Custom Core Service page working locally in Visual Studio but not when deployed in IIS on Tridion Server

Question

I have created a custom web page which uses a component's TcmUri from the query string and provides the functionality to perform some operations on it. This Web Apllication is deployed within the Tridion CMS.

The page works fine when I run it from my local machine in Visual Studio (and pass a TcmUri in Query string). But when I deploy the webpage in Tridion CMS. I get the following error:

Exception:The server has rejected the client credentials.

The code to connect to core service is:

private SessionAwareCoreServiceClient _client;
private string _strAddress;
private EndpointAddress _endpointAddress;

_strAddress = "net.tcp://hostname:2660/CoreService/2011/netTcp";
_endpointAddress = new EndpointAddress(_strAddress);

NetTcpBinding binding = new NetTcpBinding { MaxReceivedMessageSize = 2147483647 };
XmlDictionaryReaderQuotas quota = new XmlDictionaryReaderQuotas
{
    MaxStringContentLength = 2147483647,
    MaxArrayLength = 2147483647,
};
binding.ReaderQuotas = quota;

_client = new SessionAwareCoreServiceClient(binding, _endpointAddress);
_client.ChannelFactory.Credentials.Windows.ClientCredential = new NetworkCredential("computername\\username","password" );
_client.Impersonate("Hardcoded Other User Name");

Web.Config:

<configuration>
  <system.web>
    <compilation debug="true" targetFramework="4.0"/>
    <httpRuntime/>
    <pages controlRenderingCompatibilityVersion="3.5" clientIDMode="AutoID">
      <controls>
        <add tagPrefix="ajaxToolkit" assembly="AjaxControlToolkit" namespace="AjaxControlToolkit"/>
      </controls>
    </pages>
  </system.web>
  <appSettings>
  </appSettings>
</configuration>

The custom WebPage is deployed at (%Tridion_Home%)\WebUI\Editors\CustomPublishItem. The web.config is deployed at the same location.The DLL Associated with this page is deployed at location (%Tridion_Home%)\WebUI\WebRoot\bin.

The Custom Page is available as a context option for all components in Tridion CMS. When I select a component and open the page. I get the error mentioned above. In the server, the application event log displays:

The server has rejected the client credentials.
The server has rejected the client credentials.
The logon attempt failed


Component: Tridion.ContentManager.CoreService
Errorcode: 0
User: NT AUTHORITY\NETWORK SERVICE

StackTrace Information Details:
   at System.Net.Security.NegoState.StartSendAuthResetSignal(LazyAsyncResult lazyResult, Byte[] message, Exception exception)
   at System.Net.Security.NegoState.StartSendBlob(Byte[] message, LazyAsyncResult lazyResult)
   at System.Net.Security.NegoState.CheckCompletionBeforeNextSend(Byte[] message, LazyAsyncResult lazyResult)
   at System.Net.Security.NegoState.ProcessReceivedBlob(Byte[] message, LazyAsyncResult lazyResult)
   at System.Net.Security.NegoState.StartSendBlob(Byte[] message, LazyAsyncResult lazyResult)
   at System.Net.Security.NegoState.CheckCompletionBeforeNextSend(Byte[] message, LazyAsyncResult lazyResult)
   at System.Net.Security.NegoState.ProcessReceivedBlob(Byte[] message, LazyAsyncResult lazyResult)
   at System.Net.Security.NegoState.ProcessAuthentication(LazyAsyncResult lazyResult)
   at System.Net.Security.NegotiateStream.AuthenticateAsServer(NetworkCredential credential, ProtectionLevel requiredProtectionLevel, TokenImpersonationLevel requiredImpersonationLevel)
   at System.ServiceModel.Channels.WindowsStreamSecurityUpgradeProvider.WindowsStreamSecurityUpgradeAcceptor.OnAcceptUpgrade(Stream stream, SecurityMessageProperty& remoteSecurity)
   at System.ServiceModel.Channels.WindowsStreamSecurityUpgradeProvider.WindowsStreamSecurityUpgradeAcceptor.OnAcceptUpgrade(Stream stream, SecurityMessageProperty& remoteSecurity)
   at System.ServiceModel.Channels.StreamSecurityUpgradeAcceptorBase.AcceptUpgrade(Stream stream)
   at System.ServiceModel.Channels.InitialServerConnectionReader.UpgradeConnection(IConnection connection, StreamUpgradeAcceptor upgradeAcceptor, IDefaultCommunicationTimeouts defaultTimeouts)
   at System.ServiceModel.Channels.ServerSessionPreambleConnectionReader.ServerFramingDuplexSessionChannel.OnOpen(TimeSpan timeout)
   at System.ServiceModel.Channels.CommunicationObject.Open(TimeSpan timeout)
   at System.ServiceModel.Channels.CommunicationObject.Open(TimeSpan timeout)
   at System.ServiceModel.Dispatcher.ChannelHandler.OpenAndEnsurePump()

However, the page works fine in my local machine in Visual Studio.

Please note that I do not get any error in case of basic_Http. The Tridion Version is 2011 SP 1.

What am I doing wrong.

Edit:

The username and password is of administrator, which is already added in Impersonation Users

Answer 1

Came across this answer. So I decided to dig a little more. The Tridion Content Manager Service Host process was running through network service account (NT AUTHORITY\NETWORK SERVICE). Hence I removed the code for client credentials. Started getting a new error:

The socket connection was aborted. 
This could be caused by an error processing your message or a receive 
timeout being exceeded by the remote host,  or an underlying network resource issue.

Since the service was hosted on the same computer, I changed the nettcp endpoint hostname to localhost and it worked!!

Final code:

_endpointAddress = new EndpointAddress("net.tcp://localhost:2660/CoreService/2011/netTcp");
NetTcpBinding binding = new NetTcpBinding { MaxReceivedMessageSize = 2147483647 };
XmlDictionaryReaderQuotas quota = new XmlDictionaryReaderQuotas
{
    MaxStringContentLength = 2147483647,
    MaxArrayLength = 2147483647,
};
binding.ReaderQuotas = quota;

_client = new SessionAwareCoreServiceClient(binding, _endpointAddress);
_client.Impersonate(HttpContext.Current.User.Identity.Name);

Note: The user NT AUTHORITY\NETWORK SERVICE was already added in Impersonation Users.

Answer 2

I see that you do not specify client security anywhere. I can't see it in the code where you create NetTcpBinding, nor in the app config. You do specify Windows credentials but they are not sent anywhere.

I think you need to add this part, but in code to a place where you create NetTcpBinding:

  <security mode="Message">
    <message clientCredentialType="Windows" />
  </security>