12

I'm working on an WCF-based client/server application (WCF is self-hosted, not in IIS).

The WCF service has an operation to upload a chunk of data to the server. The contract roughly looks like this:

void UploadChunk(int clientId, byte[] chunk);

We are using Windows Authentication (Kerberos/NTLM) so we cannot use streaming here.

The binding looks like this (client- and server-side):

new BasicHttpBinding
{   
   Security = new BasicHttpSecurity
   {
      Mode = BasicHttpSecurityMode.TransportCredentialOnly,
      Transport = { ClientCredentialType = HttpClientCredentialType.Windows },
   },
   MaxReceivedMessageSize = 0x7fffffff,
   ReaderQuotas = { MaxArrayLength = 0x800000 },
};

The client talks to the service via proxy objects derived from System.ServiceModel.ClientBase<TChannel>.

All of this works perfectly fine, but we observed that the WCF client sends each HTTP request twice, once without auth header and once again with the correct auth header. This is problematic because the requests will be pretty big and this behavior causes the request size to be two times the actual chunk size.

I already found out (https://weblog.west-wind.com/posts/2010/Feb/18/NET-WebRequestPreAuthenticate-not-quite-what-it-sounds-like) that setting WebRequest.PreAuthenticate to true remembers the auth header and reuses it for subsequent requests.

However from what I've seen up to now WCF does not expose a mechanism to modify the WebRequest instance.

Is there any solution for this problem`?

7
  • "WCF sends each HTTP request twice" - this is incorrect. WCF is a server-side platform - it doesn't make any requests by itself. What client are you using? If you're using SOAP did you use the Service Reference (aka Service Proxy) or did you write your own client?
    – Dai
    Mar 23, 2016 at 17:57
  • We are deriving from ClientBase<TChannel>. TChannel is the contract interface that we share between client and server assemblies (I edited the question to reflect that) Mar 23, 2016 at 18:01
  • Since it is already Kerberos, collect traces to see what happened under the hood. The response message from the server should tell you why.
    – Lex Li
    Mar 24, 2016 at 11:00
  • The WCF traces do not show duplicated requests, probably because the Kerberos handshake is done by Windows (HTTP.sys) Mar 24, 2016 at 13:15
  • On a side note why do you state that you aren't using streams because you are using Windows Authentication? Windows Authentication is a transport-level security option so it should not inhibit the use of streams. Mar 27, 2016 at 6:38

2 Answers 2

3
+125

For Windows Authentication there will always be a challenge response (401) for your first request .

If you're in control of all clients I think the most practical solution is to implement an operation with a minimal payload.

Operation void IsAuthenticated() should do. For each client proxy instance you would then call IsAuthenticated before UploadChunk.

The IsAuthenticated request would get you over the 401 challenge response without sending the large payload but will authenticate the connection. Subsequent requests for that connection will not be challenged.

Edit :

The behaviour I described seems to only be applicable with IIS 8. So I took a closer look with two http.sys traces, one for an IIS hosted service and one for a self hosted service.

The IIS hosted service seems to utilize some sort of optimization with regards to authentication. The first request for the connection is authenticated using the Authenticator Sspi Authenticator. Subsequent requests are authenticated using the Fast Authenticator.

None of these events are present in the self host trace which leads me to the conclusion that self hosting is not optimized for Windows Authentication.

http.sys - trace IIS

http.sys - trace self host

Then I found this blog entry that proposes a solution using NTLM, a custom binding and the unsafeConnectionNtlmAuthentication setting for the HTTP transport. If you're willing to only use NTLM and the security concerns highlighted in the documentation are not a concern this seems to provide the behaviour you're looking for as per the http.sys trace.

http.sys trace - self host with custom binding

For the server use binding

<customBinding>
    <binding name="myBinding">
      <textMessageEncoding messageVersion="Soap11" />
      <httpTransport authenticationScheme="Ntlm" unsafeConnectionNtlmAuthentication="true"/>
    </binding>
  </customBinding>

For your client you can use a regular basicHttpBinding with Ntlm security:

<basicHttpBinding>
    <binding name="BasicHttpBinding_ITest">
      <security mode="TransportCredentialOnly">
        <transport clientCredentialType="Ntlm" />
      </security>
    </binding>
  </basicHttpBinding>
5
  • We're actually issuing several small (authenticated) requests before the big one. But although the TCP connection keeps alive each and every request is challenged. This is obviously due to the behavior described in weblog.west-wind.com/posts/2010/Feb/18/…. Mar 27, 2016 at 10:25
  • Apologies I didn't see the mention of the self host. I did a bit more digging and I've updated the answer with my findings and a solution. If you're willing to accept the constraints that is. Mar 27, 2016 at 19:05
  • Thanks for the deep analysis. Switching to NTLM (only) is no option for us for security reasons. I'm just wondering which magic happens in IIS that makes it possible there and cannot be done in a self-hosted setup... Mar 28, 2016 at 13:43
  • @FlorianGreinacher if you're using Kerberos or NTLM, why not just NTLM? Are you making use of Constrained Delegation for some consumers of the service? Mar 31, 2016 at 8:12
  • We want to default to Kerberos for security and performance reasons. We're only using impersonation, delegation is not necessary. Mar 31, 2016 at 20:11
0

Use HttWebRequest to call WCF service, creating full SOAP message manually. That will allow to set PreAuthenticate to true. Make first call with no payload, Authenticate(). Then make request with payload.

1
  • That's not an option, we need serialization and error handling/propagation from the WCF client stack Apr 1, 2016 at 19:25

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.