Service Account

phenotype

Is it possible to run photon service under a domain account? I tried but received an error. I want to do this so I can use integrated security to call a web service from a sub service. What rights would the domain account need?

Kaiserludi

I am doing that all the time, but I use a local (not domain-wide) admin account and have never tried it without local admin rights.

phenotype

Yes, the service is currently using the local service account but it needs to use a domain account to access the web services. When I switch to a domain account it gives me the following error;

The Photon Socket Server: LoadBalancing service failed to start due to the following error:
Access is denied.

phenotype

Answering my own post. To use a domain account, or any account, all the account needs is rights to the Photon directory.

But, I am still having difficulty calling a wcf web service from my code. I get the following error;

2013-09-14 10:06:47,665 [12] ERROR <Namespace>.Services.PhotonServer.Handlers.LoginRequestHandler [(null)] - Error: System.ServiceModel.Security.SecurityNegotiationException: The caller was not authenticated by the service. ---> System.ServiceModel.FaultException: The request for security token could not be satisfied because authentication failed.
at System.ServiceModel.Security.SecurityUtils.ThrowIfNegotiationFault(Message message, EndpointAddress target)
at System.ServiceModel.Security.SspiNegotiationTokenProvider.GetNextOutgoingMessageBody(Message incomingMessage, SspiNegotiationTokenProviderState sspiState)
--- End of inner exception stack trace ---

I have confirmed that the windowsidentity is the domain account but still no Joy. Any suggestions?

phenotype

SOLVED: This error was caused by using a FQDN to call the webservice on the same physical server as Photon. I moved the Photon server to a different physical server and the problem was resolved. This is a little know bug with iis 5.1 and greater.