title: Request for principal permission failed - probably due windows group?
body: <p>I googled for this error, didn't find correct answer.. 2 months ago I was doing MVC -> WCF communication. It worked, then I commented out PrincipalPermission attribute to get it working on localhost (VS IIS Express).</p>
  
  <p>After re-enable I receiving error "Request for principal permission failed." I suppose my group is wrong.</p>
  
  <p>WCF side:</p>
  
  <pre><code>[ServiceBehavior(InstanceContextMode = InstanceContextMode.Single, ConcurrencyMode = ConcurrencyMode.Multiple)]
  [AspNetCompatibilityRequirements(RequirementsMode = AspNetCompatibilityRequirementsMode.Required)]
  [PrincipalPermission(SecurityAction.Demand, Role = "Test_Group")]
  public class TestService : ITestService
  {
      public int Test()
      {
          return 0;
      }
  }
  </code></pre>
  
  <p>Client side:</p>
  
  <pre><code>public async Task&lt;ActionResult&gt; Test()
      {
          Services.TestClientService testClient = new Services.TestClientService();
          testClient.ClientCredentials.Windows.ClientCredential = System.Net.CredentialCache.DefaultNetworkCredentials;
          testClient.ClientCredentials.Windows.AllowedImpersonationLevel = TokenImpersonationLevel.Impersonation;
  
          try
          {
              int response = await testClient.TestAsync();
          }
          catch(Exception ex)
          {
              System.Diagnostics.Debug.WriteLine(ex.Message);
          }
  
          return View();
      }
  </code></pre>
  
  <p>WCF web config:</p>
  
  <pre><code>&lt;system.serviceModel&gt;
  &lt;behaviors&gt;
    &lt;serviceBehaviors&gt;
      &lt;behavior name="authBehavior"&gt;
        &lt;!-- serviceAuthorizationManagerType="MyProject.Common.RoleAuthorizationManager, MyProject" --&gt;
        &lt;serviceAuthorization principalPermissionMode="UseWindowsGroups"&gt;
          &lt;authorizationPolicies&gt;
            &lt;add policyType="MyProject.Common.AuthorizationPolicy, MyProject" /&gt;
          &lt;/authorizationPolicies&gt;
        &lt;/serviceAuthorization&gt;
        &lt;serviceCredentials&gt;
          &lt;userNameAuthentication userNamePasswordValidationMode="Custom" customUserNamePasswordValidatorType="MyProject.Common.IdentityValidator, MyProject" /&gt;
          &lt;serviceCertificate findValue="localhost" storeLocation="LocalMachine" x509FindType="FindBySubjectName" storeName="My" /&gt;
        &lt;/serviceCredentials&gt;
        &lt;serviceMetadata httpGetEnabled="true" httpsGetEnabled="true" /&gt;
        &lt;serviceDebug includeExceptionDetailInFaults="true" /&gt;
      &lt;/behavior&gt;
      &lt;behavior name="svcBehavior"&gt;
        &lt;serviceMetadata httpGetEnabled="true" httpsGetEnabled="true" /&gt;
        &lt;serviceDebug includeExceptionDetailInFaults="true" /&gt;
      &lt;/behavior&gt;
      &lt;behavior name=""&gt;
        &lt;serviceMetadata httpGetEnabled="true" httpsGetEnabled="true" /&gt;
        &lt;serviceDebug includeExceptionDetailInFaults="true" /&gt;
      &lt;/behavior&gt;
    &lt;/serviceBehaviors&gt;
  &lt;/behaviors&gt;
  &lt;bindings&gt;
    &lt;wsHttpBinding&gt;
      &lt;binding name="wsHttpEndpointBinding"&gt;
        &lt;security mode="Message"&gt;
          &lt;message clientCredentialType="Windows" /&gt;
        &lt;/security&gt;
      &lt;/binding&gt;
    &lt;/wsHttpBinding&gt;
  &lt;/bindings&gt;
  &lt;services&gt;
    &lt;service name="MyProject.TestService" behaviorConfiguration="authBehavior"&gt;
      &lt;endpoint address="" binding="wsHttpBinding" bindingConfiguration="wsHttpEndpointBinding" contract="MyProject.ITestService" /&gt;
      &lt;endpoint address="mex" binding="mexHttpBinding" contract="IMetadataExchange" /&gt;
    &lt;/service&gt;
  &lt;/services&gt;
  &lt;!-- &lt;protocolMapping&gt;
    &lt;add binding="wsDualHttpBinding" scheme="https" /&gt;
  &lt;/protocolMapping&gt;--&gt;
  &lt;serviceHostingEnvironment aspNetCompatibilityEnabled="true" multipleSiteBindingsEnabled="true" /&gt;
  </code></pre>
  
  <p></p>
  
  <p>Client webconfig:</p>
  
  <pre><code>&lt;system.serviceModel&gt;
  &lt;behaviors&gt;
    &lt;endpointBehaviors&gt;
      &lt;behavior&gt;
        &lt;customInspector /&gt;
      &lt;/behavior&gt;
    &lt;/endpointBehaviors&gt;
  &lt;/behaviors&gt;
  &lt;bindings&gt;
    &lt;basicHttpBinding&gt;
      &lt;binding name="BasicHttpBinding" /&gt;
    &lt;/basicHttpBinding&gt;
    &lt;wsHttpBinding&gt;
      &lt;binding name="wsHttpEndpointBinding"&gt;
        &lt;security mode="Message"&gt;
          &lt;message clientCredentialType="Windows" /&gt;
        &lt;/security&gt;
      &lt;/binding&gt;
    &lt;/wsHttpBinding&gt;
  &lt;/bindings&gt;
  &lt;extensions&gt;
    &lt;behaviorExtensions&gt;
      &lt;add name="customInspector" type="MyMVC.Services.WCF.Behavior, MyMVC" /&gt;
    &lt;/behaviorExtensions&gt;
  &lt;/extensions&gt;
  &lt;client&gt;
    &lt;endpoint address="http://localhost:9999/TestService.svc"
      binding="wsHttpBinding" bindingConfiguration="wsHttpEndpointBinding"
      contract="MyMVC.Services.ITestService" name="wsHttpEndpointBinding_ITestService" /&gt;
  &lt;/client&gt;
  </code></pre>
  
  <p></p>
  
  <p>I can't reach WCF AuthorizationPolicy.cs to check if Thread.CurrentPrincipal is set or not.</p>
  
  <p>Any idea how to debug what's wrong? What I think it's problem of Test_Group in windows. WCF and MVC runs in IIS. MVC runs under IIS APPPOOL\MVC which is member of Test_Group.</p>
  
  <p>Thanks for help.</p>