WCF服務未假冒客戶端

Question

物流： 1臺運行WCF服務的服務器。 1臺運行WCF服務數據庫的服務器。

問題： 我有一個WCF服務運行在1臺服務器上，它連接到一臺單獨的服務器以獲取它需要檢索的必要數據。我的問題是，當從客戶端機器調用服務時，我得到一個數據庫sql錯誤，指出'用戶登錄失敗'NT AUTHORITY \ ANONYMOUS LOGON'。我相信我已經設置了WCF服務來使用模擬。

WCF服務器配置：

<bindings> 
    <ws2007HttpBinding> 
    <binding maxReceivedMessageSize="214748"> 
     <security mode="Message"> 
     <transport clientCredentialType="Windows" 
        proxyCredentialType="Windows" realm="" /> 
     <message clientCredentialType="Windows" negotiateServiceCredential="true" 
       algorithmSuite="Default" establishSecurityContext="true" /> 
     </security> 
    </binding> 
    </ws2007HttpBinding> 
</bindings> 
<services> 
    <service behaviorConfiguration="Host.ServiceBehavior" name="Wcf.MyWebService"> 
    <endpoint address="" behaviorConfiguration="" 
       binding="ws2007HttpBinding" contract="Wcf.MyWebServiceSoap"> 
     <identity> 
     <servicePrincipalName value="ServerMachineName" /> 
     </identity> 
    </endpoint> 
    <endpoint address="mex" binding="mexHttpBinding" 
       contract="IMetadataExchange" /> 
    </service> 
</services> 
<behaviors> 
    <serviceBehaviors> 
    <behavior name="Host.ServiceBehavior"> 
     <serviceMetadata httpsGetEnabled="true" /> 
     <serviceDebug includeExceptionDetailInFaults="true" /> 
     <serviceAuthorization impersonateCallerForAllOperations="true" /> 
    </behavior> 
    </serviceBehaviors> 
</behaviors> 

WCF服務代碼：

public class MySebService: MyWebServiceSoap 
{ 
    [OperationBehavior(Impersonation = ImpersonationOption.Required)] 
    public string TestWebMethod() 
    { 
    DbDal dal = CreateDataAccessLayer(); 

    return dal.GetStringFromDatabase(); 
    } 
} 

客戶端配置和代碼：

我編程設置如下配置：

public void TestWebMethod() 
{ 
    WS2007HttpBinding binding = new WS2007HttpBinding(); 
    EndpointAddress endpoint = new EndpointAddress("uri"); 
    ServiceClient client = new ServiceClient(binding, endpoint); 
    client.ClientCredentials.Windows.AllowedImpersonationLevel = 
           TokenImpersonationLevel.Impersonation; 
    client.ClientCredentials.Windows.AllowNtlm = true; 
    string result = client.TestWebMethod(); 
    client.Close(); 
} 

Answer 1

TokenImpersonationLevel.Impersonation允許服務訪問服務本地資源，但不允許服務訪問外部資源（例如，另一個服務）。

您必須將允許的模擬級別設置爲 TokenImpersonationLevel.Delegation。

client.ClientCredentials.Windows.AllowedImpersonationLevel = TokenImpersonationLevel.Delegation;