1

I have a WCF problem. Been stuck here for days.

  • I have my WCF Service and Client working perfectly on the intranet.
  • I deployed the same service/client on our IIS server exposed over the internet. This service, i am able to access perfectly from my workstatation, using the internet site (the .com address)
  • However, when accessing the same .com site using a computer not connected to our network, it's giving me the dreaded "The HTTP request is unauthorized with client authentication scheme 'Negotiate'. The authentication header received from the server was 'Negotiate, NTLM'" when accessing the Service

Other Info: The client authenticates me. When the client is accessing the WCF Service, i get the error.

Client Web.Config:

<system.serviceModel>
  <bindings>
   <basicHttpBinding>
    <binding name="BasicHttpEndpoint" closeTimeout="00:01:00" openTimeout="00:01:00"
     receiveTimeout="00:10:00" sendTimeout="00:01:00" allowCookies="true"
     bypassProxyOnLocal="false" hostNameComparisonMode="StrongWildcard"
     maxBufferSize="65536" maxBufferPoolSize="524288" maxReceivedMessageSize="65536"
     messageEncoding="Text" textEncoding="utf-8" transferMode="Buffered"
     useDefaultWebProxy="true">
     <readerQuotas maxDepth="32" maxStringContentLength="8192" maxArrayLength="16384"
      maxBytesPerRead="4096" maxNameTableCharCount="16384" />
     <security mode="TransportCredentialOnly">
      <transport clientCredentialType="Windows" proxyCredentialType="None"
       realm="" />
      <message clientCredentialType="UserName" algorithmSuite="Default"  />
     </security>
    </binding>
   </basicHttpBinding>
  </bindings>
  <client>
   <endpoint address="http://exposedoutside.com:80/site/myservice.svc"
    binding="basicHttpBinding" bindingConfiguration="BasicHttpEndpoint"
    contract="WFLServiceReference.IWorkflow" name="BasicHttpEndpoint" />
  </client>
   <behaviors>
     <endpointBehaviors>
       <behavior name="">
         <dataContractSerializer maxItemsInObjectGraph="2147483646"/>
         <clientCredentials>
           <windows allowedImpersonationLevel="Impersonation"/>
         </clientCredentials>
       </behavior>
     </endpointBehaviors>
   </behaviors>
 </system.serviceModel>

I didn't really need to specify the port. Also, i added this in the code-behind

Dim wcfService = New WCFServiceProxy.myserviceClient()
wcfService.ClientCredentials.Windows.AllowedImpersonationLevel = System.Security.Principal.TokenImpersonationLevel.Impersonation

Am i missing something?

Thank you in advance.

3 Answers 3

0

Make sure IIS is setup to allow anonymous authentication on that Web Application. You are wanting to handle authentication yourself, so you need to tell IIS to allow everyone. This is an ok thing to do, as long as you are confident you've done your authentication well.

It works from your local machine as it is using your windows domain credentials to log in. Easiest check is to open up the WCF end point in a web browser (ie type http://exposedoutside.com:80/site/myservice.svc into the address bar)

4
  • Thank you for your reply. However, i want to use Windows Authentication on the client app (I also tried enabling Anonymous, the same thing happened). I also tried opening the endpoint, it is accessible from a computer not connected to the network.
    – John
    Feb 7, 2011 at 2:47
  • Sorry, missread your post. When enabling Anonymous you need to turn off all the other options. You may need to turn of integrated and use digest instead. Integrated is usually if the connecting computers are on the same domain. Feb 7, 2011 at 3:12
  • Thank you for the suggestion. I did try it out. Here's what i changed: SERVER: <security mode="TransportCredentialOnly"> <transport clientCredentialType="Digest" proxyCredentialType="Windows" /> </security> CLIENT: <security mode="TransportCredentialOnly"> <transport clientCredentialType="Digest" proxyCredentialType="None" realm="" /> <message clientCredentialType="UserName" algorithmSuite="Default" /> </security> ... <clientCredentials> <httpDigest impersonationLevel="Impersonation" /> </clientCredentials>
    – John
    Feb 7, 2011 at 9:32
  • Also, only the Digest Authentication is enabled in IIS for both. The result -- Both the client and server are working on their own. When the client accesses the server, i get this: "The HTTP request is unauthorized with client authentication scheme 'Digest'. The authentication header received from the server was 'Digest qop="auth",algorithm=MD5-sess,nonce="+Upgraded+v14c9e77b4c1f5db61e5dc59d598c6cb013881360bef99418bfc93238cb76f4fd6a53cb8fc0f3e96fc402e3de0c7765aa7",charset=utf-8,realm="Digest"'." uh, now it's Digest vs Digest. Still won't access...
    – John
    Feb 7, 2011 at 9:32
0

You can't use clientCredentialType="Windows" (negotiation) over Internet. It works only if client and server are in the same domain or trusted domains. If you really want to windows accounts to authenticate over Internet you must expose endpoint with clientCredentialType set to Basic. It will use Basic authentication so the client will have to provide username and password explicitly. Be aware that exposing such endpoint without transport security (HTTPS) is simply not acceptable because you will send credentials to your network over Internet in the plain text.

1
  • Thank you. I changed it now to Digest. The result -- Both the client and server are working on their own. When the client accesses the server, i get this: "The HTTP request is unauthorized with client authentication scheme 'Digest'. The authentication header received from the server was 'Digest qop="auth",algorithm=MD5-sess,nonce="+Upgraded+v14c9e77b4c1f5db61e5dc59d598c6cb013881360bef99418bfc93238cb76f4fd6a53cb8fc0f3e96fc402e3de0c7765aa7",charset=utf-8,realm="Digest"'." uh, now it's Digest vs Digest. Still won't access...
    – John
    Feb 7, 2011 at 10:15
0

Apparently, i just needed to pass credentials. I have been avoiding it, but it appears that it's really the way to go:

clientProxyHere.ClientCredentials.HttpDigest.ClientCredential = New System.Net.NetworkCredential("user", "password")

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.