SharePoint Stack Exchange is a question and answer site for SharePoint enthusiasts. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a SharePoint 2010 web application that allows both claims authentication and classic authentication. The Default claims provider for the web application has "Enable Windows Authentication" and "Enable Forms Based Authentication (FBA)" checked. For "Enable Windows Authentication" I have "Integrated Windows authentication" checked and NTLM chosen.

I also have a HttpHandler that is used for custom REST-based (non-SOAP) web services. It is a pattern I used in SharePoint 2007 and has been ported to SharePoint 2010 (if I had just started with SharePoint 2010 then I could go with full-blown WCF, but that wasn't an option).

I want to allow a web service call initiated from another machine (using Java, so no .NET stuff here) to authenticate to the web service. This works fine if the web application is limited to Windows Authentication only.

In my initial tests I see a 403 in the IIS logs and realize that the request is probably trying to do something like redirect the request to another page. I also have tried the Firefox REST client and in that I see a 200, but instead of an XML web service response I see HTML that asks me to select Windows Authentication or Forms Authentication.

My guess is that the SPRequest HttpModule is getting in the way. I want that HttpModule to run so that it sets up SPContext.Current, but I don't want it doing this.

My question is how can I prevent this and let this work just as if I was only using NTLM for the web service requests? Maybe there something that I can put on the request header?

Note that I use custom web.config files for my web services so that I can define the HttpHandler for the request. If there is something I can put in those web.config files that would be fine too.

share|improve this question
I have seen some documentation at the following link which appears to be a good discussion on how the authentication works, but I don't think it helps me for my case. – Kirk Liemohn Jun 7 '11 at 16:38
up vote 4 down vote accepted

I can add "X-FORMS_BASED_AUTH_ACCEPTED" in the request header with a value of "f" and then I get the NTLM challenge that I want. This works in both Firefox REST client and when I updated the Java code (the code that makes the request) everything works :-).

I found this little tidbit at

share|improve this answer
That did the trick! I'll try to remember to accept this answer in a couple of days as I am not allowed to accept my answer right away. – Kirk Liemohn Jun 7 '11 at 18:08

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.