Deploying WCF Service in Windows Service with pipes getting 'System.ServiceModel.Security.SecurityNegotiationException'

Question

We've created a WCF service that is hosted as a Windows Service. Our service is installed with our application on a computer, and it will never be accessed remotely from other clients. So, we've designed it to use named pipes... On our development computer, it works perfectly when we install and run our service and application. However, when we deploy our application and service to a test computer and run it, we get an SecurityNegotiationException, which is due to a call that our application makes to the service when it launches. If I comment out this service call, our application loads and run properly, as long as it doesn't use the service. I've scoured the Internet to see how to resolve this issue, but I couldn't find anything that deals specifically with WCF + Windows Service + named pipes. I really would appreciate your help!

Thanks,

Mike

EXCEPTION

Framework Version: v4.0.30319 Description: The process was terminated due to an unhandled exception. Exception Info: System.ServiceModel.Security.SecurityNegotiationException Stack:

Server stack trace: at System.ServiceModel.Channels.WindowsStreamSecurityUpgradeProvider.WindowsStreamSecurityUpgradeInitiator.OnInitiateUpgrade(Stream stream, SecurityMessageProperty& remoteSecurity) at System.ServiceModel.Channels.StreamSecurityUpgradeInitiatorBase.InitiateUpgrade(Stream stream) at System.ServiceModel.Channels.ConnectionUpgradeHelper.InitiateUpgrade(StreamUpgradeInitiator upgradeInitiator, IConnection& connection, ClientFramingDecoder decoder, IDefaultCommunicationTimeouts defaultTimeouts, TimeoutHelper& timeoutHelper) at System.ServiceModel.Channels.ClientFramingDuplexSessionChannel.SendPreamble(IConnection connection, ArraySegment`1 preamble, TimeoutHelper& timeoutHelper) at System.ServiceModel.Channels.ClientFramingDuplexSessionChannel.DuplexConnectionPoolHelper.AcceptPooledConnection(IConnection connection, TimeoutHelper& timeoutHelper) at System.ServiceModel.Channels.ConnectionPoolHelper.EstablishConnection(TimeSpan timeout) at System.ServiceModel.Channels.ClientFramingDuplexSessionChannel.OnOpen(TimeSpan timeout) at System.ServiceModel.Channels.CommunicationObject.Open(TimeSpan timeout) at System.ServiceModel.Channels.ServiceChannel.OnOpen(TimeSpan timeout) at System.ServiceModel.Channels.CommunicationObject.Open(TimeSpan timeout) at System.ServiceModel.Channels.ServiceChannel.CallOnceManager.CallOnce(TimeSpan timeout, CallOnceManager cascade) at System.ServiceModel.Channels.ServiceChannel.EnsureOpened(TimeSpan timeout) at System.ServiceModel.Channels.ServiceChannel.Call(String action, Boolean oneway, ProxyOperationRuntime operation, Object[] ins, Object[] outs, TimeSpan timeout) at System.ServiceModel.Channels.ServiceChannelProxy.InvokeService(IMethodCallMessage methodCall, ProxyOperationRuntime operation) at System.ServiceModel.Channels.ServiceChannelProxy.Invoke(IMessage message) at ClientSaver.MainForm..ctor() at ClientSaver.Program.Main()

=========================================================

SERVICE'S APP.CONFIG FILE

<system.serviceModel>
    <services>
        <service behaviorConfiguration="" name="ClientSaver.VssService.VssService">
            <endpoint address="Pipe" binding="netNamedPipeBinding"
                bindingConfiguration="" contract="ClientSaver.VssService.IVssService" />
            <host>
                <baseAddresses>
                    <add baseAddress="net.pipe://localhost/VssService/" />
                </baseAddresses>
            </host>
        </service>
    </services>

  <behaviors>
    <serviceBehaviors>
    </serviceBehaviors>
  </behaviors>      
</system.serviceModel>

===========================================================

=== CLIENT'S WCF INFORMATION FROM ITS APP.CONFIG ==

    <bindings>
          <netNamedPipeBinding>
                <binding name="NetNamedPipeBinding_IVssService" closeTimeout="00:01:00"
                      openTimeout="00:01:00" receiveTimeout="00:10:00" sendTimeout="00:01:00"
                      transactionFlow="false" transferMode="Buffered" transactionProtocol="OleTransactions"
                      hostNameComparisonMode="StrongWildcard" maxBufferPoolSize="524288"
                      maxBufferSize="65536" maxConnections="10" maxReceivedMessageSize="65536">
                      <readerQuotas maxDepth="32" maxStringContentLength="8192" maxArrayLength="16384"
                            maxBytesPerRead="4096" maxNameTableCharCount="16384" />
                      <security mode="Transport">
                            <transport protectionLevel="EncryptAndSign" />
                      </security>
                </binding>
          </netNamedPipeBinding>
    </bindings>
    <client>
          <endpoint address="net.pipe://localhost/VssService/Pipe" binding="netNamedPipeBinding"
                bindingConfiguration="NetNamedPipeBinding_IVssService" contract="VssService.IVssService"
                name="NetNamedPipeBinding_IVssService">
                <identity>
                      <servicePrincipalName value="host/DEVPC_W7.aboh.local" />
                </identity>
          </endpoint>
    </client>
    <services>
        <service name="ClientSaver.VssService.VssService">
            <endpoint address="net.pipe://localhost" binding="netNamedPipeBinding"
                bindingConfiguration="" contract="ClientSaver.VssService.IVssService" />

            <endpoint address="http://localhost/VssService/" binding="basicHttpBinding"
                bindingConfiguration="" contract="ClientSaver.VssService.IVssService" />                            
        </service>
    </services>
  <behaviors>
    <serviceBehaviors>
      <behavior name="VssServiceBehavior">
        <serviceMetadata httpGetEnabled="true" policyVersion="Policy15" />
      </behavior>
    </serviceBehaviors>
  </behaviors>      
</system.serviceModel>

Can you please give us the associated error message and the inner exception if any? — Johann Blais
Did you ever get to the bottom of this? I'm having the exact same problem. — KingCronus

Chris Dickson Chris Dickson · Accepted Answer · 2010-11-17T23:41:25

When using the NetNamedPipeBinding, Transport security is configured by default. This causes a security negotiation between the client and service channel stacks when the channel is opened. Your exception is occurring during initiation of this negotiation. (See here for more detail on how this happens.)

Please could you provide details of how your WCF client is configured. The value of the exception's Message property would also be valuable diagnostic information. My guess is that there is some mismatch between the configuration of security on the client side and the default configuration shown for the Service.