The caller was not authenticated by the service. Using wsHttpBinding and Already passing credentials

Question

I went through the other posts on the site, but none could help me.

So here is the error description that i get.

    The caller was not authenticated by the service.
INNER EXCEPTION: System.ServiceModel.FaultException: The request for security token could not be satisfied because authentication failed.
   at System.ServiceModel.Security.SecurityUtils.ThrowIfNegotiationFault(Message message, EndpointAddress target)
   at System.ServiceModel.Security.SspiNegotiationTokenProvider.GetNextOutgoingMessageBody(Message incomingMessage, SspiNegotiationTokenProviderState sspiState)

And stack trace as follows:

    Server stack trace: 
       at System.ServiceModel.Security.IssuanceTokenProviderBase`1.DoNegotiation(TimeSpan timeout)
       at System.ServiceModel.Security.SspiNegotiationTokenProvider.OnOpen(TimeSpan timeout)
       at System.ServiceModel.Security.WrapperSecurityCommunicationObject.OnOpen(TimeSpan timeout)
       at System.ServiceModel.Channels.CommunicationObject.Open(TimeSpan timeout)
       at System.ServiceModel.Security.CommunicationObjectSecurityTokenProvider.Open(TimeSpan timeout)
       at System.ServiceModel.Security.SymmetricSecurityProtocol.OnOpen(TimeSpan timeout)
       at System.ServiceModel.Security.WrapperSecurityCommunicationObject.OnOpen(TimeSpan timeout)
       at System.ServiceModel.Channels.CommunicationObject.Open(TimeSpan timeout)
       at System.ServiceModel.Channels.SecurityChannelFactory`1.ClientSecurityChannel`1.OnOpen(TimeSpan timeout)
       at System.ServiceModel.Channels.CommunicationObject.Open(TimeSpan timeout)
       at System.ServiceModel.Security.SecuritySessionSecurityTokenProvider.DoOperation(SecuritySessionOperation operation, EndpointAddress target, Uri via, SecurityToken currentToken, TimeSpan timeout)
       at System.ServiceModel.Security.SecuritySessionSecurityTokenProvider.GetTokenCore(TimeSpan timeout)
       at System.IdentityModel.Selectors.SecurityTokenProvider.GetToken(TimeSpan timeout)
       at System.ServiceModel.Security.SecuritySessionClientSettings`1.ClientSecuritySessionChannel.OnOpen(TimeSpan timeout)
       at System.ServiceModel.Channels.CommunicationObject.Open(TimeSpan timeout)
       at System.ServiceModel.Channels.ServiceChannel.OnOpen(TimeSpan timeout)
       at System.ServiceModel.Channels.CommunicationObject.Open(TimeSpan timeout)
       at System.ServiceModel.Channels.ServiceChannel.CallOpenOnce.System.ServiceModel.Channels.ServiceChannel.ICallOnce.Call(ServiceChannel channel, TimeSpan timeout)
       at System.ServiceModel.Channels.ServiceChannel.CallOnceManager.CallOnce(TimeSpan timeout, CallOnceManager cascade)
       at System.ServiceModel.Channels.ServiceChannel.Call(String action, Boolean oneway, ProxyOperationRuntime operation, Object[] ins, Object[] outs, TimeSpan timeout)
       at System.ServiceModel.Channels.ServiceChannelProxy.InvokeService(IMethodCallMessage methodCall, ProxyOperationRuntime operation)
       at System.ServiceModel.Channels.ServiceChannelProxy.Invoke(IMessage message)

    Exception rethrown at [0]: 
       at System.Runtime.Remoting.Proxies.RealProxy.HandleReturnMessage(IMessage reqMsg, IMessage retMsg)
       at System.Runtime.Remoting.Proxies.RealProxy.PrivateInvoke(MessageData& msgData, Int32 type)

   at TTasks.EmailSvc.ISendMailService.SendMailWithUri(EmailMessage emailMessageDataContract, String uri)
   at TTasks.EmailSvc.SendMailServiceClient.SendMailWithUri(EmailMessage emailMessageDataContract, String uri) in C:\Projects\Test Project\TTasks\Service References\EmailSvc\Reference.cs:line 251

Service configuration:

<services>
    <service name="WcfEndpoint.SendMailService" behaviorConfiguration="WcfEndpoint.SendMailServiceBehavior">                
        <endpoint address="Email"  binding="wsHttpBinding" contract="WcfEndpoint.ServiceContract.ISendMailService" bindingConfiguration="LargeFileBinding">
            <identity>                        
                <dns value="localhost"/>
            </identity>
        </endpoint>
        <endpoint address="mex" binding="mexHttpBinding" contract="IMetadataExchange"/>
    </service>
</services>

Client Side bindings (Building it in program)

WSHttpBinding wsb = new WSHttpBinding(SecurityMode.Message, false);
            wsb.Security.Transport.ClientCredentialType = HttpClientCredentialType.Ntlm;
            wsb.Security.Message.ClientCredentialType = MessageCredentialType.Windows;
            wsb.Security.Message.NegotiateServiceCredential = true;
            wsb.Security.Message.EstablishSecurityContext = true;

            _mailClient = new EmailSvc.SendMailServiceClient    (wsb, ep);.

So i am trying to figure out what possibly has gone wrong, please note that the client and service was working fine till recently. We did make some security changes at server level. I am clueless what broke the client app.

Any thoughts are appreciated. I am trying to get a list of all the possibilities that can break the app in this scenario. And hopefully can fix it. Since app and service used to run fine, i would believe these two don't need any new changes.

Thank you in advance.

Answer 1

Service Account which used to run the application was locked and someone has changed its credentials. We updated the service account, and that fixed the issue.

So checking credentials of service account and making sure they are valid is one important thing to look for with such issues. I hope it will help someone.