I'm trying to pass a Kerberos ticket onto a webservice through a custom webpart. The webservice is a WCF service, but it is a 3rd party web service that is not claims-aware. The web service doesn't seem like it will allow the SPD web service External Content Type. I was going to create a BCS webpart that will let BCS and SharePoint handle the authentication, but I wasn't sure if that would make a difference.
I have the webpart up and running and working with Classic Mode, but with C2WTS and impersonation, the webpart won't pass the Kerberos Ticket over correctly.
Things I've tried:
- Setting up the web service in SharePoint Designer as an External Content Type
- SPD errors -
Cannot find any matching endpoint configuration
- SPD errors -
- Setting up a classic web authentication
- Works correctly without C2WTS, but I need this in Claims (its 2013)
- Basic authentication
- Works, but need to pass the Kerberos ticket to retain identity.
Here is my code:
public static CreateBinding(string uri){
BindingElementCollection bec = new BindingElementCollection();
TransportSecurityBindingElement sbe = TransportSecurityBindingElement.CreateKerberosOverTransportBindingElement();// SecurityBindingElement.CreateKerberosOverTransportBindingElement();
sbe.IncludeTimestamp = true;
sbe.AllowInsecureTransport = true;
sbe.EnableUnsecuredResponse = true;
bec.Add(sbe);
if (uri.IndexOf("SOAP") != -1)
{
// using the SOAP endpoint
TextMessageEncodingBindingElement tme = new TextMessageEncodingBindingElement();
tme.MessageVersion = MessageVersion.Soap11;
tme.ReaderQuotas.MaxDepth = 1024;
tme.ReaderQuotas.MaxStringContentLength = 1024 * 1024;
bec.Add(tme);
}
else
{
MtomMessageEncodingBindingElement mme = new MtomMessageEncodingBindingElement();
mme.MessageVersion = MessageVersion.Soap12;
mme.ReaderQuotas.MaxDepth = 1024;
mme.ReaderQuotas.MaxStringContentLength = 1024 * 1024;
mme.MaxBufferSize = 2147483647;
bec.Add(mme);
}
HttpsTransportBindingElement tbe = new HttpsTransportBindingElement();
tbe.MaxReceivedMessageSize = 2147483647;
// tbe.RequireClientCertificate = true;
tbe.MaxBufferSize = 2147483647;
bec.Add(tbe);
CustomBinding binding = new CustomBinding(bec);
binding.ReceiveTimeout = new TimeSpan(TimeSpan.TicksPerDay); // 100 nanonsecond units, make it 1 day
binding.SendTimeout = binding.ReceiveTimeout;
WSHttpBinding custombinding = new WSHttpBinding();
custombinding.Security.Transport.ClientCredentialType = HttpClientCredentialType.Windows;
custombinding.Security.Mode = SecurityMode.TransportWithMessageCredential;
custombinding.MessageEncoding = WSMessageEncoding.Mtom;
EndpointIdentity ei = EndpointIdentity.CreateSpnIdentity("HTTP/[email protected]");
EndpointAddress endpoint = new EndpointAddress(new Uri(uri), ei);
port.ClientCredentials.Windows.ClientCredential = CredentialCache.DefaultNetworkCredentials;
port.ClientCredentials.Windows.AllowNtlm = false;
localization = new Localization();
localization.Timezone = GetTimezone();
return port;
}
using(WindowsImpersonationContext ctx = winId.Impersonate()){
WebService.Client binding = ConfigureBinding("http://webservicehost.domain.com:3425")
//fetch items using web service methods
}
My options are either to pass the Kerberos using this method, or try to use BCS webpart in order to let it handle authentication, has anyone come across this or have any experience with BCS webpart authentication? Can you set it up to use user's identity in a .NET assembly BCS model?
EDIT: Forgot to mention the errors that I'm getting is from the other side of the webservice: the user is anonymous, or otherwise not authenticated.(paraphrasing)