WCF - How to configure netTcpBinding for NTLM authentication?

Question

I know how to configure basicHttpBinding for NTLM authentication, but can't figure out a way to do the same for netTcpBinding.

Does netTcpBinding support NTLM? If so, how to force WCF service to use NTLM?

BTW a well known method using identity element for some reason didn't work at all. I am looking for something like this - clientCredentialType ="Ntlm" but for tcp. Here is basicHttp setting:

<basicHttpBinding>
  <binding name="BasicHttpBinding">
  <security mode ="TransportCredentialOnly">
  <transport clientCredentialType ="Ntlm"/>
  </security>
  </binding>
</basicHttpBinding>

Inn

If you want to include snippets of code or XML (e.g. configs), you need to highlight those lines in your post and then use the "code" Button (101 010) on the editor toolbar (or press Ctrl-K on your keyboard) to have them nicely formatted and syntax highlighted. Otherwise, your post is really hard to read and XML will not even show up! – Doherty

Answer 1

Here is the comprehensive answer that I finally found, tested, and confirmed.

A. My WCF client used to build an EndPoint.Address dynamically as follow

EndPointAddress  myEdpintAddress = new EndPointAddress(stringURL);

But in the case of a secure transport (net.tcp) it has to be initialized as follow EndPointAddress myEdpintAddress = new EndPointAddress(new UrRL(string), myEndPointIdentity)

Without the EndPointIdentity parameters the Identity property in the EndPointAddress object is null, and generates the “...target principal name is incorrect... " error on the server side.

B. Our domain controller supports both Kerberos and Ntlm authentication. After above is done, generally there are four configuration scenarios on the client side for the net.tcp binding if security is other than “None”, and the WCF service runs as a domain account:

1. No <identity> elements in the client endpoint specified - WCF call fails

2. <identity> element provided, but with an empty value for dns, userPrioncipalName or servicePrincipalName elements - WCF call successful, but uses the Ntlm authentication

3. <identity> element provided with the a value for dsn or SPN – WCF call successfull; service uses Ntlm to authenticate.

4. <identity> element provided with the correct value for upn – WCF call successfull; service uses Kerberos for authenticate. Incorrect or missing value for upn trigger Ntlm authentication

Thanks.

Inn

Answer 2

The Net TCP Binding does not support "NTLM" as a client credentials type - you have a choice of None, Windows or Certificate only (see the MSDN docs on TcpClientCredentialType).

So in your case, try this:

<netTcpBinding>
  <binding name="tcpWindows">
    <security mode ="TransportCredentialOnly">
      <transport clientCredentialType ="Windows"/>
    </security>
  </binding>
</netTcpBinding>

Any reason why this doesn't work??

Doherty

Thank you marc_s. This is what I was trying to use for tcp binding on a first place, but it does not work - it does not force NTLM. From the event viewer I can see that it still trying to use Kerberos, which is not configured in the environment. Hence the service call fails. Interesting enough that it works, if I specify the IP address rather than a full name (hostname plus domain) of the server machine. In this case it does utilize the NTLM. I can see it from the event viewer. – Inn