AJ's blog

August 8, 2010

Silverlight and Integrated Authentication

Filed under: .NET, .NET Framework, ASP.NET, C#, Silverlight, Software Development, WCF — ajdotnet @ 11:25 am

I’ve been meaning to write about this for a while, because it’s a reoccurring nuisance: Using integrated authentication with Silverlight. More to the point, the nuisance is the differences between Cassini (Visual Studio Web Development Server) and IIS in combination with some WCF configuration pitfalls for Silverlight enabled WCF services….

Note: Apart from driving me crazy, I’ve been stumbling over this issue quite a few times in the Silverlight forums. Thus I’m going through this in detail, explaining one or the other seemingly obvious point…

Many ASP.NET LOB applications run on the intranet with Windows integrated authentication (see also here). This way the user is instantly available from HttpContext.User, e.g. for display, and can be subjected to application security via a RoleProvider. Silverlight on the other hand runs on the client. I have written about making the user and his roles available on the client before. However, the more important part is to have this information available in the WCF services serving the data and initiating server side processing. And being WCF, they work a little different from ASP.NET, or not, or only sometimes….

 

Starting with Cassini…

Let’s assume we are developing a Silverlight application, using the defaults, i.e. Cassini, and the templates Visual Studio offers for new items. When a “Silverlight-enabled WCF service” is created, it uses the following settings:

xml_serviceconfig

Now there’s (already) a choice to make: Use ASP.NET compatibility? Or stay WCF only? (That question may be worth a separate post…). With ASP.NET compatibility, HttpContext.* is available within the service, including HttpContext.User. The WCF pendant of the user is OperationContext.Current.ServiceSecurityContext.PrimaryIdentity. Take the following sample implementation to see which information is available during a respective call:

code_service

The client code to test that service is simple as can be:

code_page

The XAML is boilerplate enough, but for the sake of completeness:

xaml_page

I choose compatibility mode, and as the client shows, HttpContext.User is available out of the box:

app_default

Great, just what an ASP.NET developer is used to. But compatibility or not, it also shows that the WCF user is not available. But! WCF is configurable, and all we have to do is set the correct configuration. In this case we have to choose Ntlm as authentication scheme:

xml_serviceconfig_ntlm

And look what we’ve got:

app_with_ntlm

Great, no problem at all. Now we have the baseline and are ready to move on to IIS.

 

Now for IIS…

Moving to IIS on the developer machine is simple. Just go to the web project settings, tab “Web”, choose “Use Local IIS Web Server”, optionally creating the respective virtual directory from here. In order to work against IIS, Visual Studio needs to run with administrative permissions.

vs_projectconfig

 

Moving from Cassini to IIS however has a slew of additional pitfalls:

  • The service URL
  • The IIS configuration for authentication
  • WCF service activation issues
  • The WCF authentication scheme
  • localhost vs. machine name

Usually they show up as team (which obviously doesn’t help), but let’s look at them one by one.

 

The service URL

There’s one difference between how Cassini and IIS are being addressed by the web project: Projects usually run in Cassini in the root (i.e. localhost:12345/default.aspx), while in IIS they run in a virtual directory (e.g. localhost/MyApplication/default.aspx). This may affect you whenever you are dealing with absolute and relative URLs. It will at least cause the generated service URLs to differ more than just by the port information. Of course you can recreate the service references at that point, but you don’t want to do that every time you switch between Cassini and IIS, do you?

BTW: There’s a similar issue if you are running against IIS, using localhost, and you create a service reference: This may write the machine name into the ServiceReferences.ClientConfig (depending on the proxy configuration), e.g. mymachine.networkname.com/application, rather than localhost. While these are semantically the same URLs, for Silverlight is qualifies as a cross domain call. Consequently it will look for a clientaccesspolicy.xml file which is probably not there and react with a respective security exception.

The solution with Silverlight 3 is to dynamically adjust the endpoint of the client proxy in your code to point to the service within the web, the Silverlight application was started from:

code_adjusturl

Silverlight 4 supports relative URLs out of the box:

xml_clientconfig

Coming versions of the tooling will probably generate relative URLs in the first place; until then you’ll have to remember to adjust them every time you add or update a service reference.

 

The IIS configuration for authentication

This one may be obvious, but in combination with others, it may still bite you. Initially starting the application will result in the notorious NotFound exception:

app_error

Note: To be able to handle server exceptions in Silverlight you’ll have to overcome some IE plugin limitations, inhibiting access to http response 500. This can be achieved via a behavior, as described on MSDN. However this addresses exceptions thrown by the service implementation and won’t help in the infrastructure related errors I’m talking about here.

The eventlog actually contains the necessary information:

el_require_wa

No windows authentication? Well, while Cassini automatically runs in the context of the current user, IIS needs explicitly being told that Windows Authentication is required. This is simple in IIS configuration, just enable Windows Authentication and disable Anonymous Authentication in the IIS configuration for the respective virtual directory.

 

WCF service activation issues

Running again will apparently not have changed anything at all, displaying the same error. With just a seemingly minor difference in the eventlog entry:

el_require_aa

That’s right. The service demands to run anonymous after it just demanded to run authenticated. Call it schizophrenic.

To make a long story short, our service has two endpoints with conflicting demands: The regular service endpoint requires Windows Authentication, while the “mex” endpoint for service meta information requires Anonymous access. OK, we might re-enable anonymous access, but that wasn’t indented, so the way to work around this activation issue is to keep anonymous access disabled and to remove the “mex” endpoint from the web.config:

xml_serviceconfig_nomex

Curiously generating the service reference still works in Visual Studio (perhaps with login dialogs, but still)…

 

The WCF authentication scheme

We’re still not there. The next issue when running the application might be a login credentials dialog when the service is called. And no matter what you type in, it still won’t work anyway, again with the NotFound exception. Unfortunately this time without an eventlog entry.

Again, to make it short, IIS doesn’t support Ntlm as authentication scheme, we need to switch to Negotiate… .

xml_serviceconfig_negotiate

And now it works:

app_with_negotiate

Do I have to say that this configuration doesn’t run in Cassini? Right, every time you switch between IIS and Cassini you have to remember to adjust the configuration. There is another enumeration value for the authentication scheme, named IntegratedWindowsAuthentication, which would be nice – if it worked. Unfortunately those two values, Ntlm and Negotiate, are the only ones that work, under Cassini and IIS respectively.

 

localhost vs. machine name

Now it works, we get the user information as needed. For a complete picture however, we need to look at the difference between addressing the local web server via localhost or via the machine name: Calls against localhost are optimized by the operating system to bypass some of the network protocol stack and work directly against the kernel mode driver (HTTP.SYS). This affects caching as well as http sniffers like Fiddler, which both work only via the machine name.

Note: This may actually be the very reason to switch to IIS early during development, when you need Fiddler as debugger (to check the actually exchanged information). Otherwise it’s later on, when you need it as profiler (to measure network utilization). Of course you’ll want http caching enabled and working by that time.

Of course you can put the machine name in the project settings, yet this would affect all team members. Perhaps a better idea is to have the page redirect dynamically:

code_redirect

Another word on caching: In IIS6 caching has to be explicitly set for the .xap file, using 1 day as default cache time and allowing 1 minute at the minimum. During development this may be an issue. With IIS7 caching should be automatically set to CacheUntilChange and you may also set the cache time with a resolution in seconds.

 

Where are we?

OK, that was quite a list of pitfalls and differences between Cassini and IIS, even IIS6 and IIS7. Some of this may go away with the new IIS Express. Some will stay and remain a nuisance. Visual Studio initially guides you towards using Cassini. At one time however you’ll have to switch to IIS. And since you cannot have both at the same time, this may be an issue especially in development teams. My recommendation would be: Start with IIS right away or plan the switch as a concerted action within your team.

That’s all for now folks,
AJ.NET

kick it on DotNetKicks.com

About these ads

14 Comments »

  1. Good one, AJ!

    I don’t do much Frontend as you know, but I stumbled upon these problems more than once already.

    Comment by DanielT — August 9, 2010 @ 10:10 am

  2. U R Awesome! First comprehensive guide to WCF in IIS7 I’ve found on the web. The key is “IIS doesn’t support Ntlm as authentication scheme, we need to switch to Negotiate…”!!! Can’t believe this isn’t better documented. Anyways, many thanks!

    Comment by GH — August 9, 2010 @ 7:41 pm

  3. I can get this when run localhost, but fail when run from other machine
    System.DirectoryServices.AccountManagement.UserPrincipal.Current.Name

    The question is how to make the impersonation work for querying Active directory using the impersonated credential?

    Comment by byunru — August 30, 2010 @ 10:36 pm

  4. The ASP.NET providers should give you the information you need; infos from AD here for example: http://msdn.microsoft.com/en-us/library/system.web.security.activedirectorymembershipprovider.aspx

    If you still need to query AD for some reason, you need of course to make sure the current user (and if you use impersonation that means every user) has permissions, or provide username/password from your configuration: http://msdn.microsoft.com/en-us/library/bb356158.aspx

    Comment by ajdotnet — August 31, 2010 @ 7:06 am

    • The following method will always return a correct AD user alias name both localhost or run from
      other machine, but when I try to get full name by using “System.DirectoryServices.AccountManagement.UserPrincipal.Current.Name”
      only work in localhost, not from other machine.

      [OperationBehavior(Impersonation = ImpersonationOption.Required)]
      public string GetWindowsUsername()
      {
      return = ServiceSecurityContext.Current.WindowsIdentity.Name;
      //return System.DirectoryServices.AccountManagement.UserPrincipal.Current.Name;
      }

      the error message is:
      =======================================================================================
      System.Runtime.InteropServices.COMException occurred
      Message=An operations error occurred.

      Source=System.DirectoryServices
      ErrorCode=-2147016672
      StackTrace:
      at System.DirectoryServices.DirectoryEntry.Bind(Boolean throwIfFail)
      at System.DirectoryServices.DirectoryEntry.Bind()
      at System.DirectoryServices.DirectoryEntry.get_AdsObject()
      at System.DirectoryServices.PropertyValueCollection.PopulateList()
      at System.DirectoryServices.PropertyValueCollection..ctor(DirectoryEntry entry, String propertyName)
      at System.DirectoryServices.PropertyCollection.get_Item(String propertyName)
      at System.DirectoryServices.AccountManagement.PrincipalContext.DoLDAPDirectoryInitNoContainer()
      at System.DirectoryServices.AccountManagement.PrincipalContext.DoDomainInit()
      at System.DirectoryServices.AccountManagement.PrincipalContext.Initialize()
      at System.DirectoryServices.AccountManagement.PrincipalContext.get_QueryCtx()
      at System.DirectoryServices.AccountManagement.Principal.FindByIdentityWithTypeHelper(PrincipalContext context, Type principalType, Nullable`1 identityType, String identityValue, DateTime refDate)
      at System.DirectoryServices.AccountManagement.Principal.FindByIdentityWithType(PrincipalContext context, Type principalType, IdentityType identityType, String identityValue)
      at System.DirectoryServices.AccountManagement.UserPrincipal.FindByIdentity(PrincipalContext context, IdentityType identityType, String identityValue)
      at System.DirectoryServices.AccountManagement.UserPrincipal.get_Current()
      ================================================

      it seems the problem related to partial trust assembly policy, and
      will it has anything to do with the Security Changes in the .NET Framework 4 ?
      http://msdn.microsoft.com/en-us/library/dd233103.aspx

      Comment by byunru — August 31, 2010 @ 9:04 pm

      • Sorry, I haven’t touched that area yet, so I cannot offer better help. Perhaps try to run the same code from a regular exe to see if it works with full trust, and check the eventlogs.

        Comment by ajdotnet — September 1, 2010 @ 6:44 am

  5. Very good!! Thanks a lot!

    Comment by Maxime — February 9, 2011 @ 12:36 pm

  6. hey man,
    this was a very great post. it helped me a lot. The only problem i’m facing is, this code works on the local iis deployed on my machine. however, as soon as i publish the exact same code to IIS on my web server, authenticate ceases when i hit the site from another machine. it’s very frustrating! ugh, hope you can help me some how :(

    Comment by noah — February 13, 2011 @ 3:05 am

  7. @Noah: Glad I could help.
    Your problem sounds a lot like some IIS configuration or network related issue. I would check if the other IIS is configured correctly:
    - Windows authentication on (in IIS7 you may need to install the respective module)
    - Anonymous authentication off.
    And whether the access is possible:
    - Does the IIS even belong to the domain, so it actually can support windows authenication at all?
    - Do the IIS logs or the Event Log give any indication?

    (Hint: A simple ASP.NET page displaying the current user should be a sufficient test case, no need to go thought SL.)

    If all that works, I’d employ Fiddler to check for other issues:
    - Do the calls go out to the correct web address?
    - Is there some notwork related error, some redirect or other involved?

    Once you have a lead on the cause you can move on. (Getting that lead is usually the hard part.)

    Comment by ajdotnet — February 13, 2011 @ 12:24 pm

  8. i see this error when click on Load button :

    An error occurred while trying to make a request to URI ‘http://localhost:8747/UserService.svc’. This could be due to attempting to access a service in a cross-domain way without a proper cross-domain policy in place, or a policy that is unsuitable for SOAP services. You may need to contact the owner of the service to publish a cross-domain policy file and to ensure it allows SOAP-related HTTP headers to be sent. This error may also be caused by using internal types in the web service proxy without using the InternalsVisibleToAttribute attribute. Please see the inner exception for more details.

    inner exception:
    [Arg_SecurityException]
    Arguments:
    Debugging resource strings are unavailable. Often the key and arguments provide sufficient information to diagnose the problem. See http://go.microsoft.com/fwlink/?linkid=106663&Version=5.0.60401.00&File=mscorlib.dll&Key=Arg_SecurityException

    Comment by Parsa — August 28, 2011 @ 9:36 am

  9. @Parsa: Not sure, what your question is…
    Are you making a cross domain call? Is this the issue with relative URLs?

    Comment by ajdotnet — August 28, 2011 @ 5:18 pm

  10. Wowwwww…………….. Thanks man!!!!!!!!!!

    It was very useful for me…..

    Comment by senraj — June 27, 2012 @ 12:09 pm

  11. Thank you!!!! I struggled with this for weeks until I found your article. Your step-by-step approach finally made it understandable.

    Comment by Greg Lindberg — January 27, 2013 @ 7:12 pm

  12. Outstanding…..its very helpful

    Comment by Sandeep — June 12, 2013 @ 5:08 pm


RSS feed for comments on this post. TrackBack URI

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s

The Shocking Blue Green Theme Blog at WordPress.com.

Follow

Get every new post delivered to your Inbox.

Join 244 other followers

%d bloggers like this: