13

I have an web application written in ASP.NET MVC 4. It's an intranet application therefore I'm using Windows Authentication (Anonymous Authentication is turned off). It exposes some Web API services to other web applications.

The problem is that these services should be accessed by anonymous users from other applications. When I call the service from the browser everything works fine (which is obvious). But when I try to communicate with the service through another application it returns an 401.2 error. Decorating the API controller with anonymous attribute does not help. I tried too in web.config to set the location element like in the following code:

<location path="Controllers/Api">
<system.web>
  <authorization>
    <!-- All anonymous users access to the virtual path api -->
    <allow users="?" />
  </authorization>
</system.web>
<!-- Need to include the security overrides else it will inherit from the root of the application -->
<system.webServer>
  <security>
    <authentication>
      <!-- Need to enable anonymous access and turn off Windows authentication for the virtual path -->
      <anonymousAuthentication enabled="true"/>
      <windowsAuthentication enabled="false"/>
    </authentication>
  </security>
</system.webServer>

But it does not help either. In web.config I don't have any other sections set (I mean I don't have any authorization block).

Does anybody have any idea what is going on? Why doesn't it work? I would be grateful for any information on how I can resolve this problem.

This is my Web API action created for testing purposes:

[AllowAnonymous]
public class TestController : ApiController
{
    public string GetSayHello()
    {
        return "Hello world";
    }
}


Greetings.

2 Answers 2

7

A colleague of mine found out that you must set the location path with the actual url.
For example I have a controller named exampleController and you access it like this http://domain.com/api/example/method. Then you add the example below to your web.config. Visual studio will complain but it works.

<location path="api/example/method">
  <system.web>
    <authorization>
      <allow users="?" />
    </authorization>
  </system.web>
</location>
2

Check that IIS settings are indeed allowing anonymous access. It must have a misconfiguration in the server. One alternative is to use Fiddler for debugging. You are doing everything right from the application's perspective.

1
  • 1
    Landed here via google. Was having an issue in .Net Core 2.1 where my API was returning unauthorized, even though I had the AllowAnonymous attribute on the Controller. Your answer got me to check the settings in Visual Studio. The Enable Anonymous Authentication was not checked. Checking this did the trick.
    – Mike Casas
    Jul 24, 2018 at 14:22

Your Answer

Reminder: Answers generated by Artificial Intelligence tools are not allowed on Stack Overflow. Learn more

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.