wcf binding - Using WCF's net.pipe in a website with impersonate=true

Question

I'm trying to use WCF named pipes in a web site, and it's failing with errors:

There was no endpoint listening at net.pipe://localhost/mypipename that could accept the message. This is often caused by an incorrect address or SOAP action. See InnerException, if present, for more details.

and the InnerException:

The pipe name could not be obtained for net.pipe://localhost/mypipename.

and there is another inner exception giving an access denied message.

My web site is using impersonation, and looking around the internet, this seems to be relevant, but I don't know how to fix it.

Does anyone have any ideas?

Thanks Matt

Answer 1

The standard WCF NetNamedPipesBinding creates a randomly-generated pipe name when the service starts up, and also a kernel shared memory object which the WCF client-side channel stack has to consult to find out the name of the pipe.

Using impersonation on your web site means that the security context from which your WCF service is being invoked has a logon token (the impersonation token) which includes membership of the NETWORK USERS group.

When the service listener starts up, the WCF binding creates an Access Control List (ACL) on both the named pipe itself, and on the shared memory object where the pipe name is published. Both of these ACLs deny access to the NETWORK USERS group. Thus your web site, impersonating the remote user, is denied access to the shared memory object before it can even discover the pipe name. Even if it found out the pipe name some other way, it would still be denied access to the pipe.

Everything works when you remove impersonation, because now the service is being invoked in the security context of the web application worker process, whose logon token does not have membership of the NETWORK USERS group - it is a local logon.

More details at http://blogs.charteris.com/blogs/chrisdi if you're interested. I show how the ACLs can be adjusted, and in principle this approach could be used to grant access to remote users, but I don't recommend this.