Windows 2003 R2 and WSE 3.0 Kerberos issue

[Niels Flensted-Jensen]

Running a Windows 2003 R2 Standard configured as a domain controller (the
machine will be used as a stand alone demo machine)

Working the Kerberos sample in %Program Files%Microsoft
WSE\v3.0\Samples\CS\QuickStart\Security\WSSecurityKerberos\Policy

It works fine with the service hosted by IIS in the Default App Pool.

After changing it to a new App Pool under a different service account
(member of Domain User, IIS_WPG, "Log on as service" right) I can call any
endpoint not protected by the kerberos policy, but once calling the
'StockQuoteRequest' which requires a Kerberos token, I get this error at the
server side:

WSE594: AcceptSecurityContext call failed with the following error message:
Logon failure: unknown user name or bad password.

Appearently this service account does not have the rights to verify the
Kerberos token? Some policy setting that I am missing?

NOTE: As I said the R2 server is also a domain controller. This most likely
complicates the issue, but still - Network Service works, so surely I can
configure my service acocunt to work as well?

Any ideas here?

Thanks,

Niels

[Niels Flensted-Jensen]

Well, just tried on a regular Windows 2003 SP1 - same issue and this one is
not a domain controller.

So, I suppose I'm down to some right that needs to be set.

Here is the full exception dump from my WSE trace:

<soap:Fault>
<faultcode
xmlns:q0="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd">q0:InvalidSecurityToken</faultcode>
<faultstring>Microsoft.Web.Services3.Security.SecurityFault: An
invalid security token was provided ---> System.Security.SecurityException:

WSE594: AcceptSecurityContext call failed with the following error message:
Logon failure: unknown user name or bad password.

.
at
Microsoft.Web.Services3.Security.Tokens.Kerberos.KerberosServerContext.AcceptContext(Byte[] inToken)
at
Microsoft.Web.Services3.Security.Tokens.KerberosToken.InitializeServerContext()
at
Microsoft.Web.Services3.Security.Tokens.KerberosToken.InitializeLifeTime()
at Microsoft.Web.Services3.Security.Tokens.KerberosToken.get_IsCurrent()
at Microsoft.Web.Services3.Security.Security.LoadToken(XmlElement
element, SecurityConfiguration configuration, Int32& tokenCount)
The Zone of the assembly that failed was:
MyComputer
--- End of inner exception stack trace ---
at Microsoft.Web.Services3.Security.Security.LoadToken(XmlElement
element, SecurityConfiguration configuration, Int32& tokenCount)
at Microsoft.Web.Services3.Security.Security.LoadXml(XmlElement element)
at Microsoft.Web.Services3.Security.Security.CreateFrom(SoapEnvelope
envelope, String localActor, String serviceActor)
at
Microsoft.Web.Services3.Security.ReceiveSecurityFilter.ProcessMessage(SoapEnvelope envelope)
at Microsoft.Web.Services3.Pipeline.ProcessInputMessage(SoapEnvelope
envelope)
at Microsoft.Web.Services3.WseProtocol.FilterRequest(SoapEnvelope
requestEnvelope)
at Microsoft.Web.Services3.WseProtocol.RouteRequest(SoapServerMessage
message)
at System.Web.Services.Protocols.SoapServerProtocol.Initialize()
at System.Web.Services.Protocols.ServerProtocolFactory.Create(Type type,
HttpContext context, HttpRequest request, HttpResponse response, Boolean&
abortProcessing)</faultstring>

<faultactor>http://localhost/WSSecurityKerberosPolicy/WSSecurityKerberosService.asmx</faultactor>

</soap:Fault>

[Niels Flensted-Jensen]

Well, as it often goes, time - and your own effort - is on your side. The
issue is caused by missing Service Principal Names on my service account. It
must be set to the same SPN as the computer account which is the account
behind the Default App Pool (Network Service).

So it had nothing to do with the fact that the server runs R2 or is a domain
controller.

Read here to get the full story:
http://msdn.microsoft.com/library/default.asp?url=/library/en-us/dnpag2/html/WSS_Ch7_KerbTechSupp.asp

Niels

[Hung Ngo]

Hi,
I have the same problem with SPN. Although I set the SPN the same computer
account "http/localhost:4115", the error still appear:
"WSE594:InitializeSecurityContext call failed with the following error
message: A specified logon session does not exist. It may already have been
terminated."
Do you have any experience on this error message?
Hung.

[Niels Flensted-Jensen]

Hung,

Have a look in the "Common Error Messages" in the "Troubleshooting WSE
Applications" section in the WSE 3.0 documentation.

Notice though that your SPN seems to be wrong. You need to set it as
described by link I provided (
http://msdn.microsoft.com/library/default.asp?url=/library/en-us/dnpag2/html/WSS_Ch7_KerbTechSupp.asp).
Note that you need to set two SPNs - with and without the domain name. And
to do that you need to install the Windows Support Tools as mentioned in the
article.

Niels