I have written a web service which I am hosting in a Windows service using a
SoapReceiver.  I have this working and can call the web service from a
client.  The client is running as a domain user and the service is running
as a different user on the same domain.  Both the client and service are
.NET 2.0 assemblies and are using WSE 3.0.  Currently the client and the
service are both running on the same Window XP machine.  The 2 are
communicating over TCP port 3844 (the port number was picked arbitrarily).

Now I am trying to add Kerberos encryption to the messages.  I have added
policies to both the client and the service that signs and encrypts the
messages.  I have also added the references to the policies from both the
client and the service (the wse3policycache.config files are at the end of
this post).  Now when I attempt to call the web service I get an error.  The
error in the web service's input trace file is: "Exception thrown: An
invalid security token was provided".  The web service's output trace file
has the error: "WSE594: AcceptSecurityContext call failed with the following
error message: Logon failure: unknown user name or bad password."

This MSDN page
(http://msdn.microsoft.com/library/default.asp?url=/library/en-us/wse/html/486588
ab-b08d-4374-9390-3985c1df08e5.asp)
seems to indicate that I need to use SetSpn.exe to create a service
principal name.  I guess I also have to use a different format for
"targetPrincipal" than HOST/MachineName.  What I don't understand is what
format I should be using.

I'm hoping that somebody can tell me that yes, you can add Kerberos
encryption to the messages when using a SoapReceiver.  I am also hoping
somebody can give a clue as to how to do that.  Hopefully I have provided
adequate information.  I am more than happy to provide more info, but I
figured any more info at this point may muddy things up (and nobody will
want to read it).

Thanks.
Brian Lenway
----------------------------
On the client I have this for the policy file:

<policies xmlns="http://schemas.microsoft.com/wse/2005/06/policy">
 <extensions>
   <extension name="kerberosSecurity"
type="Microsoft.Web.Services3.Design.KerberosAssertion,
Microsoft.Web.Services3, Version=3.0.0.0, Culture=neutral,
PublicKeyToken=31bf3856ad364e35" />
   <extension name="kerberos"
type="Microsoft.Web.Services3.Design.KerberosTokenProvider,
Microsoft.Web.Services3, Version=3.0.0.0, Culture=neutral,
PublicKeyToken=31bf3856ad364e35" />
   <extension name="requireActionHeader"
type="Microsoft.Web.Services3.Design.RequireActionHeaderAssertion,
Microsoft.Web.Services3, Version=3.0.0.0, Culture=neutral,
PublicKeyToken=31bf3856ad364e35" />
   <extension name="mutualCertificate11Security"
type="Microsoft.Web.Services3.Design.MutualCertificate11Assertion,
Microsoft.Web.Services3, Version=3.0.0.0, Culture=neutral,
PublicKeyToken=31bf3856ad364e35" />
   <extension name="x509"
type="Microsoft.Web.Services3.Design.X509TokenProvider,
Microsoft.Web.Services3, Version=3.0.0.0, Culture=neutral,
PublicKeyToken=31bf3856ad364e35" />
 </extensions>
 <policy name="EncryptedMessage">
   <kerberosSecurity establishSecurityContext="false"
renewExpiredSecurityContext="true" requireSignatureConfirmation="false"
messageProtectionOrder="SignBeforeEncrypt" requireDerivedKeys="false"
ttlInSeconds="300">
     <token>
       <kerberos targetPrincipal="HOST/ServiceMachineName"
impersonationLevel="Impersonation" />
     </token>
     <protection>
       <request signatureOptions="IncludeAddressing, IncludeTimestamp,
IncludeSoapBody" encryptBody="true" />
       <response signatureOptions="IncludeAddressing, IncludeTimestamp,
IncludeSoapBody" encryptBody="true" />
       <fault signatureOptions="IncludeAddressing, IncludeTimestamp,
IncludeSoapBody" encryptBody="false" />
     </protection>
   </kerberosSecurity>
   <requireActionHeader />
 </policy>
</policies>

----------------------------
For the service I have:

<policies xmlns="http://schemas.microsoft.com/wse/2005/06/policy">
 <extensions>
   <extension name="authorization"
type="Microsoft.Web.Services3.Design.AuthorizationAssertion,
Microsoft.Web.Services3, Version=3.0.0.0, Culture=neutral,
PublicKeyToken=31bf3856ad364e35" />
   <extension name="kerberosSecurity"
type="Microsoft.Web.Services3.Design.KerberosAssertion,
Microsoft.Web.Services3, Version=3.0.0.0, Culture=neutral,
PublicKeyToken=31bf3856ad364e35" />
   <extension name="requireActionHeader"
type="Microsoft.Web.Services3.Design.RequireActionHeaderAssertion,
Microsoft.Web.Services3, Version=3.0.0.0, Culture=neutral,
PublicKeyToken=31bf3856ad364e35" />
   <extension name="mutualCertificate11Security"
type="Microsoft.Web.Services3.Design.MutualCertificate11Assertion,
Microsoft.Web.Services3, Version=3.0.0.0, Culture=neutral,
PublicKeyToken=31bf3856ad364e35" />
   <extension name="x509"
type="Microsoft.Web.Services3.Design.X509TokenProvider,
Microsoft.Web.Services3, Version=3.0.0.0, Culture=neutral,
PublicKeyToken=31bf3856ad364e35" />
 </extensions>
 <policy name="EncryptedMessage">
   <authorization>
     <allow role="DOMAIN\Users" />
     <deny user="*" />
   </authorization>
   <kerberosSecurity establishSecurityContext="false"
renewExpiredSecurityContext="true" requireSignatureConfirmation="false"
messageProtectionOrder="SignBeforeEncrypt" requireDerivedKeys="true"
ttlInSeconds="300">
     <protection>
       <request signatureOptions="IncludeAddressing, IncludeTimestamp,
IncludeSoapBody" encryptBody="true" />
       <response signatureOptions="IncludeAddressing, IncludeTimestamp,
IncludeSoapBody" encryptBody="true" />
       <fault signatureOptions="IncludeAddressing, IncludeTimestamp,
IncludeSoapBody" encryptBody="false" />
     </protection>
   </kerberosSecurity>
   <requireActionHeader />
 </policy>
</policies>