I hope someone here could help me understand whats wrong. I tried to use the NegotiateStream class available in .NET 2.0 to secure a remoting connection. It was configured as follows:
Hashtable channelSettings = new Hashtable();
channelSettings["protectionLevel"] = System.Net.Security.ProtectionLevel.EncryptAndSign;
channelSettings["secure"] = true;
TcpClientChannel channel = new TcpClientChannel(channelSettings, null);
ChannelServices.RegisterChannel(channel);
It all worked fine when the client and server were running on the same machine. It also worked when server process was running on Windows 2003 Server box (with AD but the client machines were not registered in that domain). But when we tried to connect from one workstation to another (both Windows XP Prof.) we got following exception:
The server has rejected the client credentials.
Server stack trace:
at System.Net.Security.NegoState.ProcessAuthentication(LazyAsyncResult lazyResult)
at System.Net.Security.NegotiateStream.AuthenticateAsClient(NetworkCredential credential, String targetName, ProtectionLevel requiredProtectionLevel, TokenImpersonationLevel allowedImpersonationLevel)
at System.Runtime.Remoting.Channels.Tcp.TcpClientTransportSink.CreateAuthenticatedStream(Stream netStream, String machinePortAndSid)
at System.Runtime.Remoting.Channels.Tcp.TcpClientTransportSink.CreateSocketHandler(Socket socket, SocketCache socketCache, String machinePortAndSid)
at System.Runtime.Remoting.Channels.SocketCache.CreateSocketHandler(Socket socket, String machineAndPort)
at System.Runtime.Remoting.Channels.RemoteConnection.CreateNewSocket(EndPoint ipEndPoint)
at System.Runtime.Remoting.Channels.RemoteConnection.CreateNewSocket()
at System.Runtime.Remoting.Channels.SocketCache.GetSocket(String machinePortAndSid, Boolean openNew)
at System.Runtime.Remoting.Channels.Tcp.TcpClientTransportSink.SendRequestWithRetry(IMessage msg, ITransportHeaders requestHeaders, Stream requestStream)
at System.Runtime.Remoting.Channels.Tcp.TcpClientTransportSink.ProcessMessage(IMessage msg, ITransportHeaders requestHeaders, Stream requestStream, ITransportHeaders& responseHeaders, Stream& responseStream)
at System.Runtime.Remoting.Channels.BinaryClientFormatterSink.SyncProcessMessage(IMessage msg)
I couldn't find any other differences between these two setups other that mentioned above so now I wonder what are the requirements to use the Negotiate protocol? As far as I know, it uses the NTLM or Kerberos to authenticate sessions. Therefore, can it run on independent systems or does it always require ActiveDirectory?
Also, can anyone suggest any less demanding alternative to secure a remoting connection?