title: How to use netTcpBinding with Message level security?
body: <p>I am migrating my WSE3 services to WCF platform. Clients are going to be legacy WSE3 clients.</p>
  
  <p>To achieve some requirements, I have created custom service behavior. The configuration (in <code>web.config</code>) for the service behavior contains the <code>serviceCertificate</code> element. </p>
  
  <p>This behavior is applied to my service using <code>behaviorConfiguration</code> setting. Now I want to call one WCF service from another WCF service hosted in the same IIS 7.5. So I added the <code>netTcpBinding</code> (and netNamedPipeBinding too). When I invoked an OperationContract of another service from any WCF service, it used to give me <code>Access is denied.</code> error. I removed the <code>behaviorConfiguration</code> setting for the service and then <code>netTcpBinding</code> (and netNamedPipeBinding) worked.</p>
  
  <p>Configuration as below:</p>
  
  <pre><code>&lt;services&gt;
            &lt;service name="Services.AuthorizationService" behaviorConfiguration="LegacyBehavior"&gt;
              &lt;endpoint contract="IMetadataExchange" binding="mexHttpBinding" address="mex" &gt;
              &lt;endpoint
                name="AuthorizationService"
                address=""
                binding="wsHttpBinding"               contract="ServiceContracts.IAuthorizationService" /&gt;
              &lt;endpoint address="net.pipe://localhost/TestSite/AuthorizationService.svc"
                     binding="netNamedPipeBinding"                   contract="ServiceContracts.IAuthorizationService"
                     name="AuthorizationNamedPipeEndpoint"/&gt;  
  </code></pre>
  
  <p><br>
                
      </p>
  
  <p>The service behavior configuration in web.config is:</p>
  
  <pre><code>&lt;behavior name="LegacyBehavior"&gt;
            &lt;dataContractSerializer maxItemsInObjectGraph="2147483646"/&gt;
            &lt;serviceAuthorization
              principalPermissionMode="Custom"
              serviceAuthorizationManagerType="Legacy.AuthorizationManager,Legacy.Services" &gt;
            &lt;serviceDebug
              httpHelpPageEnabled="true"
              includeExceptionDetailInFaults="true" /&gt;
            &lt;serviceMetadata httpGetEnabled="true" /&gt;
            &lt;serviceCredentials&gt;
              &lt;serviceCertificate
                findValue="CN=WSE2QuickStartServer"
                storeLocation="LocalMachine"
                storeName="My"
                x509FindType="FindBySubjectDistinguishedName" /&gt;
              &lt;issuedTokenAuthentication
                audienceUriMode="Always"
                certificateValidationMode="PeerOrChainTrust"
                revocationMode="NoCheck"
                trustedStoreLocation="LocalMachine"
                samlSerializerType="Legacy.TokenSerializer, Legacy.Services"
                allowUntrustedRsaIssuers="false"&gt;
                &lt;allowedAudienceUris&gt;
                  &lt;add allowedAudienceUri="http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue/SAML" /&gt;
                &lt;/allowedAudienceUris&gt;
              &lt;/issuedTokenAuthentication&gt;
            &lt;/serviceCredentials&gt;
          &lt;/behavior&gt;
  </code></pre>
  
  <p>The binding configuration for <code>netTcpBinding</code> is as follows:</p>
  
  <p>
      
        
      </p>
  
  <p>I want to know, </p>
  
  <ol>
  <li>How to use the netTcpBinding in such scenario?</li>
  <li>can I use two different behaviors for the same service? If yes, how?</li>
  <li>If no, How can I achieve named pipe binding in this scenario?</li>
  <li>Why would server certificate related stuff be causing <code>Access is denied</code> error?
  There is no inner exception; just Accedd denied message!</li>
  </ol>