Hi Henrik,

From the error message, request message's security header dosn't meet the
server policy assertion's requirement. Also this occurs when you using the
Kerberos token at clientside, but works well when you using UsernameToken,
yes?  Have you ever tried only using Kerberos token from clientside
(without using choiceAssertion) to see whether you can get kerberos token
work correctly?

Thanks,

Steven Cheng
Microsoft Online Support

--------------------
From: "Henrik Skak Pedersen" <skak@community.nospam>
References: <uDOvP8Q8FHA.620@TK2MSFTNGP10.phx.gbl>
<eHap0QR8FHA.1000@tk2msftngp13.phx.gbl>
<dau3PrY8FHA.3764@TK2MSFTNGXA02.phx.gbl>
Subject: Re: UserName and Kerberos tokens at the same time
Date: Mon, 28 Nov 2005 21:10:22 +0100
Lines: 176
X-Priority: 3
X-MSMail-Priority: Normal
X-Newsreader: Microsoft Outlook Express 6.00.2900.2180
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.2180
X-RFC2646: Format=Flowed; Original
Message-ID: <OS79EfF9FHA.1484@tk2msftngp13.phx.gbl>
Newsgroups: microsoft.public.dotnet.framework.webservices.enhancements
NNTP-Posting-Host: 80.63.142.94
Path: TK2MSFTNGXA02.phx.gbl!TK2MSFTNGP08.phx.gbl!tk2msftngp13.phx.gbl
Xref: TK2MSFTNGXA02.phx.gbl
microsoft.public.dotnet.framework.webservices.enhancements:7756
X-Tomcat-NG: microsoft.public.dotnet.framework.webservices.enhancements

Hi Steven,

Again thank you very much for your reply. I tried to implement the
PolicyChoiceAssertion from the example but now I get an exception when I
run
with the KerberosAssertion. The code throws the exception when I call
HelloWorld in the example below. The PolicyChoiceAssertion is the same as
the one from the example.

Exception:
{"WSE2005: Protection requirements in KerberosAssertion are not satisfied."}

It works fine when I run with the UserNameAssertion. My policy looks like
this:

<policies xmlns="http://schemas.microsoft.com/wse/2005/06/policy">

<extensions>

<extension name="usernameOverTransportSecurity"
type="Microsoft.Web.Services3.Design.UsernameOverTransportAssertion,
Microsoft.Web.Services3, Version=3.0.0.0, Culture=neutral,
PublicKeyToken=31bf3856ad364e35" />

<extension name="kerberosSecurity"
type="Microsoft.Web.Services3.Design.KerberosAssertion,
Microsoft.Web.Services3, Version=3.0.0.0, Culture=neutral,
PublicKeyToken=31bf3856ad364e35" />

<extension name="requireActionHeader"
type="Microsoft.Web.Services3.Design.RequireActionHeaderAssertion,
Microsoft.Web.Services3, Version=3.0.0.0, Culture=neutral,
PublicKeyToken=31bf3856ad364e35" />

<extension name="policyChoice"
type="MindKey.License.Assertion.PolicyChoiceAssertion, Service Assertion
Library"/>

</extensions>

<policy name="ServicePolicy">

<policyChoice>

<usernameOverTransportSecurity />

<kerberosSecurity establishSecurityContext="false"
renewExpiredSecurityContext="true" requireSignatureConfirmation="false"
messageProtectionOrder="SignBeforeEncrypt" requireDerivedKeys="true"
ttlInSeconds="300">

<protection>

<request signatureOptions="IncludeAddressing, IncludeTimestamp,
IncludeSoapBody" encryptBody="true" />

<response signatureOptions="IncludeAddressing, IncludeTimestamp,
IncludeSoapBody" encryptBody="true" />

<fault signatureOptions="IncludeAddressing, IncludeTimestamp,
IncludeSoapBody" encryptBody="false" />

</protection>

</kerberosSecurity>

</policyChoice>

<requireActionHeader />

</policy>

</policies>

and the code calling using the KerberosAssertion looke like this:
TestWS testWS = new TestWS();

KerberosAssertion assertion = new KerberosAssertion();

assertion.KerberosTokenProvider = new KerberosTokenProvider("host/" +
System.Net.Dns.GetHostName(), ImpersonationLevel.Identification);

Policy policy = new Policy();

policy.Assertions.Add(assertion);

testWS.SetPolicy(policy);

MessageBox.Show(testWS.HelloWorld());

I hope you can helpe me!

Thanks Henrik.