title: WCF: SecurityNegotiationException when using client
body: <p>So I've been trying to set up certificate authentication for my clients and services. The eventual goal is to partition data based on the certificate a client connects with (i.e. the certificate becomes their credentials in to the greater system and their data is partitioned based on these credentials).</p>
  
  <p>I have been able to set it up successfully on both the client and the server side. I have created a certificate and a private key, installed them on my computer, and set up my server such that 1) it has a certificate-based service credential and 2) if a client connects <em>without</em> providing a certificate-based credential an exception is thrown.</p>
  
  <p>What I then did was create a simple client and add a certificate credential to the configuration and try to call a simple operation on the service. </p>
  
  <p>It looks like the client connects OK, and it looks like the certificate is accepted by the server, but I do get this:</p>
  
  <p><strong>SecurityNegotiationException:</strong></p>
  
  <p><em>"The caller was not authenticated by the service."</em></p>
  
  <p>That seems rather ambiguous to me. Note that I am using wsHttpBinding, which supposedly defaults to Windows auth for transport security...but all of these processes are being run as my user account as I'm running in my debug environment.</p>
  
  <p>Here is my server configuration:</p>
  
  <pre><code>&lt;system.serviceModel&gt;
      &lt;bindings&gt;
        &lt;wsHttpBinding&gt;
          &lt;binding name="MyServiceBinding"&gt;
            &lt;security mode="Message"&gt;
              &lt;transport clientCredentialType="None"/&gt;
              &lt;message clientCredentialType="Certificate"/&gt;
            &lt;/security&gt;
          &lt;/binding&gt;
        &lt;/wsHttpBinding&gt;
      &lt;/bindings&gt;
      &lt;services&gt;
        &lt;service behaviorConfiguration="MyServiceBehavior" name="MyService"&gt;
          &lt;endpoint binding="wsHttpBinding" bindingConfiguration="MyServiceBinding" contract="IMyContract"/&gt;
          &lt;endpoint binding="mexHttpBinding" address="mex" contract="IMetadataExchange"&gt;
            &lt;identity&gt;
              &lt;dns value="localhost"/&gt;
            &lt;/identity&gt;
          &lt;/endpoint&gt;
        &lt;/service&gt;
      &lt;/services&gt;
      &lt;behaviors&gt;
        &lt;serviceBehaviors&gt;
          &lt;behavior name="MyServiceBehavior"&gt;
            &lt;serviceMetadata httpGetEnabled="true" policyVersion="Policy15" /&gt;
            &lt;serviceDebug includeExceptionDetailInFaults="false" /&gt;
            &lt;serviceCredentials&gt;
              &lt;serviceCertificate storeLocation="CurrentUser" storeName="My" x509FindType="FindBySubjectName" findValue="tmp123"/&gt;
            &lt;/serviceCredentials&gt;
          &lt;/behavior&gt;
        &lt;/serviceBehaviors&gt;
      &lt;/behaviors&gt;
      &lt;serviceHostingEnvironment multipleSiteBindingsEnabled="true" /&gt;
  &lt;/system.serviceModel&gt;
  </code></pre>
  
  <p>Here is my client config -- note that I'm using the same cert for the client that I use on the service:</p>
  
  <pre><code>&lt;system.serviceModel&gt;
      &lt;bindings&gt;
          &lt;wsHttpBinding&gt;
              &lt;binding name="WSHttpBinding_IMyService" closeTimeout="00:01:00" openTimeout="00:01:00" receiveTimeout="00:10:00" sendTimeout="00:01:00" bypassProxyOnLocal="false" transactionFlow="false" hostNameComparisonMode="StrongWildcard" maxBufferPoolSize="524288" maxReceivedMessageSize="65536" messageEncoding="Text" textEncoding="utf-8" useDefaultWebProxy="true" allowCookies="false"&gt;
                  &lt;readerQuotas maxDepth="32" maxStringContentLength="8192" maxArrayLength="16384" maxBytesPerRead="4096" maxNameTableCharCount="16384"/&gt;
                  &lt;reliableSession ordered="true" inactivityTimeout="00:10:00" enabled="false"/&gt;
                  &lt;security mode="Message"&gt;
                      &lt;!--&lt;transport clientCredentialType="Windows" proxyCredentialType="None" realm=""/&gt;--&gt;
                      &lt;message clientCredentialType="Certificate" negotiateServiceCredential="true" algorithmSuite="Default"/&gt;
                  &lt;/security&gt;
              &lt;/binding&gt;
          &lt;/wsHttpBinding&gt;
      &lt;/bindings&gt;
      &lt;client&gt;
          &lt;endpoint address="http://localhost:50120/UserServices.svc" binding="wsHttpBinding" bindingConfiguration="WSHttpBinding_IMyService" behaviorConfiguration="IMyService_Behavior" contract="UserServices.IUserServices" name="WSHttpBinding_IMyService"&gt;
              &lt;identity&gt;
                  &lt;certificate encodedValue="Some RSA stuff"/&gt;
              &lt;/identity&gt;
          &lt;/endpoint&gt;
      &lt;/client&gt;
      &lt;behaviors&gt;
        &lt;endpointBehaviors&gt;
          &lt;behavior name="IMyService_Behavior"&gt;
            &lt;clientCredentials&gt;
              &lt;clientCertificate storeLocation="CurrentUser" storeName="My" x509FindType="FindBySubjectName" findValue="tmp123"/&gt;
            &lt;/clientCredentials&gt;
          &lt;/behavior&gt;
        &lt;/endpointBehaviors&gt;
      &lt;/behaviors&gt;
  &lt;/system.serviceModel&gt;
  </code></pre>
  
  <p>Can anyone please help provide some insight as to what might be up here?</p>
  
  <p>Thanks,</p>