c# - WCF "A call to SSPI failed, see inner exception"

标签 c# wcf wcf-security

我们有一个使用 WCF 的现有系统并且在昨天之前运行良好，突然它在我的机器和另一台开发人员机器上停止工作。

我在客户端配置中设置了系统诊断以写入跟踪文件，我们看到以下异常:

Throwing an exception 

**Basic Information**

Activity Name           Receive bytes on connection 'net.tcp://localhost:8004/'.
Time                    2016-01-06 13:38:45.3958
Level                   Error
Source                  System.ServiceModel
Process                 NServiceBus.Host
Thread                  219
Computer                RL-ZORO-LPT
Trace Identifier/Code   http://msdn.microsoft.com/en-US/library/System.ServiceModel.Diagnostics.ThrowingException.aspx


**Exception**

System.ServiceModel.Security.SecurityNegotiationException, System.ServiceModel, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089
    System.Security.Authentication.AuthenticationException, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089
         System.ComponentModel.Win32Exception, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089

Exception Type: System.ServiceModel.Security.SecurityNegotiationException, System.ServiceModel, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089

Message: A call to SSPI failed, see inner exception.

Stack Trace:  System.ServiceModel.Channels.StreamSecurityUpgradeAcceptorAsyncResult.CompleteAuthenticateAsServer(IAsyncResult result)
              System.ServiceModel.Channels.StreamSecurityUpgradeAcceptorAsyncResult.OnAuthenticateAsServer(IAsyncResult result)
              System.Runtime.Fx.AsyncThunk.UnhandledExceptionFrame(IAsyncResult result)
              System.Net.LazyAsyncResult.Complete(IntPtr userToken)
              System.Net.LazyAsyncResult.ProtectedInvokeCallback(Object result, IntPtr userToken)
              System.Net.Security.SslState.FinishHandshake(Exception e, AsyncProtocolRequest asyncRequest)
              System.Net.Security.SslState.ReadFrameCallback(AsyncProtocolRequest asyncRequest)
              System.Net.AsyncProtocolRequest.CompleteRequest(Int32 result)
              System.Net.FixedSizeReader.CheckCompletionBeforeNextRead(Int32 bytes)
              System.Net.FixedSizeReader.ReadCallback(IAsyncResult transportResult)
              System.Runtime.AsyncResult.Complete(Boolean completedSynchronously)
              System.ServiceModel.Channels.ConnectionStream.IOAsyncResult.OnAsyncIOComplete(Object state)
              System.ServiceModel.Channels.TracingConnection.TracingConnectionState.ExecuteCallback()
              System.Net.Sockets.SocketAsyncEventArgs.OnCompleted(SocketAsyncEventArgs e)
              System.Net.Sockets.SocketAsyncEventArgs.FinishOperationSuccess(SocketError socketError, Int32 bytesTransferred, SocketFlags flags)
              System.Net.Sockets.SocketAsyncEventArgs.CompletionPortCallback(UInt32 errorCode, UInt32 numBytes, NativeOverlapped* nativeOverlapped)
              System.Threading._IOCompletionCallback.PerformIOCompletionCallback(UInt32 errorCode, UInt32 numBytes, NativeOverlapped* pOVERLAP)

我们的服务器配置如下:

<system.serviceModel>
    <services>
      <service name="ServerImpl.RACServiceImpl.RACService" behaviorConfiguration="BILLService.ServiceBehavior">
        <host>
          <baseAddresses>
            <add baseAddress="net.Tcp://localhost:8004" />
            <add baseAddress="http://localhost:8006" />
          </baseAddresses>
        </host>
        <!-- Service Endpoints -->
        <endpoint address="BILLService" binding="netTcpBinding" bindingConfiguration="netTcpBindingConf" contract="ServerImpl.Rsp.ServiceInterfaces.IRACService">
          <identity>
            <dns value="RACServer" />
          </identity>
        </endpoint>
        <endpoint address="mex" binding="mexHttpBinding" contract="IMetadataExchange" />
      </service>
    </services>
    <client>
      <endpoint address="net.Tcp://localhost:8001/RMACService" behaviorConfiguration="ClientBehavior" binding="netTcpBinding" bindingConfiguration="netTcpBindingConf" contract="ServerImpl.Rsp.ServiceInterfaces.IRACService" name="IRACService">
        <identity>
          <dns value="RACServer" />
        </identity>
      </endpoint>
    </client>
    <behaviors>
      <serviceBehaviors>
        <behavior name="BILLService.ServiceBehavior">
          <!-- To avoid disclosing metadata information, set the value below to false and remove the metadata endpoint above before deployment -->
          <serviceMetadata httpGetEnabled="false" />
          <!-- To receive exception details in faults for debugging purposes, set the value below to true.  Set to false before deployment to avoid disclosing exception information -->
          <serviceDebug includeExceptionDetailInFaults="true" />
          <serviceCredentials>
            <serviceCertificate findValue="RACServer" storeLocation="LocalMachine" storeName="My" x509FindType="FindBySubjectName" />
            <clientCertificate>
              <certificate findValue="RACClient" storeLocation="LocalMachine" storeName="My" x509FindType="FindBySubjectName" />
              <authentication certificateValidationMode="PeerOrChainTrust" revocationMode="NoCheck" />
            </clientCertificate>
          </serviceCredentials>
          <serviceThrottling maxConcurrentCalls="40" maxConcurrentInstances="40" maxConcurrentSessions="40" />
          <dataContractSerializer maxItemsInObjectGraph="2147483647" />
        </behavior>
      </serviceBehaviors>
      <endpointBehaviors>
        <behavior name="ClientBehavior">
          <clientCredentials>
            <clientCertificate findValue="RACClient" storeLocation="LocalMachine" storeName="My" x509FindType="FindBySubjectName" />
            <serviceCertificate>
              <defaultCertificate findValue="RACServer" storeLocation="LocalMachine" storeName="My" x509FindType="FindBySubjectName" />
              <authentication certificateValidationMode="PeerOrChainTrust" revocationMode="NoCheck" />
            </serviceCertificate>
          </clientCredentials>
        </behavior>
      </endpointBehaviors>
    </behaviors>
    <bindings>
      <netTcpBinding>
        <binding name="netTcpBindingConf" closeTimeout="00:11:00" receiveTimeout="00:10:00" sendTimeout="00:10:00" transactionFlow="false" hostNameComparisonMode="StrongWildcard" maxReceivedMessageSize="2147483647" maxBufferPoolSize="2147483647" maxBufferSize="2147483647" maxConnections="100" openTimeout="00:20:00">
          <readerQuotas maxDepth="2147483647" maxStringContentLength="2147483647" maxArrayLength="2147483647" maxBytesPerRead="2147483647" maxNameTableCharCount="2147483647" />
          <reliableSession ordered="true" inactivityTimeout="00:15:00" />
          <security mode="TransportWithMessageCredential">
            <message clientCredentialType="Certificate" algorithmSuite="Default" />
            <transport clientCredentialType="Windows" protectionLevel="EncryptAndSign" />
          </security>
        </binding>
      </netTcpBinding>
    </bindings>
</system.serviceModel>

这是我们的客户端配置:

<system.serviceModel>
    <bindings>
      <netTcpBinding>
        <binding name="netTcpBinding_RACService" closeTimeout="00:10:00" openTimeout="00:40:00" receiveTimeout="00:32:00" sendTimeout="00:10:00" transactionFlow="false" hostNameComparisonMode="StrongWildcard" maxBufferPoolSize="524288" maxReceivedMessageSize="2147483647">
          <readerQuotas maxDepth="2147483647" maxStringContentLength="2147483647" maxArrayLength="2147483647" maxBytesPerRead="2147483647" maxNameTableCharCount="2147483647" />
          <reliableSession ordered="true" inactivityTimeout="00:10:00" />
          <security mode="TransportWithMessageCredential">
            <message clientCredentialType="Certificate" algorithmSuite="Default" />
            <transport clientCredentialType="Windows" protectionLevel="EncryptAndSign" />
          </security>
        </binding>
      </netTcpBinding>
    <wsHttpBinding>
        <binding name="WSHttpBinding_IThirdPartyRACService" closeTimeout="00:59:00" openTimeout="00:59:00" receiveTimeout="00:59:00" sendTimeout="00:59:00" bypassProxyOnLocal="false" transactionFlow="false" hostNameComparisonMode="StrongWildcard" maxBufferPoolSize="2147483647" maxReceivedMessageSize="2147483647" messageEncoding="Text" textEncoding="utf-8" useDefaultWebProxy="true" allowCookies="false">
          <readerQuotas maxDepth="32" maxStringContentLength="2147483647" maxArrayLength="2147483647" maxBytesPerRead="2147483647" maxNameTableCharCount="2147483647" />
          <reliableSession ordered="true" inactivityTimeout="00:10:00" enabled="false" />
          <security mode="None">
            <message clientCredentialType="None" negotiateServiceCredential="true" algorithmSuite="Default" establishSecurityContext="true"></message>
            <transport clientCredentialType="None" />
          </security>
        </binding>
      </wsHttpBinding>
    </bindings>
    <client>
      <endpoint address="net.Tcp://localhost:8004/AMACService" behaviorConfiguration="ClientBehavior" binding="netTcpBinding" bindingConfiguration="netTcpBinding_RACService" contract="ServerImpl.Rsp.ServiceInterfaces.IRACService" name="IRACService">
        <identity>
          <dns value="RACServer" />
        </identity>
      </endpoint>
      <endpoint address="net.Tcp://localhost:8004/AMACService" behaviorConfiguration="ClientBehavior" binding="netTcpBinding" bindingConfiguration="netTcpBinding_RACService" contract="ServerImpl.Rsp.ServiceInterfaces.IRACService" name="IRACService1">
        <identity>
          <dns value="RACServer" />
        </identity>
      </endpoint>
    <endpoint address="https://localhost/ThirdPartyWebService/ThirdPartyRACService.svc" binding="wsHttpBinding" bindingConfiguration="WSHttpBinding_IThirdPartyRACService" contract="IThirdPartyRACService" name="WSHttpBinding_IThirdPartyRACService">
        <identity>
          <dns value="localhost" />
        </identity>
      </endpoint>
    </client>
    <behaviors>
      <endpointBehaviors>
        <behavior name="ClientBehavior">
          <clientCredentials>
            <clientCertificate findValue="RACClient" storeLocation="LocalMachine" storeName="My" x509FindType="FindBySubjectName" />
            <serviceCertificate>
              <defaultCertificate findValue="RACServer" storeLocation="LocalMachine" storeName="My" x509FindType="FindBySubjectName" />
              <authentication certificateValidationMode="PeerOrChainTrust" revocationMode="NoCheck" />
            </serviceCertificate>
          </clientCredentials>
          <dataContractSerializer maxItemsInObjectGraph="2147483647" />
        </behavior>
      </endpointBehaviors>
    </behaviors>
</system.serviceModel>

如果我们在客户端和服务器上将安全模式设置为“无”，那么它就可以工作。

这里有什么问题吗？

最佳答案

事实证明，导致问题的原因是同一天发生的 Windows 更新(奇怪的巧合)。更新是 kb3102467(又名 .NET Framework 4.6.1)——它最终会在机器上找到自己。

事实证明，我们使用的 SSL 证书使用 RSA/SHA512，根据我的阅读，它导致 CPU 使用率过高，因此被禁用(有针对此问题的修补程序，我看到的注册表信息已添加, 但在 kb3102467 之后它仍然发生了)。

作为解决方法(直到我们颁发新的 SSL 证书)，我通过以下方式禁用了 TLS 1.2:

  1. 启动 regedit 并浏览到以下位置:HKLM\System\CurrentControlSet\Control\SecurityProviders\SChannel\Protocols
  2. 在协议(protocol)下创建以下 key :TLS 1.2
  3. 在 TLS 1.2 下创建以下两个 key :客户端和服务器
  4. 在客户端和服务器 key 下创建以下 DWORD:DisabledByDefault 和 Enabled
  5. 在客户端和服务器下设置如下:DisabledByDefault=1 和 Enabled =0
  6. 重启服务器。

这解决了问题，无需卸载 kb3102467

关于c# - WCF "A call to SSPI failed, see inner exception"，我们在Stack Overflow上找到一个类似的问题： https://stackoverflow.com/questions/34633972/

上一篇：c# - 播种多对多数据

下一篇：c# - 如何从内存缓存返回通用列表

相关文章：

WCF 无法建立连接，因为目标机器主动拒绝

c# - 如何在数据 View 中过滤数据

c# - 使用 COM 将字符串从 C# 传递到 cpp

c# - File.WriteAllLines 静默失败

.net - NetTcpBinding 和 WsHttpBinding 由哪些组件(绑定(bind)元素)组成？

c# - 如何在 ServiceAuthorizationManager 中设置身份/用户名？

c# - 在解决方案中使用多个框架？

WCF 无法为具有权限的 SSL/TLS 安全通道建立信任关系

.net - 如何在服务根地址(不带尾部斜杠)托管 WCF REST 服务？

c# - 我如何识别我的服务的客户？

©2024 IT工具网  联系我们