Problem with web service credentials

[Guest]

I have a ASP.NET web page that calls a web service on a server with IIS
installed on it. When it calls the web service, it gives a HTTP status 401
error stating that it is unauthorized to call the web service. After
searching the Microsoft Knowledge Base, article ID 811318 describes my exact
problem. However, when I try to implement the stated solution, I still
receive the same error.

Basically if I add the following line of code, it should fix my problem but
it doesn't.

WebService.credentials=system.net.credentialcache.defaultcredentials
(where WebService is a reference to the web service on the server)

I checked the directory security of the web service in IIS and anonymous
access has been turned off and Integrated Windows authentication has been
switched on.

Any help would be greatly appreciated.

Thanks.

 

[Henning Krause [MVP - Exchange]]

Hello,

I guess you have impersonation turned on in you website and the webservice
is on another computer.

In this case, you are using the credential from the client and pass it along
to the webservice. This breaks with NTLM authentication.

You have two options then:
- Implement Kerberos authentication (see
http://dunnry.com/blog/ConfiguringKerberosDelegation.aspx).
- Turn off Windows authentication and use basic authentication. But you
should do this only if you are protecting the website with SSL.
Additionally, this will remove the single-sign-on experiences for the end
users.

Best regards,
Henning Krause

 

[Guest]

Hello Henning,

Thanks for your reply. I looked at the website where it describes how to set
up kerberos delegation and have discovered that we already have it
implemented. I also checked the web.config files in the .NET application and
they are all set to impersonate=true and are running under a domain account.
I'm not sure what much more there is to check. Hope you can shed some more
light on this issue.

Thanks.

 

[Henning Krause [MVP - Exchange]]

Hello,

have you checked the service principal names? Are they all set correct?

Are there any duplicates in the list of service principal names?

Here is another link with troubleshooting tips on kerberos:
http://www.microsoft.com/technet/prodtechnol/windowsserver2003/technologies/security/tkerberr.mspx

Best regards,
Henning Krause

 

[Guest]

Hi Henning,

I've been able to get the web service to work but I really don't understand
it. I simply changed my project type in Visual Studio 2005 from a web site
type to a web application type and it worked. Apparently, there is a
difference between these 2 types but I'm not sure what. I am guessing that
either type should be able to communicate with a web service but so far I
can't figure out why a web site in VS 2005 has so much trouble talking to the
web service while a web application is so seamless.

Thanks.