2011-10-19 66 views
8

我遇到的這個問題並不是針對所有訪問我們服務的客戶端發生的,但是一致的是當錯誤發生時,它正在發生爲少數客戶提供同樣的服務。獲取403禁止的錯誤。 HTTP請求被禁止使用客戶端身份驗證方案'Anonymous'

以下是異常的詳細信息:

System.ServiceModel.Security.MessageSecurityException The HTTP request was forbidden with client authentication scheme 'Anonymous'. System.ServiceModel.Security.MessageSecurityException: The HTTP request was forbidden with client authentication scheme 'Anonymous'. > ---> System.Net.WebException: The remote server returned an error: (403) Forbidden. at System.Net.HttpWebRequest.GetResponse() at System.ServiceModel.Channels.HttpChannelFactory.HttpRequestChannel.HttpChannelRequest.WaitForReply(TimeSpan timeout) --- End of inner exception stack trace --- Server stack trace: at System.ServiceModel.Security.IssuanceTokenProviderBase 1.DoNegotiation(TimeSpan timeout) at System.ServiceModel.Security.SspiNegotiationTokenProvider.OnOpen(TimeSpan timeout) at System.ServiceModel.Security.TlsnegoTokenProvider.OnOpen(TimeSpan timeout) at System.ServiceModel.Security.WrapperSecurityCommunicationObject.OnOpen(TimeSpan timeout) at System.ServiceModel.Channels.CommunicationObject.Open(TimeSpan timeout) at System.ServiceModel.Security.CommunicationObjectSecurityTokenProvider.Open(TimeSpan timeout) at System.ServiceModel.Security.SecurityUtils.OpenTokenProviderIfRequired(SecurityTokenProvider tokenProvider, TimeSpan timeout) at System.ServiceModel.Security.SymmetricSecurityProtocol.OnOpen(TimeSpan timeout) at System.ServiceModel.Security.WrapperSecurityCommunicationObject.OnOpen(TimeSpan timeout) at System.ServiceModel.Channels.CommunicationObject.Open(TimeSpan timeout) at System.ServiceModel.Channels.SecurityChannelFactory 1.ClientSecurityChannel 1.OnOpen(TimeSpan timeout) at System.ServiceModel.Channels.CommunicationObject.Open(TimeSpan timeout) at System.ServiceModel.Security.SecuritySessionSecurityTokenProvider.DoOperation(SecuritySessionOperation operation, EndpointAddress target, Uri via, SecurityToken currentToken, TimeSpan timeout) at System.ServiceModel.Security.SecuritySessionSecurityTokenProvider.GetTokenCore(TimeSpan timeout) at System.IdentityModel.Selectors.SecurityTokenProvider.GetToken(TimeSpan timeout) at System.ServiceModel.Security.SecuritySessionClientSettings 1.ClientSecuritySessionChannel.OnOpen(TimeSpan timeout) at System.ServiceModel.Channels.CommunicationObject.Open(TimeSpan timeout) at System.ServiceModel.Channels.ServiceChannel.OnOpen(TimeSpan timeout)
at System.ServiceModel.Channels.CommunicationObject.Open(TimeSpan timeout) at System.ServiceModel.Channels.ServiceChannel.CallOpenOnce.System.ServiceModel.Channels.ServiceChannel.ICallOnce.Call(ServiceChannel channel, TimeSpan timeout) at System.ServiceModel.Channels.ServiceChannel.CallOnceManager.CallOnce(TimeSpan timeout, CallOnceManager cascade) at System.ServiceModel.Channels.ServiceChannel.EnsureOpened(TimeSpan timeout) at System.ServiceModel.Channels.ServiceChannel.Call(String action, Boolean oneway, ProxyOperationRuntime operation, Object[] ins, Object[] outs, TimeSpan timeout) at System.ServiceModel.Channels.ServiceChannel.Call(String action, Boolean oneway, ProxyOperationRuntime operation, Object[] ins, Object[] outs) at System.ServiceModel.Channels.ServiceChannelProxy.InvokeService(IMethodCallMessage methodCall, ProxyOperationRuntime operation) at System.ServiceModel.Channels.ServiceChannelProxy.Invoke(IMessage message) Exception rethrown at [0]: at System.Runtime.Remoting.Proxies.RealProxy.HandleReturnMessage(IMessage reqMsg, IMessage retMsg) at System.Runtime.Remoting.Proxies.RealProxy.PrivateInvoke(MessageData& msgData, Int32 type) at > Proxy.FileTransferService.IFileTransferService.EstablishProxy(DownloadRequest request) at Proxy.FileTransferService.FileTransferServiceClient. Proxy.FileTransferService.IFileTransferService.EstablishProxy(DownloadRequest request) at NormalFileTransferServiceClient.Download(Int32 packageId, IStreamWriter downloader, Archiver archiver) at LoggingFileTransferServiceClient.Download(Int32 packageId, ISt

該異常是由客戶端拋出。

爲IFileTransferService客戶端代理配置爲:

<binding name="WSHttpBinding_IFileTransferService" closeTimeout="00:01:00" 
    openTimeout="00:01:00" receiveTimeout="00:10:00" sendTimeout="00:01:00" 
    bypassProxyOnLocal="false" transactionFlow="false" hostNameComparisonMode="StrongWildcard" 
    maxBufferPoolSize="524288" maxReceivedMessageSize="65536" messageEncoding="Mtom" 
    textEncoding="utf-8" useDefaultWebProxy="true" allowCookies="false"> 
    <readerQuotas maxDepth="32" maxStringContentLength="8192" maxArrayLength="16384" 
    maxBytesPerRead="4096" maxNameTableCharCount="16384" /> 
    <reliableSession ordered="true" inactivityTimeout="00:10:00" 
    enabled="false" /> 
    <security mode="Message"> 
    <transport clientCredentialType="Windows" proxyCredentialType="None" 
     realm="" /> 
    <message clientCredentialType="UserName" negotiateServiceCredential="true" 
     algorithmSuite="Default" establishSecurityContext="true" /> 
    </security> 
</binding> 

    <endpoint address="http://[hostname]/FileTransferService.svc/FileTransfer" 
    binding="wsHttpBinding" bindingConfiguration="WSHttpBinding_IFileTransferService" 
    contract="Proxy.FileTransferService.IFileTransferService" 
    name="WSHttpBinding_IFileTransferService"> 
    <identity> 
     <certificate encodedValue="a long string"/> 
    </identity> 
    </endpoint> 

服務配置是

<service behaviorConfiguration="ServiceBehavior" 
    name="Services.FileTransferService"> 
     <endpoint name="WSHttpBinding_IFileTransferService" 
     binding="wsHttpBinding" 
     bindingConfiguration="MtomWSHttpBinding" 
     contract="Services.IFileTransferService" 
     address="/FileTransfer"/> 
     <endpoint binding="basicHttpBinding" 
     bindingConfiguration="FileTransferServicesBinding" 
     contract="Services.IFileTransferService"/> 
     <host> 
      <baseAddresses> 
      <add baseAddress="http://[hostname]/FileTransferService.svc"/> 
      </baseAddresses> 
     </host> 
</service> 

<binding name="wsHttpBinding" 
     maxReceivedMessageSize="2147483647" 
     receiveTimeout="5" 
     useDefaultWebProxy="false"> 
     <readerQuotas maxDepth="2147483647" 
      maxStringContentLength="2147483647" 
      maxArrayLength="2147483647" 
      maxBytesPerRead="2147483647" 
      maxNameTableCharCount="2147483647" /> 
    <security mode="Message"> 
    <message clientCredentialType="UserName" /> 
    </security> 
</binding> 

<basicHttpBinding> 
    <binding name="FileTransferServicesBinding" 
      maxReceivedMessageSize="10067108864" 
      messageEncoding="Mtom" 
      transferMode="Streamed" 
      useDefaultWebProxy="false"> 
     <security mode="None"> 
     <message clientCredentialType="UserName" /> 
     </security> 
    </binding> 
    </basicHttpBinding> 

注:一些客戶端使用basicHttpBinding的(如果我的一切正確的設置)。在客戶端的後期版本中,可能沒有完全分發(這就是爲什麼我必須支持2版本),所以我改爲使用wsHttpBinding端點代理。我想知道如果我得到的這個錯誤是特定於basicHttp的,如果是的話,也許我沒有正確設置這些配置。我假設得到這個403錯誤的客戶端正在使用wsHttpBinding。

下面是服務的代碼:

public RemoteBinaryInfo EstablishProxy(DownloadRequest request) 
{ 
    int packageId = request.PackageId; 

    System.IO.MemoryStream stream = new System.IO.MemoryStream(packageRepository.GetPackageBinary(packageId)); 

    DisposeStreamWhenOperationIsComplete(stream, OperationContext.Current); 

    RemoteBinaryInfo result = new RemoteBinaryInfo(); 
    result.Length = stream.Length; 
    result.MemoryByteStream = stream; 
    return result; 

} 

private static void DisposeStreamWhenOperationIsComplete(System.IO.MemoryStream stream, OperationContext clientContext) 
{ 
    clientContext.OperationCompleted += new EventHandler(delegate(object sender, EventArgs args) 
    { 
     if (stream != null) 
      stream.Dispose(); 
    }); 
} 

任何一個人知道這是否擺脫這個異常的東西withing我的控制?是否可以在客戶端或服務配置文件上進行任何配置更改?

如果您需要更多信息,請告訴我。

+0

如果尚未完成,您應該嘗試公開一個簡單的hello world方法來隔離問題。 – JoeBilly

回答

0

這聽起來像接受MessageSecurityException的客戶沒有提供有效的用戶名/密碼與他們的請求。

請參閱以下MSDN主題http://msdn.microsoft.com/en-us/library/ms733131.aspx

+0

如果正在完成上述操作,那麼接收到錯誤的客戶端之間是否存在連接,它們是從哪個域調用的? 排除接收錯誤的客戶端不通過代理髮送請求也很有用。 如果這些都不起作用,請啓用客戶端和服務上的消息跟蹤:http://msdn.microsoft.com/en-us/library/ms730064.aspx –

+0

用戶名和密碼直接在代碼中提供它被解密。客戶和這些服務之間沒有人際交互。我生成的代理與應用程序一起分發並自動執行。 – SideFX

+0

我已經有了這個creds.ServiceCertificate.Authentication.CertificateValidationMode = X509CertificateValidationMode.PeerTrust;但可以解決這個問題:creds.ServiceCertificate.Authentication.TrustedStoreLocation = StoreLocation.LocalMachine;我收到的錯誤並不是針對每個客戶端請求都發生的,但是可能是特定的客戶端網絡配置會導致需要添加上面的代碼。明確說明服務器證書在客戶端中的位置的目的是什麼? – SideFX

0

所以,你必須在IIS中配置使用匿名身份驗證的Web服務,你會得到一個403 Forbidden錯誤只有少數用戶。

從我自己的經驗來看,這通常是由於訪問受ACL控制的系統資源(如文件系統)時訪問被拒絕異常引起的。

每個異常連接的用戶都會通過w3wp.exe進程(假設IIS 7)處理它的請求,該進程通常具有應用程序池標識(IIS APPPOOL/AppPoolName),如果該標識未添加到任何所需的訪問控制列表訪問被拒絕的異常將導致IIS響應403錯誤。

我通常會將應用程序池標識添加到一個組,然後將該組添加到任何所需的資源。

如果找不到可能導致異常的資源,請嘗試在安全事件日誌中查找線索的「審計失敗」條目。您可能需要配置本地安全策略來記錄安全事件。

好運

3

在我的情況是我們組織的HTTP代理服務器此錯誤。發現它從: MessageSecurityException.InnerException.Response.Headers

{MIME的版本:1.0
X-SQUID-錯誤:ERR_ACCESS_DENIED 0
X-緩存:MISS從<
X-緩存查找:NONE從<的Proxy-服務器地址>
代理連接:關閉
的Content-Length:2165
的Content-Type:text/html的
日期:星期三,2012 4月25日十點55分39秒GMT
服務器:魷魚/ 3.0.STABLE25
途經:1.0 <代理服務器地址>(魷魚/ 3.0.STABLE25)
}

在我的情況也發生了它的文件傳輸方法傳輸文件大小爲16384的byte數組中的塊。在將大小減小到10000時,錯誤已解決。這意味着代理服務器有一些大小限制設置。

在具有直接上網的機器,文件傳輸方法不會與此錯誤失敗,即使數組大小> 16384

因爲只有一些你的客戶都面臨這個問題,他們可能是在防火牆後面/代理服務器,實際上是阻止訪問並返回此錯誤?

+0

同樣在這裏。忘記檢查本地地址的繞過代理服務器 – AlexDev

相關問題