httpwebrequest with https behind proxy with authentication

[Andrea Pierini]

Hi to all,
I have a problem to download a file with httpwebrequest when

_ https protocol is used
_ the client is behind a proxy that requires authentication

For example consider the following code:

WebRequest req =
WebRequest.Create("https://www.domus3d.com/ws/test.txt");
req.Proxy = new WebProxy("http://192.168.0.6:3128", true); //
Proxy available at IP 192.168.0.6 on port 3128
req.Proxy.Credentials = new NetworkCredential("user", "pwd",
"domain"); // Proxy network credentials
WebResponse res = req.GetResponse();

I always receive "The remote server returned an error: (407) Proxy
Authentication Required.". What's wrong? Note that if I make the request
over http the code works and with Internet Explorer I can open the file
either over http or over https.

Thanks in advance for any help,
Andrea Pierini

PS: I've seen that many users experience the same problem with WSUS 3.0
behind a proxy with authentication

 

[Steven Cheng[MSFT]]

Hi Andrea,

From your description, you're using WebRequest component to download a file
from a remote webservice. That webservice is accessed through a proxy and
the proxy also require authentication. However, you found your webservice
client always get proxy authentication error, correct?

Based on the code snippet you provided, you directly create a
NetworkCredential (with username/password pair) and send it via
WebProxy.Credentials. One potential things here is that whether you've
confirmed what kind of Authentication Type is the webproxy using?
Integrated windows or basic or ...?

Generally, when sending credential through NetworkCredential, it is
recommended that you explicitly supply the authenticationType(via
CredentialCache class). e.g.

=========
CredentialCache cache = new CredentialCache();
cache.Add( new Uri(proxy.Url),
// Web service URL
"Negotiate",
// Kerberos or NTLM
new NetworkCredential("username", "password", "domainname")
);

proxy.Credentials = cache;
=========

the following thread has also mentioned this:

http://forums.microsoft.com/MSDN/ShowPost.aspx?PostID=1772251&SiteID=1

You can try looking at this to see whether this is the cause.

BTW, also check the behavior when you visit it in IE(whether there is any
warning or error you interactively ignore), since any interactively
ignorable error will cause exception in programamtic code.

Sincerely,

Steven Cheng

Microsoft MSDN Online Support Lead



==================================================

Get notification to my posts through email? Please refer to
http://msdn.microsoft.com/subscriptions/managednewsgroups/default.aspx#notif
ications.



Note: The MSDN Managed Newsgroup support offering is for non-urgent issues
where an initial response from the community or a Microsoft Support
Engineer within 1 business day is acceptable. Please note that each follow
up response may take approximately 2 business days as the support
professional working with you may need further investigation to reach the
most efficient resolution. The offering is not appropriate for situations
that require urgent, real-time or phone-based interactions or complex
project analysis and dump analysis issues. Issues of this nature are best
handled working with a dedicated Microsoft Support Engineer by contacting
Microsoft Customer Support Services (CSS) at
http://msdn.microsoft.com/subscriptions/support/default.aspx.

==================================================


This posting is provided "AS IS" with no warranties, and confers no rights.








--------------------

 

[Andrea Pierini]

Hi Steven,
first of all thanks for your answer.
Our proxy server uses NTLM authentication and as you suggested I modified
the code as follows:

*******************************
WebRequest req = WebRequest.Create("https://www.domus3d.com/ws/test.txt");
Uri proxyuri = new Uri("http://192.168.0.6:3128");
WebProxy proxy = new WebProxy(proxyuri, true);
NetworkCredential cred = new NetworkCredential("administrator", "xxxxx",
"WEBSERVER12");
CredentialCache credcache = new CredentialCache();
credcache.Add(proxyuri, "NTLM", cred);
proxy.UseDefaultCredentials = false;
proxy.Credentials = credcache;
req.Proxy = proxy;
WebResponse res = req.GetResponse();
*******************************

I still receive "The remote server returned an error: (407) Proxy
Authentication Required." and it works if I use http instead of https or if
I disable authentication on the proxy (I can do it to make some tests, but
our customers can't). This is the proxy server log:

*******************************
1197019352.005 0 192.168.0.250 TCP_DENIED/407 2108 CONNECT
www.domus3d.com:443 - NONE/- text/html
1197019425.021 73000 192.168.0.250 TCP_MISS/200 3322 CONNECT
www.domus3d.com:443 webserver12\administrator DIRECT/62.149.195.31 -
1197019632.552 0 192.168.0.250 TCP_DENIED/407 1839 GET
http://www.domus3d.com/ws/test.txt - NONE/- text/html
1197019632.568 0 192.168.0.250 TCP_DENIED/407 2153 GET
http://www.domus3d.com/ws/test.txt - NONE/- text/html
1197019632.599 31 192.168.0.250 TCP_HIT/200 464 GET
http://www.domus3d.com/ws/test.txt webserver12\administrator NONE/-
application/octet-stream
1197021220.771 39422 192.168.0.250 TCP_MISS/200 3466 CONNECT
www.domus3d.com:443 webserver12\administrator DIRECT/62.149.195.31 -
*******************************

Line #1 is the .Net code trying to access the file over https (doesn't
work); line #2 is FireFox successfully accessing the file over https; line
#3/4/5 is the .Net code successfully accessing the file over http; line #6
is Internet Explorer successfully accessing the file over https. It seems
that the .Net code doesn't pass the proxy authentication over HTTP CONNECT.

Any idea?

Thanks in advance,
Andrea Pierini

 

[Andrea Pierini]

Hi to all,
after searching and searching perhaps I have found the problem, it is
documented in Microsoft KB928563. Can anyone who has access to the hotfixes
confirm this?
Regards,
Andrea Pierini

 

[Steven Cheng[MSFT]]

Hi Andrea,

Thanks for your followup. I've read the kb article, and I agree that the
issue it describes seems quite fit your scenario. As the article mentioned,
for such hotfix, you'll need to contact CSS to confirm whether your problem
match the hotfix condition and if necessary you can obtain the hotfix from
them:

===========
To resolve this problem immediately, contact Microsoft Customer Support
Services to obtain the hotfix. For a complete list of Microsoft Customer
Support Services telephone numbers and information about support costs,
visit the following Microsoft Web site:
http://support.microsoft.com/contactus/?ws=support
==============

Sincerely,

Steven Cheng

Microsoft MSDN Online Support Lead



This posting is provided "AS IS" with no warranties, and confers no rights.



--------------------

From: "Andrea Pierini" <[email protected]>
References: <[email protected]>