我将尽力让这个问题尽可能简短，因为这个问题对我来说有点难以解释。如果有任何不清楚的地方，请提出任何疑问。所以，你开始吧，
这是我在处理此问题时收到的错误消息，
“HTTP 请求未经客户端身份验证方案‘Ntlm’的授权。从服务器收到的身份验证标头是‘Negotiate,NTLM’。远程服务器返回错误：(401) Unathorized”
我有两个 Windows 盒子，Box1 和 Box2。我有 2 个 WCF 服务（ServiceA 和 ServiceB）托管在 IIS 6 中。从功能上讲，ServiceA 仅与数据库通信。 ServiceB 与 ServiceA 对话并获取结果。这两种服务都启用了匿名访问和集成 Windows 身份验证。 ServiceA 在应用程序池 ServiceAPool 下运行，ServiceB 在 ServiceBPool 下运行。这些应用程序池中的每一个都配置了域用户的身份。
这些应用程序池在 Box1 和 Box2 上完全相同。
首先，我的客户端应用程序（只是一个小型控制台应用程序）使用我的 Windows 凭据调用 Box1 上的 ServiceA。有用。
其次，我的客户端应用程序使用我的 Windows 凭据调用 Box1 上的 ServiceB。此 ServiceB 在内部使用域用户（应用程序池身份）调用 ServiceA 它可以工作。
我上面提到的第二点在Box2上不起作用，它给出了上面的错误。需要明确的是，两个盒子上的服务代码（包括 web.config 文件等）完全相同。应用程序池的域用户是相同的。两个盒子都在同一个域上。
我观察到（可能），在 Box2 上，当我使用 Windows 凭据调用 ServiceA 时，它可以工作，但是当服务与其他域帐户（例如我的应用程序池帐户）之间存在跳跃时，它会失败并出现上述错误。
如果有人见过这种行为，请分享一些信息。
I am going to try to keep this question as brief as possible since the problem is a little tricky to explain for me. Please ask any queries if something is left unclear. So here you go,
This is the error message I have been getting for a while as I am working on this,
"The HTTP request is unauthorized with client authentication scheme 'Ntlm'. The authentication header received from the server was 'Negotiate,NTLM'. The remote server returned an error: (401) Unathorized"
I have two Windows boxes, Box1 and Box2. I have 2 WCF services (ServiceA and ServiceB) hosted in IIS 6 on each of them. Functionally, ServiceA talks to db only. ServiceB talks to ServiceA and gets results. Both services have anonymous access and Integrated Windows authentication enabled. ServiceA runs under Application pool ServiceAPool and ServiceB runs under ServiceBPool. Each of these app pools have configured identity of a domain user.
These app pools are exactly same on Box1 and Box2.
First, My client application (just a small console app), calls ServiceA on Box1 with my Windows credentials. It works.
Second, My client application , calls ServiceB on Box1 with my Windows credentials. This ServiceB calls ServiceA internally with domain user (app pool identity) It works.
The Second point I mentioned above does not work on Box2, it gives the above error. Just to be clear, the service code including web.config file etc is exactly same on both boxes. The domain user for app pool is the same. Both boxes are on same domain.
What I have observed is (probably), on Box2, when I call ServiceA with my windows credentials, it works, but when there is a hop between services with some other domain account (like my app pool account) it fails with the error above.
If anyone has seen such kind of behavior please share some information.
发布评论
评论（1）
我想发布我自己问题的答案。
事实证明，这是一个该死的注册表项更新，以使身份验证工作正常。基本上它是关于禁用“DisableLoopbackCheck”值。更多信息请访问
http://blogs.msdn.com/b/distributedservices/archive/2009/11/10/wcf-calling-wcf-service-hosted-in-iis-on-the-same-machine- as-client-throws-an-authentication-error.aspx
http://support.microsoft.com/default.aspx?scid=kb ;EN-US;926642
I would like to post an answer to my own question.
It turned out to be a friggin registry key update to get the authentication work just fine. Basically it was about disabling "DisableLoopbackCheck" value. More information can be found at
http://blogs.msdn.com/b/distributedservices/archive/2009/11/10/wcf-calling-wcf-service-hosted-in-iis-on-the-same-machine-as-client-throws-an-authentication-error.aspx
http://support.microsoft.com/default.aspx?scid=kb;EN-US;926642