"The caller was not authenticated by the service" when using a customBinding only on machines on a domain

Question

I wrote a WCF service hosted by IIS 6 on a server that is not part of a domain. It uses the following configuration:

<system.serviceModel>
  <services>
    <service behaviorConfiguration="ServiceBehavior" name="Services.DeliveryStatsService">
      <endpoint address="" binding="customBinding" bindingConfiguration="BindingWithMaxClockSkewForIncorrectlyConfiguredWindowsServer"
        contract="Services.IDeliveryStatsService" />
    </service>
  </services>

  <bindings>
    <customBinding>
      <binding name="BindingWithMaxClockSkewForIncorrectlyConfiguredWindowsServer">
        <binaryMessageEncoding />
        <security>
          <localClientSettings maxClockSkew="00:20:00" />
          <localServiceSettings maxClockSkew="00:20:00" />
          <secureConversationBootstrap />
        </security>
        <httpTransport />
      </binding>
    </customBinding>
  </bindings>

  <behaviors>
    <serviceBehaviors>
      <behavior name="ServiceBehavior">
        <serviceMetadata httpGetEnabled="false" />
        <serviceDebug includeExceptionDetailInFaults="true" />
      </behavior>
    </serviceBehaviors>
  </behaviors>
</system.serviceModel>

It would've been a simple basicHttpBinding, except that the server's clock is not set to the right time and its administrator will not change that, so a customBinding is required to allow for "clockSkew."

Clients use pretty much the same configuration (binding-wise) and can access the service without any trouble, as long as they are not part of a domain. However, clients that are part of a domain are rejected with the message "The caller was not authenticated by the service."

I turned on tracing and it would seem that the problem comes from a token exchange using SSPI negociation. Unfortunately, I can't seem to find the right configuration that will allow both machines that are not part of a domain and machines that are part of a domain to access the service. I have tried several values for authenticationMode, without avail. What's more, as far as I'm concerned, I don't need any particular security on this service.

WCF configuration is far from being my specialty and I haven't found an answer anywhere else, so I hope someone at Stack Overflow will be able to help. Thanks in advance.

Answer 1

Why do you need to set maxClockSkew when you don't need security? It is for handling time differences in timestamps which are not send without security. Once you add security element you turn on authentication because all attributes in the element have default values. Default value for mode is sspiNegotiated. I would start with removing security element.