Recently, we wanted to create multiple WCF services that should communicate with each other through the netMsmqBinding binding and we wanted to use a clustered MSMQ service.
However we encountered some problems and wanted to share them with you.
Situation: We run MSMQ as a part of resource group on a cluster. The service is hosted in WAS and the application pool runs under a functional user.
1. Without Windows Integration
Note: In our WCF service the security mode is set to "None".
When our services ran and started to communicate with each other we did not get any messages in the queue as we expected, actually we did not find any message on the clustered MSMQ but we saw in our tracing that the WCF service did not report any error to place a message on the queue.
After some investigation we found all test messages in the local System queue “Transactional dead-letter messages” with the report “Access denied”.
So our first thought was to check the MSMQ security on that particular queue: we started up mmc, connected to the clustered resource e.g. “MyclusteredResource” to check on the MSMQ security:
There we wanted to check the security on a queue (by right clicking on the queue) we noticed we did not have a properties option.
It seems that you cannot configure MSMQ security when connecting through the mmc console.
Microsoft pointed out that we should use an other tool to configure the security (mmcv.exe).
You can download mmcv.exe : http://www.microsoft.com/download/en/details.aspx?id=18189
You use it as follows on the active node (Where the MSMQ resource is running):
"<drive>:\<directory>\mmcv -s <Network Name of the clustered MSMQ resource>"
When you drill down to the MSMQ queues we finally got the properties option. So we went on to check the security.
Note: If you are running the mmcv.exe tool on the non-active node you will not find the Message Queueing option.
It seemed that Everyone had full control and yet we got the error message “Access denied”
After a bit of searching we found the following KB article: http://support.microsoft.com/default.aspx?scid=kb;EN-US;952570 and following blog http://blogs.msdn.com/b/tomholl/archive/2008/07/13/msmq-wcf-and-iis-getting-them-to-play-nice-part-2.aspx
This explained why we got the error message “ the message does not include the security header. Therefore, the message does not contain the user ID of the sender "
So we added the “ANONYMOUS LOGON “ to the users and gave him the appropriate rights to read / write on the queue.
After that we ran a test and all messages were delivered on the clustered MSMQ!
In the next step I’ll show you how you can check and enable the Windows Integration on your server...
2. With Windows Integration
Through the Features option in the server manager (Server 2008) you need to check if Directory Service Integration is enabled. Be aware that you need to do this for each node.
Once this feature is installed and your resources went online, an MSMQ object should be created in the active directory record of your network resource hosting your MSMQ e.g. “MyclusterresourceYou” can check it by the following steps:
Open the Active directory Users and Computers.
Through the View otpion select "Users, groups and computers as containers"
Finally search for your network resource and check if it has a MSMQ object.
If you don’t find any MSMQ object it is possible that when Directory Service Integration is installed afterwards no MSMQ object is created (more info: http://support.microsoft.com/default.aspx?scid=kb;EN-US;935498)
Once that is fixed, for Windows Integrated security you only need to add your user in the MSMQ security with mmcv.exe
Change your WCF security mode to "Transport" and enable the msmqAuthentication mode so your WCF service is ready to use Windows Authentication.
When you get the following error while starting your WCF service: "Binding validation failed because the binding's MsmqAuthenticationMode property is set to WindowsDomain but MSMQ is installed with Active Directory integration disabled. The channel factory or service host cannot be opened" then you need to check the MSMQ object in the active directory (see previous steps).