Take the 2-minute tour ×
SharePoint Stack Exchange is a question and answer site for SharePoint enthusiasts. It's 100% free, no registration required.

This must be something very simple I just don't get.

I create the demo wcf service by Microsoft: http://msdn.microsoft.com/en-us/library/ff521581.aspx

I create two web applications on my SP2010 development farm, one with Claims, one with Classic. I add a site collection to both.

Next I deploy the simple demo service to both. And try to call it from visual studio console application.

I add the following line to on the client (in order to use Ntlm authentication)

using (MyClient client = new MyClient()) { client.ClientCredentials.Windows.AllowedImpersonationLevel = System.Security.Principal.TokenImpersonationLevel.Impersonation; }

This works for the classic web application but gives the following error on the claims web application: "The HTTP request is unauthorized with client authentication scheme 'Ntlm'. The authentication header received from the server was 'NTLM'."

share|improve this question
add comment

1 Answer

If your web application is configured for Claims mode authentication, then you cannot pass NTLM credentials/tokens. You must get a FedAuth token from the identity provider and pass it to the service.

I suggest that you read Vittorio's book on Windows Identity Framework programming.http://www.amazon.com/Programming-Windows-Identity-Foundation-Dev/dp/0735627185

share|improve this answer
    
Actually funny thing it just started to work. –  why oh why Jan 4 '12 at 16:48
    
...after switching to SP oob web.config instead of a custom one. –  why oh why Jan 4 '12 at 16:54
    
..i mean the service seems to work with windows cretentials: i can recognize the user in the service, and personalize based on the current user. but do you mean there's something wrong in this approach? –  why oh why Jan 4 '12 at 16:59
    
Can you explain the statement "If your web application is configured for Claims mode authentication, then you cannot pass NTLM credentials/tokens. You must get a FedAuth token from the identity provider and pass it to the service." with a example. –  Monica Jagani Feb 21 '12 at 4:56
    
I will not. Read up on Microsoft's support of claims identity and you will find a wealth of information. –  Paul Schaeflein Mar 5 '12 at 22:18
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.