0

The Scenario

I have two applications running on separate servers, within the same internal network.

Server 1 contains a WebAPI MVC Project.

Server 2 contains a MVC Web Application which calls the API on server 1.

Both Applications work using Windows Authentication.

The code works fine when I'm running them locally, both through IIS and running through Visual Studio.

When running on the server I get the following error:

The remote server returned an error: (401) Unauthorized.

Below is the request from Fiddler.

GET http://server1/..../..../GetTest HTTP/1.1
Host: server 1
Connection: keep-alive
Cache-Control: max-age=0
Authorization: Negotiate YIIHIgYGKwYBBQUCoIIHFjCCBxK.....
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2743.116 Safari/537.36
Accept:     text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate, sdch
Accept-Language: en-GB,en-US;q=0.8,en;q=0.6
Cookie: ASP.NET_SessionId=gffyzdgub41op0diygy5lyv2

Below is the API request code

public string GetTest()
{

    string sURL = "http://server2/.../api/test?value=JERONIMO";
    WebRequest wrGETURL = WebRequest.Create(sURL);

    wrGETURL.Credentials = CredentialCache.DefaultCredentials;
    var result = "";
    using (Stream objStream = wrGETURL.GetResponse().GetResponseStream()) {
        using(StreamReader objReader = new StreamReader(objStream)) {

            string sLine = "";
            int i = 0;

            while (sLine != null) {
                i++;
                sLine = objReader.ReadLine();
                if (sLine != null) result += sLine;
            }
        }
    }

    return result;
 }

Thanks for the help.

1 Answer 1

0

This is a well known problem when using Windows Authentication called double hop.

2 solutions for such a problem:

  • Change Application pool identity on Server2 from ApplicationPoolIdentity to a service Account, that we be allowed to make calls to Server1. This solution does not propagate the context as user calling api on Server2 (you can still do so by sending a parameterized info to your Server1 methods to make calls to filter out data).

  • Implement constrained delegation to allow Server2 to forward the user identity to Server1; unless you have a strong security requirement for that, I would take first approach.

4
  • Hi, thanks for the info. I'm slightly confused with solution 1. Why would I need to change the ApplicationPoolIdentity on my WebAPI Project? Shouldn't it be the MVC Web Application which runs under a service account which the WebAPI trusts? Also I found this link about disabling loopbackcheckhttps://blogs.technet.microsoft.com/sharepoint_foxhole/2010/06/21/disableloopbackcheck-lets-do-it-the-right-way/ - Is loopback the same as doublehop? And is there an issue with disabling it? Thanks again
    – SkelDave
    Sep 2, 2016 at 9:52
  • ApplicationPoolIdentity is not a Service account from an Active Directory standpoint, so when it goes outside, it is not authenticated, and therefore you get a 401. Sep 2, 2016 at 10:00
  • What I meant was: Should the MVC app be run under a Active Directory account, and the API under ApplicationPoolIdentity? Or both run under sevice accounts? Thanks.
    – SkelDave
    Sep 2, 2016 at 11:05
  • Only having Server2 running with a proper service account (having right to access to Server1) would do the job. Sep 2, 2016 at 11:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.