title: WCF Fails when using impersonation over 2 machine boundaries (3 machines)
body: <p>These scenarios work in their pieces. Its when i put it all together that it breaks.</p>
  
  <p>I have a WCF service using netTCP that uses impersonation to get the callers ID (role based security will be used at this level)</p>
  
  <p>on top of this is a WCF service using basicHTTP with TransportCredientialOnly which also uses impersonation</p>
  
  <p>I then have a client front end that connects to the basicHttp.</p>
  
  <p>the aim of the game is to return the clients username from the netTCP service at the bottom - so ultimatley i can use role based security here.</p>
  
  <p>each service is on a different machine - and each service works when you remove any calls they make to other services when you run a client for them both locally and remotley. IE the problem only manifests when you jump accross more than one machine boundary.</p>
  
  <p>IE  the setup breaks when i connect each part together - but they work fine on their own.</p>
  
  <p>I also specify</p>
  
  <p>[OperationBehavior(Impersonation = ImpersonationOption.Required)] in the method and </p>
  
  <p>have IIS setup to only allow windows authentication (actually i have ananymous enabled still, but disabling makes no difference)</p>
  
  <p>This impersonation works fine in the scenario where i have a netTCP Service on Machine A with a client with a basicHttp service on machine B with a clinet for the basicHttp service also on machine B ... however if i move that client to any machine C i get the following error:</p>
  
  <p>The exception is 'The socket connection was aborted. This could be caused by an error processing your message or a receive timeout being exceeded by the remote host, or an underlying network resource issue. Local socket timeout was '00:10:00''
  the inner message is 'An existing connection was forcibly closed by the remote host'</p>
  
  <p>Am beginning to think this is more a network issue than config ... but then im grasping at straws ...</p>
  
  <p>the config files are as follows (heading from the client down to the netTCP layer)</p>
  
  <pre><code>&lt;?xml version="1.0" encoding="utf-8" ?&gt;
  &lt;configuration&gt;
      &lt;system.serviceModel&gt;
          &lt;bindings&gt;
              &lt;basicHttpBinding&gt;
                  &lt;binding name="basicHttpBindingEndpoint" closeTimeout="00:02:00"
                      openTimeout="00:02:00" receiveTimeout="00:10:00" sendTimeout="00:02:00"
                      allowCookies="false" bypassProxyOnLocal="false" hostNameComparisonMode="StrongWildcard"
                      maxBufferSize="65536" maxBufferPoolSize="524288" maxReceivedMessageSize="65536"
                      messageEncoding="Text" textEncoding="utf-8" transferMode="Buffered"
                      useDefaultWebProxy="true"&gt;
                      &lt;readerQuotas maxDepth="32" maxStringContentLength="8192" maxArrayLength="16384"
                          maxBytesPerRead="4096" maxNameTableCharCount="16384" /&gt;
                      &lt;security mode="TransportCredentialOnly"&gt;
                          &lt;transport clientCredentialType="Windows" proxyCredentialType="None"
                              realm="" /&gt;
                          &lt;message clientCredentialType="UserName" algorithmSuite="Default" /&gt;
                      &lt;/security&gt;
                  &lt;/binding&gt;
              &lt;/basicHttpBinding&gt;
          &lt;/bindings&gt;
          &lt;client&gt;
              &lt;endpoint address="http://panrelease01/WCFTopWindowsTest/Service1.svc"
                  binding="basicHttpBinding" bindingConfiguration="basicHttpBindingEndpoint"
                  contract="ServiceReference1.IService1" name="basicHttpBindingEndpoint" 
   behaviorConfiguration="ImpersonationBehaviour" /&gt;
          &lt;/client&gt;
    &lt;behaviors&gt;
     &lt;endpointBehaviors&gt;
      &lt;behavior name="ImpersonationBehaviour"&gt;
       &lt;clientCredentials&gt;
        &lt;windows allowedImpersonationLevel="Impersonation"/&gt;
       &lt;/clientCredentials&gt;
      &lt;/behavior&gt;
     &lt;/endpointBehaviors&gt;
    &lt;/behaviors&gt;
      &lt;/system.serviceModel&gt;
  &lt;/configuration&gt;
  </code></pre>
  
  <p>the service for the client (basicHttp service and the client for the netTCP service)</p>
  
  <pre><code>&lt;?xml version="1.0" encoding="UTF-8"?&gt;
  &lt;configuration&gt;
  
    &lt;system.web&gt;
      &lt;compilation debug="true" targetFramework="4.0" /&gt;
    &lt;/system.web&gt;
    &lt;system.serviceModel&gt;
      &lt;bindings&gt;
        &lt;netTcpBinding&gt;
          &lt;binding name="netTcpBindingEndpoint" closeTimeout="00:01:00"
            openTimeout="00:01:00" receiveTimeout="00:10:00" sendTimeout="00:01:00"
            transactionFlow="false" transferMode="Buffered" transactionProtocol="OleTransactions"
            hostNameComparisonMode="StrongWildcard" listenBacklog="10" maxBufferPoolSize="524288"
            maxBufferSize="65536" maxConnections="10" maxReceivedMessageSize="65536"&gt;
            &lt;readerQuotas maxDepth="32" maxStringContentLength="8192" maxArrayLength="16384"
              maxBytesPerRead="4096" maxNameTableCharCount="16384" /&gt;
            &lt;reliableSession ordered="true" inactivityTimeout="00:10:00"
              enabled="false" /&gt;
            &lt;security mode="Transport"&gt;
              &lt;transport clientCredentialType="Windows" protectionLevel="EncryptAndSign" /&gt;
              &lt;message clientCredentialType="Windows" /&gt;
            &lt;/security&gt;
          &lt;/binding&gt;
        &lt;/netTcpBinding&gt;
    &lt;basicHttpBinding&gt;
     &lt;binding name="basicHttpWindows"&gt;
      &lt;security mode="TransportCredentialOnly"&gt;
       &lt;transport clientCredentialType="Windows"&gt;&lt;/transport&gt;
      &lt;/security&gt;
     &lt;/binding&gt;
    &lt;/basicHttpBinding&gt;
      &lt;/bindings&gt;
      &lt;client&gt;
        &lt;endpoint address="net.tcp://5d2x23j.panint.com/netTCPwindows/Service1.svc"
      binding="netTcpBinding" 
      bindingConfiguration="netTcpBindingEndpoint"
      contract="ServiceReference1.IService1" 
      name="netTcpBindingEndpoint"
      behaviorConfiguration="ImpersonationBehaviour"&gt;
          &lt;identity&gt;
            &lt;dns value="localhost" /&gt;
          &lt;/identity&gt;
        &lt;/endpoint&gt;
      &lt;/client&gt;
      &lt;behaviors&gt;
    &lt;endpointBehaviors&gt;
     &lt;behavior name="ImpersonationBehaviour"&gt;
      &lt;clientCredentials&gt;
       &lt;windows allowedImpersonationLevel="Impersonation" allowNtlm="true"/&gt;
      &lt;/clientCredentials&gt;
     &lt;/behavior&gt;
    &lt;/endpointBehaviors&gt;
        &lt;serviceBehaviors&gt;
          &lt;behavior name="WCFTopWindowsTest.basicHttpWindowsBehaviour"&gt;
            &lt;!-- To avoid disclosing metadata information, set the value below to false and remove the metadata endpoint above before deployment --&gt;
            &lt;serviceMetadata httpGetEnabled="true" /&gt;
            &lt;!-- To receive exception details in faults for debugging purposes, set the value below to true.  Set to false before deployment to avoid disclosing exception information --&gt;
            &lt;serviceDebug includeExceptionDetailInFaults="true" /&gt;
          &lt;/behavior&gt;
        &lt;/serviceBehaviors&gt;
      &lt;/behaviors&gt;
     &lt;services&gt;
      &lt;service name="WCFTopWindowsTest.Service1"
         behaviorConfiguration="WCFTopWindowsTest.basicHttpWindowsBehaviour"&gt;
       &lt;endpoint address=""
        binding="basicHttpBinding"
        bindingConfiguration="basicHttpWindows"
        name ="basicHttpBindingEndpoint"
        contract ="WCFTopWindowsTest.IService1"&gt;
  
       &lt;/endpoint&gt;      
     &lt;/service&gt;       
     &lt;/services&gt;
      &lt;serviceHostingEnvironment multipleSiteBindingsEnabled="true" /&gt;
    &lt;/system.serviceModel&gt;
   &lt;system.webServer&gt;
      &lt;modules runAllManagedModulesForAllRequests="true" /&gt;
          &lt;directoryBrowse enabled="true" /&gt;
    &lt;/system.webServer&gt;
  
  &lt;/configuration&gt;
  </code></pre>
  
  <p>then finally the service for the netTCP layer</p>
  
  <pre><code>&lt;?xml version="1.0" encoding="UTF-8"?&gt;
  &lt;configuration&gt;
  
    &lt;system.web&gt;
     &lt;authentication mode="Windows"&gt;&lt;/authentication&gt;
     &lt;authorization&gt;
      &lt;allow roles="*"/&gt;
     &lt;/authorization&gt;
      &lt;compilation debug="true" targetFramework="4.0" /&gt;
          &lt;identity impersonate="true" /&gt;
    &lt;/system.web&gt;
    &lt;system.serviceModel&gt;
     &lt;bindings&gt;
      &lt;netTcpBinding&gt;
       &lt;binding name="netTCPwindows"&gt;
        &lt;security mode="Transport"&gt;
         &lt;transport clientCredentialType="Windows"&gt;&lt;/transport&gt;
        &lt;/security&gt;
       &lt;/binding&gt;
      &lt;/netTcpBinding&gt;
     &lt;/bindings&gt;
     &lt;services&gt;
      &lt;service behaviorConfiguration="netTCPwindows.netTCPwindowsBehaviour" name="netTCPwindows.Service1"&gt;
       &lt;endpoint address="" bindingConfiguration="netTCPwindows" binding="netTcpBinding" name="netTcpBindingEndpoint" contract="netTCPwindows.IService1"&gt;
        &lt;identity&gt;
         &lt;dns value="localhost" /&gt;
        &lt;/identity&gt;
       &lt;/endpoint&gt;  
       &lt;endpoint address="mextcp" binding="mexTcpBinding" contract="IMetadataExchange"/&gt;
       &lt;host&gt;
        &lt;baseAddresses&gt;     
         &lt;add baseAddress="net.tcp://localhost:8721/test2" /&gt;
        &lt;/baseAddresses&gt;
       &lt;/host&gt;
      &lt;/service&gt;       
     &lt;/services&gt;   
      &lt;behaviors&gt;  
        &lt;serviceBehaviors&gt;
          &lt;behavior name="netTCPwindows.netTCPwindowsBehaviour"&gt;  
  
            &lt;!-- To avoid disclosing metadata information, set the value below to false and remove the metadata endpoint above before deployment --&gt;
            &lt;serviceMetadata httpGetEnabled="false" /&gt;
            &lt;!-- To receive exception details in faults for debugging purposes, set the value below to true.  Set to false before deployment to avoid disclosing exception information --&gt;
            &lt;serviceDebug includeExceptionDetailInFaults="true" /&gt;
          &lt;/behavior&gt;
        &lt;/serviceBehaviors&gt;
      &lt;/behaviors&gt;
      &lt;serviceHostingEnvironment multipleSiteBindingsEnabled="true" /&gt;
    &lt;/system.serviceModel&gt;
   &lt;system.webServer&gt;
      &lt;modules runAllManagedModulesForAllRequests="true" /&gt;
          &lt;directoryBrowse enabled="true" /&gt;
    &lt;/system.webServer&gt;
  
  &lt;/configuration&gt;
  </code></pre>