"Anthony Yott" wrote:

> Folks,
>
> I'm having an issue calling a .NET 2.0 Web Service using WSE 3.0 with
> Kerberos Policy from an ASP.NET 2.0 Web client on a remote machine (I've
> tried XP and Win 2003). I can call the web service from my local XP SP 2
> machine using a ASP.NET 2.0 client but it does not work if the client ASP.NET
> web site is on another machine. The Web Service is located on a 2003 remote
> machine in the domain as well so it is not located on the same machine as the
> client.
>
> - I've setup a arbitrary SPN with a domain account for the web service and
> the created an app pool to run under this identity.
>
> - On the Client web app I set the targetPrincipal accordingly in the policy
> file
> <kerberos targetPrincipal="SomeWebService/machine.domain.com"
> impersonationLevel="Impersonation" />
>
> - On the 2003 and XP clients web sites Integrated Windows Authentication is
> ON and Anonymous is off
>
> - On the 2003 and XP clients we ARE impersonating <identity
> impersonate="true"/>
>
> Can anyone help with this? I would appreciate any responses.
>
> I've included the error messages for both the XP and Win 2003 clients.
> Again, it works if the client is local but not if the client is on another
> machine.
>
> Thanks,
> Anthony Yott
>
>
> Remote XP Machine in same domain
> ======================================================================
> System.Security.SecurityException: The Kerberos credential handle could not
> be acquired. The AcquireCredentialsHandle call returned the following error
> code: The parameter is incorrect. . at
> Microsoft.Web.Services3.Security.Tokens.Kerberos.KerberosCredential..ctor(CredentialUse
> usage) at
> Microsoft.Web.Services3.Security.Tokens.Kerberos.KerberosClientContext..ctor(String
> targetPrincipalName, Boolean requireMutualAuthentication, ImpersonationLevel
> level) at Microsoft.Web.Services3.Security.Tokens.KerberosToken..ctor(String
> targetPrincipal, ImpersonationLevel level) at
> Microsoft.Web.Services3.Design.KerberosTokenProvider.GetToken() at
> Microsoft.Web.Services3.Design.KerberosAssertion.ClientOutputFilter.SecureMessage(SoapEnvelope
> envelope, Security security, MessageProtectionRequirements request) at
> Microsoft.Web.Services3.Security.SecureConversationClientSendSecurityFilter.SecureMessage(SoapEnvelope
> envelope, Security security) at
> Microsoft.Web.Services3.Security.SendSecurityFilter.ProcessMessage(SoapEnvelope
> envelope) at
> Microsoft.Web.Services3.Pipeline.ProcessOutputMessage(SoapEnvelope envelope)
> at Microsoft.Web.Services3.Xml.SoapEnvelopeWriter.Finish() at
> Microsoft.Web.Services3.Xml.XmlWrappingWriter.Flush() at
> System.Web.Services.Protocols.SoapHttpClientProtocol.Serialize(SoapClientMessage
> message) at
> System.Web.Services.Protocols.SoapHttpClientProtocol.Invoke(String
> methodName, Object[] parameters) at
> Cox.Web.CryptographyManager.CryptoMgmtService.CryptoManagementServiceWse.GetIngrianAccountInformation(String&
> IngrianPassword) in
> C:\Dev\Webservices\zVersions\Cryptography\1.0.0.0\Applications\Web\CryptographyManager\Web
> References\CryptoMgmtService\Reference.cs:line 170 at
> Cox.Web.CryptographyManager.MainForm.loadIngrianSetup() in
> C:\Dev\Webservices\zVersions\Cryptography\1.0.0.0\Applications\Web\CryptographyManager\MainForm.aspx.cs:line
> 397 The Zone of the assembly that failed was: MyComputer
>
> Remote 2003 Machine in same domain
> ========================================================================
> System.Security.SecurityException: The Kerberos credential handle could not
> be acquired. The AcquireCredentialsHandle call returned the following error
> code: A specified logon session does not exist. It may already have been
> terminated. . at
> Microsoft.Web.Services3.Security.Tokens.Kerberos.KerberosCredential..ctor(CredentialUse
> usage) at
> Microsoft.Web.Services3.Security.Tokens.Kerberos.KerberosClientContext..ctor(String
> targetPrincipalName, Boolean requireMutualAuthentication, ImpersonationLevel
> level) at Microsoft.Web.Services3.Security.Tokens.KerberosToken..ctor(String
> targetPrincipal, ImpersonationLevel level) at
> Microsoft.Web.Services3.Design.KerberosTokenProvider.GetToken() at
> Microsoft.Web.Services3.Design.KerberosAssertion.ClientOutputFilter.SecureMessage(SoapEnvelope
> envelope, Security security, MessageProtectionRequirements request) at
> Microsoft.Web.Services3.Security.SecureConversationClientSendSecurityFilter.SecureMessage(SoapEnvelope
> envelope, Security security) at
> Microsoft.Web.Services3.Security.SendSecurityFilter.ProcessMessage(SoapEnvelope
> envelope) at
> Microsoft.Web.Services3.Pipeline.ProcessOutputMessage(SoapEnvelope envelope)
> at Microsoft.Web.Services3.Xml.SoapEnvelopeWriter.Finish() at
> Microsoft.Web.Services3.Xml.XmlWrappingWriter.Flush() at
> System.Web.Services.Protocols.SoapHttpClientProtocol.Serialize(SoapClientMessage
> message) at
> System.Web.Services.Protocols.SoapHttpClientProtocol.Invoke(String
> methodName, Object[] parameters) at
> Cox.Web.CryptographyManager.CryptoMgmtService.CryptoManagementServiceWse.GetIngrianAccountInformation(String&
> IngrianPassword) at Cox.Web.CryptographyManager.MainForm.loadIngrianSetup()