WCF Security Issue - The target principal name is incorrect

My WCF service was working when testing on my laptop. After deploying to a dev environment where the client/caller and server/WCF were on different machines, I got this error:

System.ServiceModel.Security.SecurityNegotiationException: A call to SSPI failed...System.ComponentModel.Win32Exception: The target principal name is incorrect

My situation is this:

Client (AD user) -> WCF Service (AD service account)

First, the solution. Two options:

1. Instead of using the AD service account, use the Network Service account
2. On the client, specify a dummy SPN

Why do these things work? Another blog post explained the situation nicely.

For option #1, the Network Service account has access to the host machine SPN. Because of this, Kerberos authentication can be used. When the AD service account is used (like my scenario), it doesn't have access to the host machine SPN, so Kerberos fails and we get the SSPI exception.

For option #2, if a dummy SPN is used, Kerberos authentication will fail, however in this case authentication will fall back to NTLM and succeed.

An example client config section, using identity, is shown here:

<identity>  <servicePrincipalName value="MySystem/Service1"/></identity>

It can also be done programmatically (second line):

var uri = new Uri(ConfigurationManager.AppSettings["serviceAddress"]);var endpointIdentity = EndpointIdentity.CreateSpnIdentity("");var endpointAddress = new EndpointAddress(uri, endpointIdentity);return _channelFactory.CreateChannel(endpointAddress);

If the client doesn't explicitly specify an identity, WCF will automatically create an identity using the host name in the Uri. If we are calling net.tcp://remotemachine1:port/MyService, the WCF client will use the machine name as the SPN, like this:

EndpointIdentity.CreateSpnIdentity("remotemachine1")

That's what will be used to call the service. When this happens, Kerberos authentication will fail, WCF will not fall back to NTLM, and we get the exception.

Finding the Root Cause of WCF Exceptions

When setting up a WCF service, calls can fail for many reasons. The frustrating part is that we typically get a generic error:

The socket connection was aborted. This could be caused by an error processing your message or a receive timeout being exceeded by the remote host, or an underlying network resource issue. Local socket timeout was '00:00:59.8380000'.

In order to find out exactly what was wrong, simply configure tracing, by placing this in the config file of the WCF service:

  <system.diagnostics>
    <sources>
      <source name="System.ServiceModel"
              switchValue="Information, ActivityTracing"
              propagateActivity="true">
        <listeners>
          <add name="traceListener"
              type="System.Diagnostics.XmlWriterTraceListener"
              initializeData= "c:\temp\Traces.svclog" />
        </listeners>
      </source>
    </sources>
  </system.diagnostics>

Note: The above configuration is from http://msdn.microsoft.com/en-us/library/ms733025.aspx.

After trying the WCF call again, open Traces.svclog and find the activity in red:

After clicking on the activity, click on the description/error in the right window pane:

The bottom pane will show you exactly what's wrong:

Books I've Read - Software

There are 89 books listed below. Out of those 89, I have chosen the five that have had the most influence on my career, and that I consider the best of them all. These are in no particular order.

My Top 5

1. Agile Principles, Patterns, and Practices in C# [Martin]
2. Head First Design Patterns [Freeman, et al.]
3. Peopleware: Productive Projects and Teams [DeMarco, Lister]
4. Joel on Software [Spolsky]
5. The Mythical Man-Month [Brooks]


C#/.NET

1. Programming C# 5.0 [Griffiths]
2. C# in Depth [Skeet]
3. Programming .NET Components [Lowy]
4. Framework Design Guidelines: Conventions, Idioms, and Patterns for Reusable .NET Libraries [Cwalina, Abrams]
5. Effective C#: 50 Specific Ways to Improve Your C# [Wagner]
6. C# Cookbook, 2nd Edition [Hilyard, Teilhet]
7. Introducing .NET 4.0: With Visual Studio 2010 [Mackey]
8. CLR via C#, Third Edition [Richter]
9. Expert C# 2008 Business Objects [Lhotka]
10. Programming .NET 3.5 [Liberty, Horovitz]
11. Essential Windows Communication Foundation (WCF): For .NET Framework 3.5 [Resnick, et al.]
12. MSDN (magazine) - many

Design/Practices

1. The Mythical Man-Month [Brooks]
2. Agile Principles, Patterns, and Practices in C# [Martin]
3. Design Patterns [Gamma, et al.]
4. Head First Design Patterns [Freeman, et al.]
5. Clean Code: A Handbook of Agile Software Craftsmanship [Martin]
6. The Pragmatic Programmer: From Journeyman to Master [Hunt]
7. Refactoring: Improving the Design of Existing Code [Fowler, et al.]
8. Code Complete: A Practical Handbook of Software Construction [McConnell]
9. Applying UML and Patterns [Larman]
10. Software Engineering: A Practitioner's Approach [Pressman]
11. UML Distilled [Fowler]
12. Pragmatic Unit Testing in C# with NUnit [Hunt, Thomas]
13. Practices of an Agile Developer: Working in the Real World [Subramaniam]
14. Head First Object-Oriented Analysis and Design [McLaughlin, et al.]
15. Data Modeling Essentials, Third Edition [Simsion, Witt]
16. The Object-Oriented Thought Process [Weisfeld]

Architecture

1. Patterns of Enterprise Application Architecture [Fowler]
2. Enterprise Integration Patterns: Designing, Building, and Deploying Messaging Solutions [Hohpe, Woolf]
3. Service Design Patterns: Fundamental Design Solutions for SOAP/WSDL and RESTful Web Services [Daigneau]
4. Microsoft® Application Architecture Guide
5. Microsoft® .NET: Architecting Applications for the Enterprise [Esposito]
6. The Process of Software Architecting [Eeles, Cripps]
7. REST in Practice: Hypermedia and Systems Architecture [Webber, et al.]

Web

1. JavaScript and jQuery [McFarland]
2. Programming ASP.NET MVC 4 [Chadwick, et al.]
3. HTML5 and CSS3 [Castro]
4. HTML5: The Missing Manual [MacDonald]
5. Silverlight 4 in Action [Brown]
6. Head First Ajax [Riordan]
7. Programming ASP.NET [Liberty, Hurwitz]

Leadership/Project Management

1. Agile Project Management with Scrum [Schwaber]
2. Succeeding with Agile: Software Development Using Scrum [Cohn]
3. The Five Dysfunctions of a Team: A Leadership Fable [Lencioni]
4. Leadership: Enhancing the Lessons of Experience [Ginnett, et al.]
5. The Leadership Challenge [Kouzes, Posner]
6. A Guide to the Project Management Body of Knowledge, Third Edition [PMI]
7. Project Management: A Systems Approach to Planning, Scheduling, and Controlling [Kerzner]
8. The Power of IT: Survival Guide for the CIO [De Sutter]
9. Ship it! A Practical Guide to Successful Software Projects [Richardson, Gwaltney]
10. Creating a Software Engineering Culture [Wiegers]
11. Peopleware: Productive Projects and Teams [DeMarco, Lister]
12. The Project Manager's MBA: How to Translate Project Decisions into Business Success [Cohen, Graham]
13. Adventures of an IT Leader [Austin, et al.]
14. What Got You Here Won't Get You There: How Successful People Become Even More Successful [Goldsmith, Reiter]
15. Manage It!: Your Guide to Modern, Pragmatic Project Management [Rothman]
16. CIO Survival Guide: The Roles and Responsibilities of the Chief Information Officer [Schubert]
17. The First 90 Days: Critical Success Strategies for New Leaders at All Levels [Watkins]
18. Harvard Business Review (magazine) - many
19. Introduction to Information Systems Project Management [Olson]
20. Earned Value Project Management [Fleming]
21. Applied Software Project Management [Stellman, Greene]
22. Introduction to Project Management [Schwalbe]

Other/Advice/Culture

1. Big Ball of Mud [Foote, Yoder]
2. Building Windows 8 Apps with JavaScript [Sells, Satrom]
3. Building Windows 8 Apps with C# and XAML [Likness]
4. C Programming Language [Kernighan, Ritchie]
5. WPF 4 Unleashed [Nathan]
6. Programming Entity Framework: Code First [Lerman, Miller]
7. Joel on Software [Spolsky]
8. More Joel on Software [Spolsky]
9. The Best Software Writing I [Spolsky]
10. Programming Language Pragmatics, Third Edition [Scott]
11. Data Communications and Computer Networks: A Business User's Approach [White]
12. Manufacturing Execution Systems (MES): Optimal Design, Planning, and Deployment [Meyer, et al.]
13. Workflow Modeling [Sharp]
14. The Data Warehouse Lifecycle Toolkit [Kimball]
15. Computer Networks, Third Edition: A Systems Approach [Peterson, Davie]
16. Statistics for Business and Economics, 6th Edition [Anderson, et al.]
17. Information Nation: Seven Keys to Information Management Compliance [Kahn, Blair]
18. Who: The A Method for Hiring [Smart, Street]
19. The Guru's Guide to Transact-SQL [Henderson, Celko]
20. Computing Concepts with Java 2 Essentials [Horstmann]

Linux

1. Understanding UNIX/LINUX Programming: A Guide to Theory and Practice [Molay]
2. Linux in a Nutshell [Siever, et al.]
3. Knoppix Hacks [Rankin]
4. Linux Server Hacks: 100 Industrial-Strength Tips and Tools [Flickenger]
5. Red Hat RPM Guide [Foster-Johnson]

An Implementation of the Dispose() Pattern - For Reference

Awesome SO answer on proper use of IDisposable here.

The Bad Code Problem - The Smooth-talking Garbage Guy

I think there is a major, fundamental problem in the software development industry. And it's a difficult, tricky problem to solve. That problem is managers hiring developers that write truly poor code, not knowing it, and letting them run amok, and even letting them guide other developers and teams.

The root of the issue is management not knowing the true quality of the programmers they hire. It's all too easy for a smooth-talking developer (that actually writes garbage code, hence smooth-talking garbage guy) to make himself look like the right answer in front of a manager that can't refute anything he says. It's especially more problematic when not examining a developer's code before a manager hires the developer. And even worse if a manager looks at the code and doesn't truly know if it's good code.

The problem is further compounded when misled manager guy (MMG) touts his developer to others within the organization. And to make matters even worse, the root of all evil in a company, the BOYM (bend over yes men) who are afraid to do or say anything about it.

Developers (and somewhat decent developers) can sometimes be awed by this STGG. I think I know why now. His systems are complex balls of mud, yet he can explain things in a way that can seem to make sense. Only through seeing through the bullshit, and going back to the basics of simple, clean, and elegant code, can you truly appreciate STGG for what he has built: an ugly system because he doesn't know how to do otherwise.

Good systems, regardless of architecture, have code that is simple, clean, and elegant. Period. A system with an awesome architecture, backed by terrible code, is a terrible system.

Bringing in a new developer, or architect, that knows how to do things better than the way things are currently being done, won't change things. At least not anytime soon. The system is the system, and the folks left to deal with it are constrained by it. In time, these new resources will look bad because they'll be associated with the current crop of problems. This is exasperating, especially if STGG has moved on/up to other departments.

How is this fixed? In enlightened companies this isn't even a problem. Software development is valued as a first-class citizen, and top-notch developers tend to run things. In unenlightened companies, it's almost impossible. The only thing I can think of is to hire an outside firm to do an objective analysis of the system. This can be expensive (although much, much less expensive than the hidden cost of not doing it at all), and since the system "works," nothing is usually done.

How do we stop this from happening?

Inspecting Browser Requests and Server Responses with Fiddler

With Fiddler, not only can you inspect the browser requests, and the server responses, but you can alter them.

Note: To filter the traffic to only localhost, so Fiddler ignores other requests, do this (you need to click in the window on the left to get this to save):

In order to intercept a browser request to the server, turn on automatic breakpoints in Fiddler:

Note: You may not want to set automatic breakpoints until just before the actual request is sent. Otherwise, Fiddler will start breaking on all requests.

Make sure Fiddler is set to capture traffic:

Initiate a request. In this scenario, I'm running an app from Visual Studio and eventually hitting a save button, on a web page, to submit a request to the server. When I click the save button, Fiddler will break on the request. You can click on the request to view the data being sent.

This is what you'll see in the right pane of Fiddler:

In the above image, the top pane is the request details, and the bottom pane is the response details.

Connecting SSMS to SQL Azure

When using SSMS to connect to a SQL Azure DB, some typical ways of connecting simply don't work.

Note: I believe I had this issue because I wasn't using SQL Server 2008 R2. That appears to be necessary for the normal login dialogs, and object explorer, to work.

The first issue is the connection dialog box. When you enter your information and hit connect:

You get this:

The way around this is to cancel the connection dialog and click the New Query button, in SSMS, even though you're not yet connected:

The same dialog box will come up, but this time you'll be able to connect. HOWEVER, when you try to select your DB:

You'll get this error:

Note: The USE statement won't work either.

To change the DB, do this:

You'll be presented with the same connect dialog as earlier. This time, click Options:

Select your DB here:

Now you're connected!

Note: You can select the DB, within options, when you first connected, after clicking New Query.