title: Why is kerberos defaulting to NTLM in WCF?
body: <p>Got a simple WCF demo app that has two console projects--host and client.  Both are running on my machine (win 7 box).  I'm using the netTcpBinding, which uses windows authentication.  </p>
  
  <p><strong>The issue is that authentication is downgrading to NTLM from kerberos, and I can't figure out why.</strong></p>
  
  <p>If I use       </p>
  
  <pre><code>&lt;clientCredentials&gt;
     &lt;windows allowNtlm="true" /&gt;
  &lt;/clientCredentials&gt;
  </code></pre>
  
  <p>on the client side, everything is cool.  But if I change that to <code>false</code>, I get the following exception:</p>
  
  <blockquote>
    <p>SecurityNegotiationException:  The
    remote server did not satisfy the
    mutual authentication requirement.</p>
  </blockquote>
  
  <p>This suggests that kerberos is failing and since the client won't allow NTLM the call results in an exception being thrown.</p>
  
  <p>Is this an issue with the project, or is it an external issue caused by the configuration of my development machine?  </p>
  
  <hr>
  
  <p>Solution:</p>
  
  <p>Apparently, I have to specify the identity of the server within the client configuration.  In my case, the server is running under my identity, so I modify the client thusly:</p>
  
  <pre><code>&lt;client&gt;
    &lt;endpoint address="net.tcp://dev7.HurrDurr.com:12345/MyService" 
              binding="netTcpBinding" 
              bindingConfiguration="MyBindingConfigurationLol" 
              behaviorConfiguration="HurrDurrServiceEndpoint" 
              contract="ShaolinCore.ICommunicationService"&gt;
      &lt;!-- start changes here --&gt;
      &lt;identity&gt;
        &lt;userPrincipalName value="myusername@mydomain"/&gt;
      &lt;/identity&gt;
      &lt;!-- end changes here --&gt;
    &lt;/endpoint&gt;
  &lt;/client&gt;
  </code></pre>
  
  <p>I'm not sure why this fixes the issue.  Okay, now on the client side I fully trust the server (hey, I know that guy!).  But since NTLM is less secure than kerberos, why isn't it the other way around?  If I don't fully trust the server, I use kerberos, otherwise ntlm is fine.  </p>
  
  <p>Or, OTOH, if I don't fully trust the server why does it work at all?  "SecurityException:  Endpoint identity not set.  WCF cannot trust the identity of the server and will not transmit client identity."  </p>