2

I use a self hosted service within a WPF application for certain tasks. The service host is started at runtime and its base address is http://localhost:Whatever-port-is-free-at-runtime. This works fine when the user has admin rights but problems arise when the application is ran by a restricted user.

I found some suggestions on the web that suggested reserving the url using netsh/httpcfg which works fine for admin users but fails for restricted users because they presumably do not have the rights to use these tools to reserve a url. As the port number is not known until runtime the url reservation command can logically only be run at runtime which means the process will be initiated by a restricted user without the right privilege to execute the command. Am i correct in thinking this?

What i would like to know is if there is a suitable work around? Also, i would like to know if a restricted user can open a locally hosted WCF service at all, since solving the aforementioned problem will be pointless if the restricted user couldn't do this.

This question perfectly describes my first issue of URL reservation

Community
  • 1
  • 1
Bablo
  • 906
  • 7
  • 18
  • 1
    Is this service consumed by any of the clients? If yes, then how can the client consume the service as its address changes as its being generated dynamically. Also why can you not have a fixed port for the WCF service? – Rajesh Mar 20 '13 at 17:02
  • Yes it is consumed by other clients. The dynamically generated localhost:xxxx urls are made known to the clients at runtime so this isn't an issue as this setup actually works when run as admin. I cannot have a fixed port because i cannot determine if the hard-coded port number is free on the end user's machine and even if it was i still have the same problem as i would still need to reserve the namespace regardless. – Bablo Mar 20 '13 at 17:51

1 Answers1

1

In WCF, the HTTP and HTTPS bindings use HTTP.sys under the cover to reserve a required URL for a specific WCF service, which is the same path IIS itself follows while doing the bindings for the websites it manages. This explains why the process performing the HTTP/HTTPS binding is required to run in elevated mode.

That being said, I would solve your issue in two different ways:

Option 1: use a different kind of binding. NetTcpBinding and NetNamedPipesBinding, for example, do not generally require administrative privileges: this is by far the easiest way to go.

Option 2: setup the required namespace reservation at installation time. This way you may ask your users to perform the installation in elevated mode and later allow restricted accounts to run it. While performing the initial installation/reservation you may also find out an available port to use (and perhaps save it in a configuration file for later reuse).

Efran Cobisi
  • 6,138
  • 22
  • 22