WCF访问被拒绝的例外

Question

我有一个我异步调用的wcf服务。当我通过从visual studio运行服务并从客户端异步调用它来测试服务调用时，一切正常。当我将服务移动到服务器并异步调用服务时，我遇到异常。

服务器异常：

<ExceptionType>System.ServiceModel.FaultException, System.ServiceModel, Version=3.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089</ExceptionType>
<Message>Access is denied.</Message>
<StackTrace>
at System.ServiceModel.Dispatcher.AuthorizationBehavior.Authorize(MessageRpc&amp; rpc)
at System.ServiceModel.Dispatcher.ImmutableDispatchRuntime.ProcessMessage1(MessageRpc&amp; rpc)
at System.ServiceModel.Dispatcher.MessageRpc.Process(Boolean isOperationContextSet)
at System.ServiceModel.Dispatcher.ImmutableDispatchRuntime.Dispatch(MessageRpc&amp; rpc, Boolean isOperationContextSet)
at System.ServiceModel.Dispatcher.ChannelHandler.DispatchAndReleasePump(RequestContext request, Boolean cleanThread, OperationContext currentOperationContext)
at System.ServiceModel.Dispatcher.ChannelHandler.HandleRequest(RequestContext request, OperationContext currentOperationContext)
at System.ServiceModel.Dispatcher.ChannelHandler.AsyncMessagePump(IAsyncResult result)
at System.ServiceModel.Dispatcher.ChannelHandler.OnContinueAsyncReceive(Object state)
at System.ServiceModel.Channels.IOThreadScheduler.CriticalHelper.WorkItem.Invoke2()
at System.ServiceModel.Channels.IOThreadScheduler.CriticalHelper.WorkItem.OnSecurityContextCallback(Object o)
at System.Security.SecurityContext.Run(SecurityContext securityContext, ContextCallback callback, Object state)
at System.ServiceModel.Channels.IOThreadScheduler.CriticalHelper.WorkItem.Invoke()
at System.ServiceModel.Channels.IOThreadScheduler.CriticalHelper.ProcessCallbacks()
at System.ServiceModel.Channels.IOThreadScheduler.CriticalHelper.CompletionCallback(Object state)
at System.ServiceModel.Channels.IOThreadScheduler.CriticalHelper.ScheduledOverlapped.IOCallback(UInt32 errorCode, UInt32 numBytes, NativeOverlapped* nativeOverlapped)
at System.ServiceModel.Diagnostics.Utility.IOCompletionThunk.UnhandledExceptionFrame(UInt32 error, UInt32 bytesRead, NativeOverlapped* nativeOverlapped)
at System.Threading._IOCompletionCallback.PerformIOCompletionCallback(UInt32 errorCode, UInt32 numBytes, NativeOverlapped* pOVERLAP)
</StackTrace>
<ExceptionString>System.ServiceModel.FaultException: Access is denied.</ExceptionString>

客户端例外：

<Exception>
<ExceptionType>System.Reflection.TargetInvocationException, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089</ExceptionType>
<Message>An exception occurred during the operation, making the result invalid.  Check InnerException for exception details.</Message>
<StackTrace>
at System.ComponentModel.AsyncCompletedEventArgs.RaiseExceptionIfNecessary()
at RegenerateManagerApprovedDeptDocsCompletedEventArgs.get_Result() in C:\Service References\ManagePos\Reference.cs:line 476
at Tjx.Pm.Clients.PaperVisionBatchConsole.Program.client_RegenerateManagerApprovedDeptDocsCompleted(Object sender, RegenerateManagerApprovedDeptDocsCompletedEventArgs e) in C:\Client\Console\Tjx.Pm.Clients.PaperVisionBatchConsole\Program.cs:line 125
at Tjx.Pm.Common.Proxies.ManagePos.ManagePoServiceClient.OnRegenerateManagerApprovedDeptDocsCompleted(Object state) in C:\Service References\ManagePos\Reference.cs:line 1641
at System.Threading.QueueUserWorkItemCallback.WaitCallback_Context(Object state)
at System.Threading.ExecutionContext.runTryCode(Object userData)
at System.Runtime.CompilerServices.RuntimeHelpers.ExecuteCodeWithGuaranteedCleanup(TryCode code, CleanupCode backoutCode, Object userData)
at System.Threading.ExecutionContext.RunInternal(ExecutionContext executionContext, ContextCallback callback, Object state)
at System.Threading.ExecutionContext.Run(ExecutionContext executionContext, ContextCallback callback, Object state, Boolean ignoreSyncCtx)
at System.Threading.QueueUserWorkItemCallback.System.Threading.IThreadPoolWorkItem.ExecuteWorkItem()
at System.Threading.ThreadPoolWorkQueue.Dispatch()
at System.Threading._ThreadPoolWaitCallback.PerformWaitCallback()
</StackTrace>
<ExceptionString>System.Reflection.TargetInvocationException: An exception occurred during the operation, making the result invalid.  Check InnerException for exception details. ---&gt; System.ServiceModel.Security.SecurityAccessDeniedException: Access is denied.

Server stack trace: 
   at System.ServiceModel.Channels.ServiceChannel.ThrowIfFaultUnderstood(Message reply, MessageFault fault, String action, MessageVersion version, FaultConverter faultConverter)
   at System.ServiceModel.Channels.ServiceChannel.HandleReply(ProxyOperationRuntime operation, ProxyRpc&amp; rpc)
   at System.ServiceModel.Channels.ServiceChannel.EndCall(String action, Object[] outs, IAsyncResult result)
   at System.ServiceModel.Channels.ServiceChannelProxy.InvokeEndService(IMethodCallMessage methodCall, ProxyOperationRuntime operation)
   at System.ServiceModel.Channels.ServiceChannelProxy.Invoke(IMessage message)

Exception rethrown at [0]: 
   at System.Runtime.Remoting.Proxies.RealProxy.HandleReturnMessage(IMessage reqMsg, IMessage retMsg)
   at System.Runtime.Remoting.Proxies.RealProxy.PrivateInvoke(MessageData&amp; msgData, Int32 type)
   at ManagePoService.EndRegenerateManagerApprovedDeptDocs(IAsyncResult result)
   at ManagePoServiceClient.EndRegenerateManagerApprovedDeptDocs(IAsyncResult result) in C:\Service References\ManagePos\Reference.cs:line 1620
   at ManagePoServiceClient.OnEndRegenerateManagerApprovedDeptDocs(IAsyncResult result) in C:\Service References\ManagePos\Reference.cs:line 1631
   at System.ServiceModel.ClientBase`1.OnAsyncCallCompleted(IAsyncResult result)
   --- End of inner exception stack trace ---
   at System.ComponentModel.AsyncCompletedEventArgs.RaiseExceptionIfNecessary()
   at ManagePos.RegenerateManagerApprovedDeptDocsCompletedEventArgs.get_Result() in C:\Service References\ManagePos\Reference.cs:line 476
   at Program.client_RegenerateManagerApprovedDeptDocsCompleted(Object sender, RegenerateManagerApprovedDeptDocsCompletedEventArgs e) in C:\Console\Tjx.Pm.Clients.PaperVisionBatchConsole\Program.cs:line 125
   at ManagePoServiceClient.OnRegenerateManagerApprovedDeptDocsCompleted(Object state) in C:\Tjx.Pm.Common.Proxies\Service References\ManagePos\Reference.cs:line 1641
   at System.Threading.QueueUserWorkItemCallback.WaitCallback_Context(Object state)
   at System.Threading.ExecutionContext.runTryCode(Object userData)
   at System.Runtime.CompilerServices.RuntimeHelpers.ExecuteCodeWithGuaranteedCleanup(TryCode code, CleanupCode backoutCode, Object userData)
   at System.Threading.ExecutionContext.RunInternal(ExecutionContext executionContext, ContextCallback callback, Object state)
   at System.Threading.ExecutionContext.Run(ExecutionContext executionContext, ContextCallback callback, Object state, Boolean ignoreSyncCtx)
   at System.Threading.QueueUserWorkItemCallback.System.Threading.IThreadPoolWorkItem.ExecuteWorkItem()
   at System.Threading.ThreadPoolWorkQueue.Dispatch()
   at System.Threading._ThreadPoolWaitCallback.PerformWaitCallback()</ExceptionString>
<InnerException>
<Exception>
<ExceptionType>System.ServiceModel.Security.SecurityAccessDeniedException, System.ServiceModel, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089</ExceptionType>
<Message>Access is denied.</Message>
<StackTrace>
Server stack trace:
at System.ServiceModel.Channels.ServiceChannel.ThrowIfFaultUnderstood(Message reply, MessageFault fault, String action, MessageVersion version, FaultConverter faultConverter)
at System.ServiceModel.Channels.ServiceChannel.HandleReply(ProxyOperationRuntime operation, ProxyRpc&amp; rpc)
at System.ServiceModel.Channels.ServiceChannel.EndCall(String action, Object[] outs, IAsyncResult result)
at System.ServiceModel.Channels.ServiceChannelProxy.InvokeEndService(IMethodCallMessage methodCall, ProxyOperationRuntime operation)
at System.ServiceModel.Channels.ServiceChannelProxy.Invoke(IMessage message)
Exception rethrown at [0]:
at System.Runtime.Remoting.Proxies.RealProxy.HandleReturnMessage(IMessage reqMsg, IMessage retMsg)
at System.Runtime.Remoting.Proxies.RealProxy.PrivateInvoke(MessageData&amp; msgData, Int32 type)
at Tjx.Pm.Common.Proxies.ManagePos.ManagePoService.EndRegenerateManagerApprovedDeptDocs(IAsyncResult result)
at Tjx.Pm.Common.Proxies.ManagePos.ManagePoServiceClient.EndRegenerateManagerApprovedDeptDocs(IAsyncResult result) in C:\Common\Tjx.Pm.Common.Proxies\Service References\ManagePos\Reference.cs:line 1620
at ManagePoServiceClient.OnEndRegenerateManagerApprovedDeptDocs(IAsyncResult result) in C:\Tjx.Pm.Common.Proxies\Service References\ManagePos\Reference.cs:line 1631
at System.ServiceModel.ClientBase`1.OnAsyncCallCompleted(IAsyncResult result)
</StackTrace>
<ExceptionString>System.ServiceModel.Security.SecurityAccessDeniedException: Access is denied.

Server stack trace: 
   at System.ServiceModel.Channels.ServiceChannel.ThrowIfFaultUnderstood(Message reply, MessageFault fault, String action, MessageVersion version, FaultConverter faultConverter)
   at System.ServiceModel.Channels.ServiceChannel.HandleReply(ProxyOperationRuntime operation, ProxyRpc&amp; rpc)
   at System.ServiceModel.Channels.ServiceChannel.EndCall(String action, Object[] outs, IAsyncResult result)
   at System.ServiceModel.Channels.ServiceChannelProxy.InvokeEndService(IMethodCallMessage methodCall, ProxyOperationRuntime operation)
   at System.ServiceModel.Channels.ServiceChannelProxy.Invoke(IMessage message)

Exception rethrown at [0]: 
   at System.Runtime.Remoting.Proxies.RealProxy.HandleReturnMessage(IMessage reqMsg, IMessage retMsg)
   at System.Runtime.Remoting.Proxies.RealProxy.PrivateInvoke(MessageData&amp; msgData, Int32 type)
   at ManagePoService.EndRegenerateManagerApprovedDeptDocs(IAsyncResult result)
   at ManagePoServiceClient.EndRegenerateManagerApprovedDeptDocs(IAsyncResult result) in C:\Service References\ManagePos\Reference.cs:line 1620
   at ManagePoServiceClient.OnEndRegenerateManagerApprovedDeptDocs(IAsyncResult result) in C:\Service References\ManagePos\Reference.cs:line 1631
   at System.ServiceModel.ClientBase`1.OnAsyncCallCompleted(IAsyncResult result)</ExceptionString>
</Exception>

客户端配置：

  <system.serviceModel>
    <diagnostics>
      <messageLogging logMalformedMessages="true" logMessagesAtServiceLevel="true" logMessagesAtTransportLevel="true"/>
    </diagnostics>
    <extensions>
      <bindingElementExtensions>
        <add name="gzipMessageEncoding" type="Common.Utilities.GZipEncoding.GZipMessageEncodingElement, Common.Utilities, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null"/>
      </bindingElementExtensions>
      <behaviorExtensions>
        <add name="azManAuthorization" type="Common.Security.ServiceBehavior.AuthorizationBehaviorExtensionElement, Common.Security, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null"/>
      </behaviorExtensions>
    </extensions>
    <behaviors>
      <endpointBehaviors>
        <behavior name="LookupServiceQuotaBehavior">
          <azManAuthorization/>
          <dataContractSerializer maxItemsInObjectGraph="1000000"/>
        </behavior>
        <behavior name="AuthorizationEndPointBehavior">
          <azManAuthorization/>
        </behavior>
      </endpointBehaviors>
    </behaviors>
    <bindings>
      <customBinding>
        <binding name="WorksheetServiceEndPoint" sendTimeout="00:02:00" receiveTimeout="00:02:00">
          <gzipMessageEncoding innerMessageEncoding="textMessageEncoding">
            <readerQuotas maxDepth="2147483647" maxStringContentLength="2147483647" maxArrayLength="2147483647" maxBytesPerRead="2147483647" maxNameTableCharCount="2147483647"/>
          </gzipMessageEncoding>
          <security defaultAlgorithmSuite="Basic128" authenticationMode="Kerberos" requireDerivedKeys="true" securityHeaderLayout="Strict" includeTimestamp="true" keyEntropyMode="CombinedEntropy" messageProtectionOrder="SignBeforeEncryptAndEncryptSignature" messageSecurityVersion="WSSecurity11WSTrustFebruary2005WSSecureConversationFebruary2005WSSecurityPolicy11BasicSecurityProfile10" requireSignatureConfirmation="false">
            <localClientSettings cacheCookies="true" detectReplays="true" replayCacheSize="900000" maxClockSkew="00:05:00" maxCookieCachingTime="Infinite" replayWindow="00:05:00" sessionKeyRenewalInterval="10:00:00" sessionKeyRolloverInterval="00:05:00" reconnectTransportOnFailure="true" timestampValidityDuration="00:05:00" cookieRenewalThresholdPercentage="60"/>
            <localServiceSettings detectReplays="true" issuedCookieLifetime="10:00:00" maxStatefulNegotiations="128" replayCacheSize="900000" maxClockSkew="00:05:00" negotiationTimeout="00:01:00" replayWindow="00:05:00" inactivityTimeout="00:02:00" sessionKeyRenewalInterval="15:00:00" sessionKeyRolloverInterval="00:05:00" reconnectTransportOnFailure="true" maxPendingSessions="128" maxCachedCookies="1000" timestampValidityDuration="00:05:00"/>
            <secureConversationBootstrap/>
          </security>
          <httpTransport manualAddressing="false" maxBufferPoolSize="524288" maxReceivedMessageSize="2147483647" allowCookies="false" authenticationScheme="Anonymous" bypassProxyOnLocal="false" hostNameComparisonMode="StrongWildcard" keepAliveEnabled="true" maxBufferSize="2147483647" proxyAuthenticationScheme="Anonymous" realm="" transferMode="Buffered" unsafeConnectionNtlmAuthentication="false" useDefaultWebProxy="true"/>
        </binding>
      </customBinding>
    </bindings>
    <client>
      <endpoint address="http://server1:8100/V2.0/ManagePoService.svc" binding="customBinding" behaviorConfiguration="LookupServiceQuotaBehavior" bindingConfiguration="WorksheetServiceEndPoint" contract="ManagePoService" name="ManagePoServiceEndPoint">
        <identity>
          <servicePrincipalName value="User1@corp.abccorp.net"/>
        </identity>
      </endpoint>
    </client>
  </system.serviceModel>

服务器配置：

<system.serviceModel>
    <serviceHostingEnvironment>
      <baseAddressPrefixFilters>
        <add prefix="http://fra1vmos01d.abc.com:8100"/>
      </baseAddressPrefixFilters>
    </serviceHostingEnvironment>
    <extensions>
      <bindingElementExtensions>
        <add name="gzipMessageEncoding" type="Common.Utilities.GZipEncoding.GZipMessageEncodingElement, Common.Utilities, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null" />
      </bindingElementExtensions>
    </extensions>
    <diagnostics>
      <messageLogging logMalformedMessages="false" logMessagesAtServiceLevel="false" logMessagesAtTransportLevel="false" />
    </diagnostics>
    <bindings>
      <customBinding>
        <binding name="Server.Services.CustomWsBinding"  sendTimeout="00:02:00" receiveTimeout="00:02:00">
          <gzipMessageEncoding innerMessageEncoding="textMessageEncoding">
            <readerQuotas maxArrayLength="2147483647" maxDepth="2147483647" maxStringContentLength="2147483647" />
          </gzipMessageEncoding>
          <security authenticationMode="Kerberos" requireSecurityContextCancellation="false">
            <secureConversationBootstrap authenticationMode="Kerberos" requireSecurityContextCancellation="false"></secureConversationBootstrap>
          </security>
          <httpTransport maxReceivedMessageSize="2147483647" maxBufferSize="2147483647"  />
        </binding>
      </customBinding>
    </bindings>
    <services>
      <service behaviorConfiguration="Server.Services.PoBehavior" name="Server.Framework.Po.Facade.ManagePoFacade">
        <endpoint binding="customBinding"
                  bindingConfiguration="Server.Services.CustomWsBinding"
                  name="ManagePoServiceEndPoint"
                  bindingNamespace="urn:Common.Types.ServiceContracts.ManagePoService"
                  contract="Common.Types.ServiceContracts.Po.IManagePoService"
                  behaviorConfiguration="LookupServiceQuotaBehavior" >
          <identity>
            <servicePrincipalName value="User1@corp.abccorp.net"/>
          </identity>
        </endpoint>
        <endpoint address="/ws"
                  binding="wsHttpBinding"
                  bindingConfiguration="Server.Services.WsBinding"
                  name="ManagePoServiceEndPoint_WsBinding"
                  bindingNamespace="urn:Common.Types.ServiceContracts.ManagePoService"
                  contract="Common.Types.ServiceContracts.Po.IManagePoService"
                  behaviorConfiguration="LookupServiceQuotaBehavior" />
      </service>
    </services>
    <behaviors>
      <endpointBehaviors>
        <behavior name="LookupServiceQuotaBehavior">
          <dataContractSerializer maxItemsInObjectGraph="1000000" />
        </behavior>
      </endpointBehaviors>
      <serviceBehaviors>
        <behavior name="Server.Services.PoBehavior">
          <serviceMetadata httpGetEnabled="true" />
          <serviceDebug includeExceptionDetailInFaults="true" />
          <serviceAuthorization principalPermissionMode="UseWindowsGroups"
           serviceAuthorizationManagerType="Common.Security.AuthorizationManager, Common.Security" />
          <serviceThrottling
               maxConcurrentCalls="250"
               maxConcurrentInstances="2147483647"
               maxConcurrentSessions="250"/>
        </behavior>
      </serviceBehaviors>
    </behaviors>      
  </system.serviceModel>