Kerberos Adventures

Kerberos Adventures - Lessons Learned

michael stephenson — Sat, 10 Feb 2007 00:31:00 GMT

The security stuff is pretty much complete so here are some random thoughts after this experience which might be useful to anyone else.

Article	Description
POC Overview	Details about the different proof of concepts we did to validate all of the different scenarios we require.
Useful Links	Some links to articles and blogs which will provide useful background information
Useful Tools	Links to tools which were useful to help troubleshooting this implementation
Problems - Error Consuming a service from an XP Client on service pack 2	Details of the problem and how we solved it
Problems - Credentials not delegated the User is null	We had some problems in delegation and this describes the problem and how it was solved
Problems - The handle for the current process could not be retrieved	This was an error we had with a BizTalk web service exposed using the WSE 2 adapter
Lessons Learned	Some review thoughts about this project and what could have made things easier or better

(Click on the article title to link to the page)

Kerberos Adventures - Problem: Exposing an Orchestration from BizTalk with the WSE 2 Adapter and using Kerberos

michael stephenson — Wed, 07 Feb 2007 04:15:00 GMT

Scenario

I was trying to implement the requirement to use Kerberos to sign and encrypt the messages to and from a web service which was generated using the WSE 2 Web Service Publishing Wizard to expose a BizTalk Orchestration as a web service.

Problem

I had this all setup as I expected to work. The SPN and everything seemed correct but when I called it I kept getting the following error message:

System.Web.Services.Protocols.SoapHeaderException: Server unavailable, please try later ---> System.Security.SecurityException: The Kerberos credential handle could not be acquired. The AcquireCredentialsHandle call returned the following error code: A specified logon session does not exist. It may already have been terminated.

at Microsoft.Web.Services2.Security.Tokens.Kerberos.KerberosCredential..ctor(CredentialUse usage)

at Microsoft.Web.Services2.Security.Tokens.Kerberos.KerberosServerContext.AcceptContext(Byte[] inToken, AscReq flags)

at Microsoft.Web.Services2.Security.Tokens.Kerberos.KerberosServerContext..ctor(Byte[] inToken, AscReq flags)

at Microsoft.Web.Services2.Security.Tokens.KerberosToken2.InitializeLifeTime()

at Microsoft.Web.Services2.Security.Tokens.KerberosToken2.get_IsCurrent()

at Microsoft.Web.Services2.Security.Security.LoadToken(XmlElement element, SecurityConfiguration configuration, Int32& tokenCount)

at Microsoft.Web.Services2.Security.Security.LoadXml(XmlElement element)

at Microsoft.Web.Services2.Security.SecurityInputFilter.ProcessMessage(SoapEnvelope envelope)

at Microsoft.Web.Services2.Pipeline.ProcessInputMessage(SoapEnvelope envelope)

at Microsoft.Web.Services2.Messaging.SoapReceiver.FilterMessage(SoapEnvelope envelope)

at Microsoft.Web.Services2.Messaging.SoapReceiver.ProcessMessage(SoapEnvelope message)

The Zone of the assembly that failed was:

MyComputer

--- End of inner exception stack trace ---

I spend a lot of time working with Microsoft to resolve this problem and we had validated all settings and went through various troubleshooting procedures to no avail.

Solution

Microsoft had a version of this scenario working in a lab and when trying to compare what they did against what I was doing we eventually found the cause of the problem.

Im not fully sure why this was the cause of the problem as I didn’t expect it to even come into play but basically if the IIS Anonymous User for the virtual directory is set as a local user then you get the error above. If you change this to a domain user then it seems to work fine. In my case I had set it to the domain user who was running the application pool and was also the credential for the BizTalk Isolated Host.

The following picture shows the settings that did not work.

The following picture shows the settings that work fine.

If I change it back it doesn’t work again.

An interesting point on this is in the sample we were running here we also had a C# hello world web service which sat in the same project as the BizTalk one. We were calling the C# one first to test that before calling the BizTalk one. Calls to the C# web service were not affected by the change of the anonymous user.

Summary

In summary I believe the following

1. In order to use Kerberos, WSE and a normal C# web service the anonymous user account doesn’t matter. This just worked as it had all along once we got the SPN's correct.

2. For BizTalk to work with WSE AND Kerberos the anonymous user needs to be set as a domain user, in this case it is the same user that is also running the application pool and also the Biztalk isolated host so not sure if a standarrd domain user would be sufficient or if it has to be the same as the app pool and host but I think it is probably a good idea to make them so for consistency.

Acknowledgements

I would like to thank the following people at Microsoft who helped me resolve this issue:

Michael Koppenol
Jean Severino

Kerberos Adventures - Problem: 401 Unauthorised - User equals null

michael stephenson — Wed, 07 Feb 2007 04:07:00 GMT

Scenario

We were trying to implement a delegation scenario similar to the one in the POC (Web Services using Delegation). While implementing this we came across the problem where we seemed to not be passing the clients credentials. We constantly got the IIS 401 Unauthorized return code.

Symptoms

In this example we got some of the following symptoms:

In the IIS Log of the back end service there would be no credential specified.
When calling the back end service locally on the machine where it sits it seemed to work but not when called from another machine.

Troubleshooting Tips

I found that the easiest way to help get this right was to firstly focus on getting the IIS and AD setup correct before starting to use your code. I placed a simple asp page in the backend servers virtual directory and wanted to browse to that from the other machine. Doing this would show I could delegate my credentials fine from one machine to another.

Solution

The problem was caused because I did not have this setup correctly in AD and IIS. Basically I had the application pool running as a Network Service local account. To get this working I took the following steps.

Have a domain account which you plan to run the IIS Application Pool as. This will need to be in groups such as IIS_WPG
Register the SPN for the HTTP service on the back end server against the domain account which will be running the back end application pool.

(Eg: SetSpn -a HTTP/<MachineName> <Service User> ).

In AD setup delegation for the service user running your middle tier application pool to be able to delegate to the SPN you have previously setup.

The following diagram shows where these changes relate to the architecture:

Points To Notes

The following are a couple of points to note incase they are not explained clearly enough above:

The network service account worked okay when you are calling on the same box but when we were delegating across machines the back end service needs to run in an application pool with runs as a domain account
When registering the SPN it is the HTTP service and should be registered against the domain account not the machine object in AD.

Kerberos Adventures - Problem: Error consuming web service from Windows XP SP2 client

michael stephenson — Wed, 07 Feb 2007 04:04:00 GMT

Scenario

We have a windows XP Client which is calling a .net 2 Web Service which uses WSE 2.0 SP3 on a remote Windows 2003 Server. When we make the call we get the following error message:

"System.ApplicationException: InitializeSecurityContext call failed with the following error message: A specified logon session does not exist. It may already have been terminated."

We only get this message when calling our web service from a client running Windows XP Service Pack 2.

Symptoms

You will get the following message in the event log.

The Security System could not establish a secured connection with the server ldap/<DomainController>.<Domain>/<Domain>. No authentication protocol was available.
When a windows 2003 client is used to make the same call it works fine.
We had other projects doing the same thing which were working okay. These other projects were using the same build of XP Client

Work Around

There is a workaround to this problem, when you log off and back on everything starts working again.

Solution

The following article describes more on this problem, there is also a hot fix which has been used by some of our developers. This seems to have stopped their problem.

http://support.microsoft.com/kb/885887

Kerberos Adventures - Overview

michael stephenson — Tue, 06 Feb 2007 03:38:00 GMT

This post will provide an overview of the planned proof of concepts we have been working on to try and get this right. In this series of posts I intend to provide a step by step guide for setting up each of these scenarios. Or if there is a sufficient walk through already available I will point you to that. The proof of concepts I intend to cover are:

Web Services secured with Kerberos

This proof of concept aims to show we can create web services which can be secured with a Kerberos token.

Web Services using Delegation

This proof of concept aims to show we can create a web service which can delegate the clients credentials to access backend services under the context of the client. The following diagram shows how this will look.

BizTalk Signing and Encryption with Kerberos

This proof of concept aims to show we can use the WSE Adapter to call and expose services which are secured using Kerberos. The following diagram shows how this is intended to look.

BizTalk Credential Delegation

This proof of concept aims to show we can flow credentials through BizTalk and call back end services under the context of the calling client. The following diagram shows how this is intended to look.

Proof Of Concept Summary

In the proof of concepts we need to be able to do the following set of things:

Send a request to a WSE web service which is signed and encrypted with a KerberosToken2

Receive a response from a WSE web service which is signed as encrypted with a KerberosToken2

Use delegation and KerberosToken2 to pass credentials from a client to a WSE web service and then forward them to another WSE web service where the back end service will impersonate the client

Use delegation and KerberosToken2 to pass credentials from a client to a WSE web service and then forward to a web service secured with IIS Windows Integrated Security

Send a request to a BizTalk WSE web service which is signed and encrypted with a KerberosToken2

Receive a response from a BizTalk WSE web service which is signed as encrypted with a KerberosToken2

Use delegation and KerberosToken2 to pass credentials from a client to a BizTalk WSE web service and then route through BizTalk and finally forward them to another WSE web service where the back end service will impersonate the client

Use delegation and KerberosToken2 to pass credentials from a client to a BizTalk WSE web service and then route through BizTalk and finally forward to a web service secured with IIS Windows Integrated Security

Send a request to and get a response from a WSE Web Service using the BizTalk WSE 2 adapter to sign and encrypt a message with a KerberosToken2

Kerberos Adventures - Useful Tools

michael stephenson — Fri, 02 Feb 2007 18:46:00 GMT

The following tools proved useful in diagnosing problems with this

Tool	Description	Link
KerbTray		http://support.microsoft.com/kb/326985
Windows 2003 Support Tools	Contains the tool SETSPN which you need to register an SPN.	Located on windows 2003 disk or at the following url: http://support.microsoft.com/kb/892777
WSE Trace Tool	Provides a tool to look over the WSE Trace output files	http://www.gotdotnet.com/workspaces/workspace.aspx?id=ab938e2f-cabf-4145-b0e9-dbeeaf51dbe5

Kerberos Adventures - Useful Information Links

michael stephenson — Fri, 02 Feb 2007 18:40:00 GMT

This post will list some of the sources of information I have found useful during my "Kerberos Adventures"

Recommended Reading

To help you get up to speed quickly I would recommend checking out the following resources. There are additional resources below.

Kerberos Delegation Troubleshooting Guide

Pretty much walks you through all of setting up a delegation scenario and will tell you how to do each step and what is going on in relation to a good sample.

http://www.microsoft.com/technet/prodtechnol/windowsserver2003/technologies/security/tkerbdel.mspx

Keith Browns Security WIKI

(Contains most of the excellent book .Net Developers Guide to Windows Security). Contains most of the background information you might want.

http://pluralsight.com/wiki/default.aspx/Keith.GuideBook.HomePage

Background Information

The following links provide background information on some of the concepts in this area.

Description	Link
Keith Brown Q & A Keith brown provides useful background information on this type of security in the form of an interview in MSDN Magazine.	http://msdn.microsoft.com/msdnmag/issues/05/09/securitybriefs/
Discussion on Delegation	http://searchwindowssecurity.techtarget.com/originalContent/0,289142,sid45_gci1013484,00.html
KB Article on Delegation Issues in Load Balanced Scenarios	http://support.microsoft.com/kb/325608/
PnP guide on Implementing Kerberos on win2k	http://msdn2.microsoft.com/en-us/library/aa302400.aspx
WSE Documentation (How to sign a message with a Kerberos Token)	http://msdn.microsoft.com/library/default.asp?url=/library/en-us/wse3.0/html/b03d6cfb-e65e-4d19-bf7b-137338b663d1.asp
SetSpn Examples	http://technet2.microsoft.com/WindowsServer/en/library/2bbd23c5-a01d-49bc-8b1c-6d309767c5e71033.mspx?mfr=true
Setting up SPN/Kerberos against the cluster name	http://technet2.microsoft.com/WindowsServer/en/library/024e21dd-c864-43de-908a-a3c2a9fcf9431033.mspx?mfr=true
PnP Kerberos Technical Supplement for Windows More detail on Kerberos	http://msdn.microsoft.com/library/default.asp?url=/library/en-us/dnpag2/html/WSS_Ch7_KerbTechSupp.asp
Differences between KerberosToken and KerberosToken2	http://msdn.microsoft.com/library/default.asp?url=/library/en-us/wse/html/4dd8d00a-19b7-4c94-b515-778b11a62c0b.asp
BizTalk WSE Adapter Walk through Does not use Kerberos but still covers the use of the WSE adapter. Uses X509 Certificates instead.	http://www.microsoft.com/technet/prodtechnol/biztalk/biztalk2004/planning/walkwse.mspx

How To Guides

These links will provide useful information on how to do some of the common tasks you might come across in this area.

Description	Link
How to troubleshoot Kerberos related issues in IIS	http://support.microsoft.com/kb/326985
How to enable Kerberos Event Logging	http://support.microsoft.com/kb/262177
How to force Kerberos to use TCP instead of UDP in Windows 2003 etc...	http://support.microsoft.com/kb/244474

Troubleshooting

The following links provide useful troubleshooting resources.

Description	Link
You receive an "HTTP Error 401.1 - Unauthorized: Access is denied due to invalid credentials" error message when you try to access a Web site that is part of an IIS 6.0 application pool Contains information on how to resolve HTTP 401 response code	http://support.microsoft.com/kb/871179
WSE Common Configuration Errors	http://msdn.microsoft.com/library/default.asp?url=/library/en-us/wse3.0/html/67e4e65b-ffc8-4d2b-9359-7f05758a419d.asp
WSE Common Error Messages	http://msdn.microsoft.com/library/default.asp?url=/library/en-us/wse3.0/html/97451b4c-d25b-480d-b304-3bde7834eaf5.asp
Enabling Kerberos Logging	http://www.support.microsoft.com/kb/262177/
Troubleshooting Kerberos Issues in IIS	http://www.support.microsoft.com/kb/326985
Troubleshooting Kerberos	http://www.microsoft.com/technet/prodtechnol/windowsserver2003/technologies/security/tkerberr.mspx
Kerberos Delegation Troubleshooting Guide	http://www.microsoft.com/technet/prodtechnol/windowsserver2003/technologies/security/tkerbdel.mspx

Kerberos Adventures - Introduction

michael stephenson — Fri, 02 Feb 2007 18:38:00 GMT

I am currently on a medium - large sized project where one of the things we are planning to do is use BizTalk and Web Services. Within the architecture we have plans to support credential flow across tiers. It has proven quite difficult to get this working and then doing things with BizTalk has added an additional twist which also proved tricky.

During the course of working on resolving our issues and also setting up these proof of concepts I have found that there is useful information out there on the web but it is mainly for web services, there isn't much about using BizTalk and WSE/Kerberos.

My adventure started when I was trying to implement a requirement to sign and encrypt messages send to a BizTalk Web Service generated by the WSE Adapter using a Kerberos Token.

Eventually after a lot of help from Microsoft I have been able to resolve my issue. I have now decided to do a series of posts which will aim to describe some of what we have done, provide links to useful things I have come across during my time on this and also some troubleshooting on some of the problems we have encountered.

I aim to produce the following posts in my Kerberos Adventures Series

Article	Description
POC Overview	Details about the different proof of concepts we did to validate all of the different scenarios we require.
Useful Links	Some links to articles and blogs which will provide useful background information
Useful Tools	Links to tools which were useful to help troubleshooting this implementation
Problems - Error Consuming a service from an XP Client on service pack 2	Details of the problem and how we solved it
Problems - Credentials not delegated the User is null	We had some problems in delegation and this describes the problem and how it was solved
Problems - The handle for the current process could not be retrieved	This was an error we had with a BizTalk web service exposed using the WSE 2 adapter
Problems - WSE Publishing Wizard does not generate KerberosToken2	When generating the web services policy it uses KerberosToken not KerberosToken2

(Click on the article title to link to the page)