Enable both Basic and Windows authentication

Question

My services are enabled using Windows authentication on IIS7.

    <binding name="Soap.HttpsBinding" closeTimeout="00:05:00"
             openTimeout="00:05:00" receiveTimeout="00:05:00" sendTimeout="00:05:00">
      <security mode="Transport">
        <transport clientCredentialType="Windows" proxyCredentialType="None">
          <extendedProtectionPolicy policyEnforcement="WhenSupported" />
        </transport>
        <message clientCredentialType="UserName" algorithmSuite="Default" />
      </security>
    </binding>

My clients connect to it successfully using the same binding details.

I recently had a request to add Basic authentication to support some legacy systems. Everything I thought I knew said we can run both side by side.

I enabled Basic authentication, and the legacy systems can connect. However, all our existing WCF clients are now throwing the following exception:

MessageSecurityException: The HTTP request is unauthorized with client authentication scheme 'Negotiate'. The authentication header received from the server was 'Basic realm="mydomain.local",Negotiate,NTLM'.

1. Why is Basic being listed first when it's beneath the others in the module list?
2. Why are the clients not failing Basic and moving onto Negotiate? (surely they don't have to be identical)
3. How can I support both Basic and Windows authentication on the same WCF service?

Regards, Rob.

Answer 1

Okay, it turns out this is one of the more misleading Microsoft error messages I've come across.

The 401 authentication error is being created on the initial request without any exception being logged in the event viewer.

The answer appears to be the use of system.webServer -> httpErrors

As I wanted to use the tilde (~) in the URL, I was setting my config to the following:

<httpErrors>
  <clear />
  <error statusCode="401" responseMode="ExecuteURL" path="~/error.xml" />
</httpErrors>

Whether it was the use of tilde, or the ExecuteURL, I eventually found that using the following works:

<httpErrors>
  <clear />
  <error statusCode="401" responseMode="File" path="/error.xml" />
</httpErrors>