具有外部信任的WCF SSPI失败-选择性与全域性

我在工作中遇到了一个问题,我们的应用程序在使用WCF进行SSO时,在与其他域通信时,对域信任使用选择性身份验证时失败。这是在服务器2K8R2机器上,在其两个域的完整2K8R2功能级别上(这是一个测试系统,因为我们有一个客户想要部署这种类型的东西)。

基本上,我们有两个域,分别称为A和B。当我们在域之间进行完全的双向外部(而不是林)信任时,应用程序工作正常(当然,在将用户放入另一个域的适当组之后)。然后,我们将“全域”认证的关系转换为“选择性认证”,根据我们读到的一些文档,我们需要将用户直接添加到每台计算机在广告中的条目中,并授予他们“允许认证”的权限。

它不起作用。

此外,我们还看到了其他地方,这意味着我们还必须给他们在分布式控制系统上的相同权限。这样就完成了。再次,失败。

应用程序引发的异常如下(我将其转储到一个文件中)

A call to SSPI failed, see inner exception. Stacktrace: 
Server stack trace: 
   at System.ServiceModel.Channels.WindowsStreamSecurityUpgradeProvider.WindowsStreamSecurityUpgradeInitiator.OnInitiateUpgrade(Stream stream, SecurityMessageProperty& remoteSecurity)
   at System.ServiceModel.Channels.StreamSecurityUpgradeInitiatorBase.InitiateUpgrade(Stream stream)
   at System.ServiceModel.Channels.ConnectionUpgradeHelper.InitiateUpgrade(StreamUpgradeInitiator upgradeInitiator, IConnection& connection, ClientFramingDecoder decoder, IDefaultCommunicationTimeouts defaultTimeouts, TimeoutHelper& timeoutHelper)
   at System.ServiceModel.Channels.ClientFramingDuplexSessionChannel.SendPreamble(IConnection connection, ArraySegment`1 preamble, TimeoutHelper& timeoutHelper)
   at System.ServiceModel.Channels.ClientFramingDuplexSessionChannel.DuplexConnectionPoolHelper.AcceptPooledConnection(IConnection connection, TimeoutHelper& timeoutHelper)
   at System.ServiceModel.Channels.ConnectionPoolHelper.EstablishConnection(TimeSpan timeout)
   at System.ServiceModel.Channels.ClientFramingDuplexSessionChannel.OnOpen(TimeSpan timeout)
   at System.ServiceModel.Channels.CommunicationObject.Open(TimeSpan timeout)
   at System.ServiceModel.Channels.ServiceChannel.OnOpen(TimeSpan timeout)
   at System.ServiceModel.Channels.CommunicationObject.Open(TimeSpan timeout)
   at System.ServiceModel.Channels.ServiceChannel.CallOnceManager.CallOnce(TimeSpan timeout, CallOnceManager cascade)
   at System.ServiceModel.Channels.ServiceChannel.EnsureOpened(TimeSpan timeout)
   at System.ServiceModel.Channels.ServiceChannel.Call(String action, Boolean oneway, ProxyOperationRuntime operation, Object[] ins, Object[] outs, TimeSpan timeout)
   at System.ServiceModel.Channels.ServiceChannelProxy.InvokeService(IMethodCallMessage methodCall, ProxyOperationRuntime operation)
   at System.ServiceModel.Channels.ServiceChannelProxy.Invoke(IMessage message)

Exception rethrown at [0]: 
   at System.Runtime.Remoting.Proxies.RealProxy.HandleReturnMessage(IMessage reqMsg, IMessage retMsg)
   at System.Runtime.Remoting.Proxies.RealProxy.PrivateInvoke(MessageData& msgData, Int32 type)
(A couple of calls in our own code below here)
InnerException: System.Security.Authentication.AuthenticationException: A call to SSPI failed, see inner exception. ---> System.ComponentModel.Win32Exception: Unknown error (0xc0000413)
   --- End of inner exception stack trace ---
   at System.Net.Security.NegoState.ProcessAuthentication(LazyAsyncResult lazyResult)
   at System.Net.Security.NegotiateStream.AuthenticateAsClient(NetworkCredential credential, String targetName, ProtectionLevel requiredProtectionLevel, TokenImpersonationLevel allowedImpersonationLevel)
   at System.ServiceModel.Channels.WindowsStreamSecurityUpgradeProvider.WindowsStreamSecurityUpgradeInitiator.OnInitiateUpgrade(Stream stream, SecurityMessageProperty& remoteSecurity) 

基本上就是这样。正在发生某种类型的“授权异常”。正如我所说,当它是一个全域双向信任时,就不会发生这种情况,所以我们认为我们缺少一些设置来“重新启用”以使其工作。是否有人非常了解信任,能够为我们指明正确的方向,以实现选择性身份验证,并使SSO/SSPI为此发挥作用?它已经在整个领域中起作用了,但是我们必须打开什么才能使它有选择性地工作(而且最好只对我们希望它为之工作的用户开放)?

谢谢。