Using WCF's net.pipe in a website with impersonate=true

Question

I'm trying to use WCF named pipes in a web site, and it's failing with errors:

There was no endpoint listening at net.pipe://localhost/mypipename that could accept the message. This is often caused by an incorrect address or SOAP action. See InnerException, if present, for more details.

and the InnerException:

The pipe name could not be obtained for net.pipe://localhost/mypipename.

and there is another inner exception giving an access denied message.

My web site is using impersonation, and looking around the internet, this seems to be relevant, but I don't know how to fix it.

Does anyone have any ideas?

Thanks Matt

Answer 1

The standard WCF NetNamedPipesBinding creates a randomly-generated pipe name when the service starts up, and also a kernel shared memory object which the WCF client-side channel stack has to consult to find out the name of the pipe.

Using impersonation on your web site means that the security context from which your WCF service is being invoked has a logon token (the impersonation token) which includes membership of the NETWORK USERS group.

When the service listener starts up, the WCF binding creates an Access Control List (ACL) on both the named pipe itself, and on the shared memory object where the pipe name is published. Both of these ACLs deny access to the NETWORK USERS group. Thus your web site, impersonating the remote user, is denied access to the shared memory object before it can even discover the pipe name. Even if it found out the pipe name some other way, it would still be denied access to the pipe.

Everything works when you remove impersonation, because now the service is being invoked in the security context of the web application worker process, whose logon token does not have membership of the NETWORK USERS group - it is a local logon.

More details at http://blogs.charteris.com/blogs/chrisdi if you're interested. I show how the ACLs can be adjusted, and in principle this approach could be used to grant access to remote users, but I don't recommend this.

Answer 2

If you're getting this particular exception, it typically means that your service is not running. I see that you use localhost in the URL. I just want to make sure that the host and the service are running on the same machine. WCF does not allow communication across machines with this binding.

When I get this message, usually I check and see that I forgot to start the service, thus, there is no endpoint listening. Please check that your service is actually still running and hasn't crashed at the time that the exception is thrown. If that doesn't fix the problem, please post your progress and I can make more suggestions.

Answer 3

我通过使IIS终结点解决了该问题，该终结点最终使网络管道从可用状态变为匿名用户，这意味着没有假冒行为。