Windows Authentication with basicHttpBinding of WCF

Question

I am quite annoyed with this one for last 2 hours :(

Folks,

I am trying to access a SharePoint OOTB List web service from a Console application. My SharePoint site in IIS is set to Integrated Windows Auth mode, and anonymous access is disabled.

Now at client side what I am doing is as follows

try            
{
   BasicHttpBinding bind = new BasicHttpBinding();
   bind.Security.Mode = BasicHttpSecurityMode.TransportCredentialOnly;
   bind.Security.Transport.ClientCredentialType = HttpClientCredentialType.Windows;
   EndpointAddress endpoint = new EndpointAddress("http://abc:37379/_vti_bin/lists.asmx");
   ServiceReference1.ListsSoapClient listService
       = new ConsoleApplication1.ServiceReference1.ListsSoapClient(bind, endpoint);
   var elm = listService.GetListItems("Tasks", null, null, null, "10", null, @"06dc3b48-a55e-4db8-8511-acbaf9748e15");
}
catch (Exception ex){
  Console.WriteLine("Message:\n" + ex.Message + "\nDetail:\n" +
  ex.ToString() + "\nStackTrace:\n" + ex.StackTrace);   }

Boom, this raises the exception "The HTTP request is unauthorized with client authentication scheme 'Negotiate'. The authentication header received from the server was 'NTLM'."

I really wanted to do something like following what we used to do in old net 2.0 days

serviceProxy.Credentials = new NetworkCredentials("username","password","domain");

What is the easiest way to achieve this kind of credential handling in new proxy classes??

(BTW as you have already noticed I am using the Binding /endpoint everything inside code rather a config file, this is a restriction for my app. please don't tell me to change this-its not possible).

Can anyone help me with this?? It would be greatly appreciated.

Answer 1

IIRC this happens when the web server tries to fail back to ntlm when you specified kerberos (windows) in the binding.

You should be able to change this line of code

bind.Security.Transport.ClientCredentialType = HttpClientCredentialType.Windows;

to

bind.Security.Transport.ClientCredentialType = HttpClientCredentialType.Ntlm;

if you need kerberos to work then you will need to make sure that the service on the web server is running under the same account as the is in the active directory for the service principle name.

If you want to specify the credentials, use the channel factory to create the client and before you open the channel, set the appropriate credentials on the credential property of the channel factory. For example:

var cf = new ChannelFactory<IServiceInterface>(
    bind, endpoint);
cf.Credentials.UserName.UserName = "domain\\someuser";
cf.Credentials.UserName.Password = "password";