IIS 7 hosted WCF service using domain account for app pool identity

Question

I am trying to do something which I think should be very simple, but I am not having any luck at all. I have a simple Hello World WCF service that I am hosting in IIS 7. The service works fine using the default app pool. However, when I create a new app pool and have that app pool run using a domain account I get an error when calling the service. I am certain I need to make config changes, however I don't know what they are. The error I get is

"Security Support Provider Interface (SSPI) authentication failed. The server may not be running in an account with identity 'host/ep2t-ifs01'. If the server is running in a service account (Network Service for example), specify the account's ServicePrincipalName as the identity in the EndpointAddress for the server. If the server is running in a user account, specify the account's UserPrincipalName as the identity in the EndpointAddress for the server."

Security of this type is not something I am very knowledgeable about so no suggestion is too simple. ANY help at this point will be greatly appreciated. Here is relevant section from my web.config file:

Answer 1

This issue is quite tricky. Here is a list of resources (in that particular order) you can check to understand the issue:

• http://msdn.microsoft.com/en-us/library/bb463274.aspx
• http://msdn.microsoft.com/en-us/library/ms733130.aspx
• http://msdn.microsoft.com/en-us/library/bb628618.aspx

At the end, you will probably need to create a SPN for your domain account that is linked to the server you are deploying to. This requires domain administrator privileges. More info here

Answer 2

For some reason my web.config section didn't get saved...

<system.serviceModel>
<behaviors>
  <serviceBehaviors>
    <behavior name="basicServiceBehavior">
      <serviceMetadata httpGetEnabled="True" />
      <serviceDebug includeExceptionDetailInFaults="False" />
    </behavior>
  </serviceBehaviors>
</behaviors>
<services>
  <service name="WebSyncPrototypeMVCApp.Service1" behaviorConfiguration="basicServiceBehavior">
    <endpoint address="" binding="wsHttpBinding" contract="WebSyncPrototypeMVCApp.IService1" />
    <endpoint address="mex" binding="mexHttpBinding" contract="IMetadataExchange" />
  </service>
</services>