摘要 : 最近遇到了一個奇怪的 WCF 安全配置問題, WCF Service 上面配置了Windows Authentication. IIS上也啟用了 Windows Authentication, 但是仍然出現IIS沒有啟用Windows Authentication的問題. 在網路上能查到的資料很少. 通過自己的troubleshooting發現所遇到的錯誤提示比較具有迷惑性. 所以POST上來給大家分享一下.

問題 :

 最近遇到了一個奇怪的 WCF 安全配置問題, WCF Service 上面配置了Windows Authentication. IIS上也啟用了 Windows Authentication, 但是仍然出現IIS沒有啟用Windows Authentication的問題.  然而在啟動這個WCF Service的時候遇到了如下的錯誤. 

Security settings for this service require Windows Authentication but it is not enabled for the IIS application that hosts this service. 
  Description: An unhandled exception occurred during the execution of the current web request. Please review the stack trace for more information about the error and where it originated in the code.

Exception Details: System.NotSupportedException: Security settings for this service require Windows Authentication but it is not enabled for the IIS application that hosts this service.
 


Source Error:

An unhandled exception was generated during the execution of the current web request. Information regarding the origin and location of the exception can be identified using the exception stack trace below. 

Stack Trace:

[NotSupportedException: Security settings for this service require Windows Authentication but it is not enabled for the IIS application that hosts this service.]
   System.ServiceModel.Channels.HttpChannelListener.ApplyHostedContext
 
(VirtualPathExtension virtualPathExtension, Boolean isMetadataListener) +15710645
   System.ServiceModel.Channels.HttpsChannelListener.ApplyHostedContext(VirtualPathExtension virtualPathExtension, Boolean isMetadataListener) +27
   System.ServiceModel.Channels.HttpsTransportBindingElement.BuildChannelListener(BindingContext context) +105
   System.ServiceModel.Channels.BindingContext.BuildInnerChannelListener() +95
   System.ServiceModel.Channels.MessageEncodingBindingElement.InternalBuildChannelListener(BindingContext context) +102
   System.ServiceModel.Channels.TextMessageEncodingBindingElement.BuildChannelListener(BindingContext context) +70
   System.ServiceModel.Channels.BindingContext.BuildInnerChannelListener() +95
   System.ServiceModel.Channels.Binding.BuildChannelListener(Uri listenUriBaseAddress, String listenUriRelativeAddress, ListenUriMode listenUriMode, BindingParameterCollection parameters) +166
   System.ServiceModel.Description.DispatcherBuilder.MaybeCreateListener(Boolean actuallyCreate, Type[] supportedChannels, Binding binding, BindingParameterCollection parameters, Uri listenUriBaseAddress, String listenUriRelativeAddress, ListenUriMode listenUriMode, ServiceThrottle throttle, IChannelListener& result, Boolean supportContextSession) +399
   System.ServiceModel.Description.DispatcherBuilder.BuildChannelListener(StuffPerListenUriInfo stuff, ServiceHostBase serviceHost, Uri listenUri, ListenUriMode listenUriMode, Boolean supportContextSession, IChannelListener& result) +499
   System.ServiceModel.Description.DispatcherBuilder.InitializeServiceHost(ServiceDescription description, ServiceHostBase serviceHost) +1937
   System.ServiceModel.ServiceHostBase.InitializeRuntime() +61
   System.ServiceModel.ServiceHostBase.OnOpen(TimeSpan timeout) +63
   System.ServiceModel.Channels.CommunicationObject.Open(TimeSpan timeout) +563
   System.ServiceModel.HostingManager.ActivateService(String normalizedVirtualPath) +135
   System.ServiceModel.HostingManager.EnsureServiceAvailable(String normalizedVirtualPath) +654

[ServiceActivationException: The service '/WinAuthService.svc' cannot be activated due to an exception during compilation.  The exception message is: Security settings for this service require Windows Authentication but it is not enabled for the IIS application that hosts this service..]
   System.ServiceModel.AsyncResult.End(IAsyncResult result) +15786048
   System.ServiceModel.Activation.HostedHttpRequestAsyncResult.End(IAsyncResult result) +15706393
   System.ServiceModel.Activation.HostedHttpRequestAsyncResult.ExecuteSynchronous(HttpApplication context, Boolean flowContext) +265
   System.ServiceModel.Activation.HttpModule.ProcessRequest(Object sender, EventArgs e) +227
   System.Web.SyncEventExecutionStep.System.Web.HttpApplication.IExecutionStep.Execute() +80
   System.Web.HttpApplication.ExecuteStep(IExecutionStep step, Boolean& completedSynchronously) +171

下面是這個WCF Service的配置. 按照這個配置, 是需要在IIS上啟用Windows Authentication.

<system.serviceModel>
    <bindings>
        <basicHttpBinding>
            <binding name="myBasicBinding">
                <security mode="Transport">
                    <transport clientCredentialType="Windows" />
                </security>
            </binding>
        </basicHttpBinding>
    </bindings>
    <services>
        <service name="WCFSample.WinAuthService">
            <endpoint address="WinAuthService.svc" binding="basicHttpBinding"
                bindingConfiguration="myBasicBinding" contract="WCFSample.IWinAuthService" />
        </service>
    </services>
</system.serviceModel>

在IIS的管理介面上, 已經按照啟用了Windows Authentication並且禁用了Anonymous Authentication. 

分析 :

報錯資訊的最頂上一條已經提示了丟擲這個異常的CALL STACK 是 System.ServiceModel.Channels.HttpChannelListener.ApplyHostedContext. 因為是託管程式碼, 所以用工具ILSPY來檢查這段程式碼看什麼情況下會丟擲這樣的錯誤. 從程式碼上看, 這個異常是在做了一定邏輯的校驗之後, 主動丟擲來.

internal override void ApplyHostedContext(VirtualPathExtension virtualPathExtension, bool isMetadataListener)
        {
            ServiceNameCollection customServiceNames;
            base.ApplyHostedContext(virtualPathExtension, isMetadataListener);
            AuthenticationSchemes authenticationSchemes = HostedTransportConfigurationManager.MetabaseSettings.GetAuthenticationSchemes(base.HostedVirtualPath);
            if (this.AuthenticationScheme == AuthenticationSchemes.Anonymous && (authenticationSchemes & AuthenticationSchemes.Anonymous) == AuthenticationSchemes.None && isMetadataListener)
            {
                if ((authenticationSchemes & AuthenticationSchemes.Negotiate) == AuthenticationSchemes.None)
                {
                    this.authenticationScheme = authenticationSchemes;
                }
                else
                {
                    this.authenticationScheme = AuthenticationSchemes.Negotiate;
                }
            }
            if ((authenticationSchemes & this.AuthenticationScheme) == AuthenticationSchemes.None)
            {
                if (!AuthenticationSchemesHelper.IsWindowsAuth(this.AuthenticationScheme))
                {
                    ExceptionUtility exceptionUtility = DiagnosticUtility.ExceptionUtility;
                    object[] str = new object[] { this.AuthenticationScheme.ToString() };
                    throw exceptionUtility.ThrowHelperError(new NotSupportedException(SR.GetString("Hosting_AuthSchemesRequireOtherAuth", str)));
                }
                throw DiagnosticUtility.ExceptionUtility.ThrowHelperError(new NotSupportedException(SR.GetString("Hosting_AuthSchemesRequireWindowsAuth")));
            }
            if (this.AuthenticationScheme != AuthenticationSchemes.Anonymous)
            {
                ExtendedProtectionPolicy extendedProtectionPolicy = HostedTransportConfigurationManager.MetabaseSettings.GetExtendedProtectionPolicy(base.HostedVirtualPath);
                if (extendedProtectionPolicy == null)
                {
                    if (this.extendedProtectionPolicy.PolicyEnforcement == PolicyEnforcement.Always)
                    {
                        throw DiagnosticUtility.ExceptionUtility.ThrowHelperError(new NotSupportedException(SR.GetString("ExtendedProtectionNotSupported")));
                    }
                }
                else if (!isMetadataListener || !ChannelBindingUtility.IsDefaultPolicy(this.extendedProtectionPolicy))
                {
                    ChannelBindingUtility.ValidatePolicies(extendedProtectionPolicy, this.extendedProtectionPolicy, true);
                    if (this.usingDefaultSpnList)
                    {
                        customServiceNames = null;
                    }
                    else
                    {
                        customServiceNames = this.extendedProtectionPolicy.CustomServiceNames;
                    }
                    if (!ChannelBindingUtility.IsSubset(extendedProtectionPolicy.CustomServiceNames, customServiceNames))
                    {
                        object[] objArray = new object[] { SR.GetString("Hosting_ExtendedProtectionSPNListNotSubset") };
                        string str1 = SR.GetString("Hosting_ExtendedProtectionPoliciesMustMatch2", objArray);
                        throw DiagnosticUtility.ExceptionUtility.ThrowHelperError(new NotSupportedException(str1));
                    }
                }
                else
                {
                    this.extendedProtectionPolicy = extendedProtectionPolicy;
                }
            }
            if (!ServiceHostingEnvironment.IsSimpleApplicationHost)
            {
                this.realm = HostedTransportConfigurationManager.MetabaseSettings.GetRealm(virtualPathExtension.VirtualPath);
            }
        }

不過由於不是我們確切看到的錯誤. 所以需要在DLL的Resources中確切的驗證一下. 在這裡明確

Hosting_AuthSchemesRequireWindowsAuth=Security settings for this service require Windows Authentication but it is not enabled for the IIS application that hosts this service.

往上判斷, 能夠進入到 if ((authenticationSchemes & this.AuthenticationScheme) == AuthenticationSchemes.None) . AuthenticationSchemes是一個列舉型別. 在這裡注意到了有兩個分開的定義, Negotiate和Ntlm. 在 IIS Windows Authentication 可以配置多個Provider. 預設情況下有2個, 分別是Negotiate 和 NTLM.

namespace System.Net
{
    /// <summary>Specifies protocols for authentication.</summary>
    [Flags]
    public enum AuthenticationSchemes
    {
        /// <summary>No authentication is allowed. A client requesting an <see cref="T:System.Net.HttpListener" /> object with this flag set will always receive a 403 Forbidden status. Use this flag when a resource should never be served to a client.</summary>
        None = 0,
        /// <summary>Specifies digest authentication.</summary>
        Digest = 1,
        /// <summary>Negotiates with the client to determine the authentication scheme. If both client and server support Kerberos, it is used; otherwise, NTLM is used.</summary>
        Negotiate = 2,
        /// <summary>Specifies NTLM authentication.</summary>
        Ntlm = 4,
        /// <summary>Specifies Windows authentication.</summary>
        IntegratedWindowsAuthentication = 6,
        /// <summary>Specifies basic authentication. </summary>
        Basic = 8,
        /// <summary>Specifies anonymous authentication.</summary>
        Anonymous = 32768
    }
}

在得到這些線索之後, 檢查了Windows Authentication的Providers. 果然只有一個NTLM. 添加了一個新的Negotiate 的 Provider之後, WCF Service就得到了解決.

結論 :

這篇文章中僅討論其中一種可能造成這樣問題的情況. 這裡我遇到的問題與Windows Authentication的Provider有關係.

當 WCF Service 上啟用了Transport 層面上的安全設定之後, 可以配置某一種型別的ClientCredentialType. 其中可以包括 None, Basic, Digest, Ntlm, Windows, Certificate 和 Password. 

當指定為Windows的時候, 實質是要求Kerboer或者NTLM兩者皆可. Server先去嘗試Kerberos驗證, 如果Kerberos驗證失敗, 則會嘗試通過NTLM. 也可以通過設定另外的屬性 AllowNtlm為false來強制使用Kerberos. Kerberos和Ntlm是兩種不同的驗證方式.

由於這一點的不同, 在IIS上要確保做出相應的配置. 即, 開啟IIS的Windows Authentication的同時, 要確保Negotiate Provider也在列表中. 只有Ntlm會被認為是錯誤的配置.

可以參考這裡的連結 :

• http://blogs.msdn.com/b/benjaminperkins/archive/2011/09/14/iis-integrated-windows-authentication-with-negotiate.aspx

Sonic Guo