Windows 2003 R2 and WSE 3.0 Kerberos issue

am 28.04.2006 15:52:02 von NielsFlenstedJensen

Running a Windows 2003 R2 Standard configured as a domain controller (the
machine will be used as a stand alone demo machine)

Working the Kerberos sample in %Program Files%Microsoft
WSE\v3.0\Samples\CS\QuickStart\Security\WSSecurityKerberos\P olicy

It works fine with the service hosted by IIS in the Default App Pool.

After changing it to a new App Pool under a different service account
(member of Domain User, IIS_WPG, "Log on as service" right) I can call any
endpoint not protected by the kerberos policy, but once calling the
'StockQuoteRequest' which requires a Kerberos token, I get this error at the
server side:

WSE594: AcceptSecurityContext call failed with the following error message:
Logon failure: unknown user name or bad password.

Appearently this service account does not have the rights to verify the
Kerberos token? Some policy setting that I am missing?

NOTE: As I said the R2 server is also a domain controller. This most likely
complicates the issue, but still - Network Service works, so surely I can
configure my service acocunt to work as well?

Any ideas here?

Thanks,

Niels

RE: Windows 2003 R2 and WSE 3.0 Kerberos issue

am 28.04.2006 16:26:02 von NielsFlenstedJensen

Well, just tried on a regular Windows 2003 SP1 - same issue and this one is
not a domain controller.

So, I suppose I'm down to some right that needs to be set.

Here is the full exception dump from my WSE trace:

xmlns:q0="http://docs.oasis-open.org/wss/2004/01/oasis-20040 1-wss-wssecurity-secext-1.0.xsd">q0:InvalidSecurityToken
Microsoft.Web.Services3.Security.SecurityFault: An
invalid security token was provided ---> System.Security.SecurityException:
WSE594: AcceptSecurityContext call failed with the following error message:
Logon failure: unknown user name or bad password.
..
at
Microsoft.Web.Services3.Security.Tokens.Kerberos.KerberosSer verContext.AcceptContext(Byte[] inToken)
at
Microsoft.Web.Services3.Security.Tokens.KerberosToken.Initia lizeServerContext()
at
Microsoft.Web.Services3.Security.Tokens.KerberosToken.Initia lizeLifeTime()
at Microsoft.Web.Services3.Security.Tokens.KerberosToken.get_Is Current()
at Microsoft.Web.Services3.Security.Security.LoadToken(XmlEleme nt
element, SecurityConfiguration configuration, Int32& tokenCount)
The Zone of the assembly that failed was:
MyComputer
--- End of inner exception stack trace ---
at Microsoft.Web.Services3.Security.Security.LoadToken(XmlEleme nt
element, SecurityConfiguration configuration, Int32& tokenCount)
at Microsoft.Web.Services3.Security.Security.LoadXml(XmlElement element)
at Microsoft.Web.Services3.Security.Security.CreateFrom(SoapEnv elope
envelope, String localActor, String serviceActor)
at
Microsoft.Web.Services3.Security.ReceiveSecurityFilter.Proce ssMessage(SoapEnvelope envelope)
at Microsoft.Web.Services3.Pipeline.ProcessInputMessage(SoapEnv elope
envelope)
at Microsoft.Web.Services3.WseProtocol.FilterRequest(SoapEnvelo pe
requestEnvelope)
at Microsoft.Web.Services3.WseProtocol.RouteRequest(SoapServerM essage
message)
at System.Web.Services.Protocols.SoapServerProtocol.Initialize( )
at System.Web.Services.Protocols.ServerProtocolFactory.Create(T ype type,
HttpContext context, HttpRequest request, HttpResponse response, Boolean&
abortProcessing)

http://localhost/WSSecurityKerberosPolicy/WSSecurityKerberos Service.asmx

RE: Windows 2003 R2 and WSE 3.0 Kerberos issue

am 28.04.2006 16:26:02 von NielsFlenstedJensen

RE: Windows 2003 R2 and WSE 3.0 Kerberos issue

am 01.05.2006 13:09:02 von NielsFlenstedJensen

Well, as it often goes, time - and your own effort - is on your side. The
issue is caused by missing Service Principal Names on my service account. It
must be set to the same SPN as the computer account which is the account
behind the Default App Pool (Network Service).

So it had nothing to do with the fact that the server runs R2 or is a domain
controller.

Read here to get the full story:
http://msdn.microsoft.com/library/default.asp?url=/library/e n-us/dnpag2/html/WSS_Ch7_KerbTechSupp.asp

Niels

"Niels Flensted-Jensen" wrote:

> Running a Windows 2003 R2 Standard configured as a domain controller (the
> machine will be used as a stand alone demo machine)
>
> Working the Kerberos sample in %Program Files%Microsoft
> WSE\v3.0\Samples\CS\QuickStart\Security\WSSecurityKerberos\P olicy
>
> It works fine with the service hosted by IIS in the Default App Pool.
>
> After changing it to a new App Pool under a different service account
> (member of Domain User, IIS_WPG, "Log on as service" right) I can call any
> endpoint not protected by the kerberos policy, but once calling the
> 'StockQuoteRequest' which requires a Kerberos token, I get this error at the
> server side:
>
> WSE594: AcceptSecurityContext call failed with the following error message:
> Logon failure: unknown user name or bad password.
>
> Appearently this service account does not have the rights to verify the
> Kerberos token? Some policy setting that I am missing?
>
> NOTE: As I said the R2 server is also a domain controller. This most likely
> complicates the issue, but still - Network Service works, so surely I can
> configure my service acocunt to work as well?
>
> Any ideas here?
>
> Thanks,
>
> Niels

RE: Windows 2003 R2 and WSE 3.0 Kerberos issue

am 01.05.2006 13:09:02 von NielsFlenstedJensen

RE: Windows 2003 R2 and WSE 3.0 Kerberos issue

am 03.05.2006 18:03:02 von HungNgo

Hi,
I have the same problem with SPN. Although I set the SPN the same computer
account "http/localhost:4115", the error still appear:
"WSE594:InitializeSecurityContext call failed with the following error
message: A specified logon session does not exist. It may already have been
terminated."
Do you have any experience on this error message?
Hung.

"Niels Flensted-Jensen" wrote:

> Well, as it often goes, time - and your own effort - is on your side. The
> issue is caused by missing Service Principal Names on my service account. It
> must be set to the same SPN as the computer account which is the account
> behind the Default App Pool (Network Service).
>
> So it had nothing to do with the fact that the server runs R2 or is a domain
> controller.
>
> Read here to get the full story:
> http://msdn.microsoft.com/library/default.asp?url=/library/e n-us/dnpag2/html/WSS_Ch7_KerbTechSupp.asp
>
> Niels
>
>
> "Niels Flensted-Jensen" wrote:
>
> > Running a Windows 2003 R2 Standard configured as a domain controller (the
> > machine will be used as a stand alone demo machine)
> >
> > Working the Kerberos sample in %Program Files%Microsoft
> > WSE\v3.0\Samples\CS\QuickStart\Security\WSSecurityKerberos\P olicy
> >
> > It works fine with the service hosted by IIS in the Default App Pool.
> >
> > After changing it to a new App Pool under a different service account
> > (member of Domain User, IIS_WPG, "Log on as service" right) I can call any
> > endpoint not protected by the kerberos policy, but once calling the
> > 'StockQuoteRequest' which requires a Kerberos token, I get this error at the
> > server side:
> >
> > WSE594: AcceptSecurityContext call failed with the following error message:
> > Logon failure: unknown user name or bad password.
> >
> > Appearently this service account does not have the rights to verify the
> > Kerberos token? Some policy setting that I am missing?
> >
> > NOTE: As I said the R2 server is also a domain controller. This most likely
> > complicates the issue, but still - Network Service works, so surely I can
> > configure my service acocunt to work as well?
> >
> > Any ideas here?
> >
> > Thanks,
> >
> > Niels

RE: Windows 2003 R2 and WSE 3.0 Kerberos issue

am 03.05.2006 18:03:02 von HungNgo

RE: Windows 2003 R2 and WSE 3.0 Kerberos issue

am 03.05.2006 21:47:46 von NielsFlenstedJensen

Hung,

Have a look in the "Common Error Messages" in the "Troubleshooting WSE
Applications" section in the WSE 3.0 documentation.

Notice though that your SPN seems to be wrong. You need to set it as
described by link I provided (
http://msdn.microsoft.com/library/default.asp?url=/library/e n-us/dnpag2/html/WSS_Ch7_KerbTechSupp.asp).
Note that you need to set two SPNs - with and without the domain name. And
to do that you need to install the Windows Support Tools as mentioned in the
article.

Niels

"Hung Ngo" wrote:

> Hi,
> I have the same problem with SPN. Although I set the SPN the same computer
> account "http/localhost:4115", the error still appear:
> "WSE594:InitializeSecurityContext call failed with the following error
> message: A specified logon session does not exist. It may already have been
> terminated."
> Do you have any experience on this error message?
> Hung.
>
> "Niels Flensted-Jensen" wrote:
>
> > Well, as it often goes, time - and your own effort - is on your side. The
> > issue is caused by missing Service Principal Names on my service account. It
> > must be set to the same SPN as the computer account which is the account
> > behind the Default App Pool (Network Service).
> >
> > So it had nothing to do with the fact that the server runs R2 or is a domain
> > controller.
> >
> > Read here to get the full story:
> > http://msdn.microsoft.com/library/default.asp?url=/library/e n-us/dnpag2/html/WSS_Ch7_KerbTechSupp.asp
> >
> > Niels
> >
> >
> > "Niels Flensted-Jensen" wrote:
> >
> > > Running a Windows 2003 R2 Standard configured as a domain controller (the
> > > machine will be used as a stand alone demo machine)
> > >
> > > Working the Kerberos sample in %Program Files%Microsoft
> > > WSE\v3.0\Samples\CS\QuickStart\Security\WSSecurityKerberos\P olicy
> > >
> > > It works fine with the service hosted by IIS in the Default App Pool.
> > >
> > > After changing it to a new App Pool under a different service account
> > > (member of Domain User, IIS_WPG, "Log on as service" right) I can call any
> > > endpoint not protected by the kerberos policy, but once calling the
> > > 'StockQuoteRequest' which requires a Kerberos token, I get this error at the
> > > server side:
> > >
> > > WSE594: AcceptSecurityContext call failed with the following error message:
> > > Logon failure: unknown user name or bad password.
> > >
> > > Appearently this service account does not have the rights to verify the
> > > Kerberos token? Some policy setting that I am missing?
> > >
> > > NOTE: As I said the R2 server is also a domain controller. This most likely
> > > complicates the issue, but still - Network Service works, so surely I can
> > > configure my service acocunt to work as well?
> > >
> > > Any ideas here?
> > >
> > > Thanks,
> > >
> > > Niels

RE: Windows 2003 R2 and WSE 3.0 Kerberos issue

am 03.05.2006 21:47:46 von NielsFlenstedJensen