
  Server stack trace: at System.ServiceModel.Security.IdentityVerifier.EnsureIdentity(EndpointAddress serviceReference, AuthorizationContext authorizationContext, String errorString)...
  </code></pre>
  
  <p>Any ideas?
  I have tried running this as local system on the web server machine with exactly the same configuration and it works perfectly.</p>
  
  <p>It has something to do with IIS?</p>
  
  <p>Regards
  Craig.</p>