SiteData service: some methods give Access Denied

Question

We recently migrated some applications from SharePoint 2007 to SharePoint 2010. The application uses the SiteData.asmx web service.

After the migration there are Access Denied errors, withtout any additional information.

The following sample code reproduces the problem:

var service = new SiteData();
service.Url = url + "_vti_bin/sitedata.asmx";

string web;string site;string bucket;string list;string item;

service.GetURLSegments(url + "Docs/SomeDocumentLibrary/Test/testafterupdate/2007-00152-01-E.doc", out web, out bucket, out list, out item);

The point is to get the listId from the url.

The error I get is: Server was unable to process request. ---> Access is denied.

System.Web.Services.Protocols.SoapException: Server was unable to process request. ---> Access is denied. (Exception from HRESULT: 0x80070005 (E_ACCESSDENIED))   at System.Web.Services.Protocols.SoapHttpClientProtocol.ReadResponse(SoapClientMessage message, WebResponse response, Stream responseStream, Boolean asyncCall)   at System.Web.Services.Protocols.SoapHttpClientProtocol.Invoke(String methodName, Object[] parameters)   at ConsoleApplication1.test.SiteData.GetListCollection(_sList[]& vLists)   at ConsoleApplication1.Program.Main(String[] args)

The exact same error comes back on some of the other web methods (getlistitems, getlist, getlistcollection)

Other web metods do work fine (GetSiteUrl, GetSiteAndWeb)

The error happens when running as a farm administrator. The same error happens running on a local development machine, which makes me think it has nothing to do with user permissions.

Has anyone seen this error before, or managed to solve it?

Edit:

The error goes away when only Windows Authentication is configured. Is there a way to fully enable the old web services with claims based authentication?

Update

The real issue is Multiple Membership Providers not really working in a lot of situations. We have to following issues:

• legacy web services do not fully work.
• odata does not work. (http://localhost/_vti_bin/listdata.svc/List hangs indefinitly)
• Livewriter can not connect to blog site
• opening office documents in edit mode gives access denied, but they can actually be opened.

For applications using SharePoint web services we will extend the web application and have an internal url with only Windows authentication enabled.

Answer 1

We've "solved" this by extending the web application and using windows authentication only on the extended web application. All service applications use this one. It works, but it's like we're back in 2007.

Answer 2

In case you are using claims this is how you should authenticate: Using Web Services with a Site Protected by Forms Authentication (cannot find v2010 version of this article, but had same problem on my SharePoint 2010, changed the service call according to instructions and it worked).

From the original article:

Using the SharePoint Web services with a site secured with forms authentication works; however, the process differs from what you would do to use Web services for a site that is secured with Windows authentication. The primary difference is that you must obtain an authentication cookie and then use that cookie when accessing the Web services in the site protected by forms authentication.

Sample:

fbaAuth.Authentication auth = new fbaAuth.Authentication(); // http://siteCollectionName/_vti_bin/authentication.asmx.
fbaLists.Lists lists = new fbaLists.Lists(); // http://siteCollectionName/_vti_bin/Lists.asmx

auth.CookieContainer = new System.Net.CookieContainer();
auth.AllowAutoRedirect = true;
fbaAuth.LoginResult lr = auth.Login("myUserName", "myUserPassword");

if (lr.ErrorCode == fbaAuth.LoginErrorCode.NoError)
{
  //Now we can talk to the Lists Web service.
}

Answer 3

Does it consistantly fail on the same line or is it seemingly random? Do you have more than one web front end? I have seen an issue with some load balanced environments where the request is routed to a different web front end and given the access denied message.

I like to use WebService Studio (http://code.msdn.microsoft.com/webservicestudio20) to test web service calls separate from the code implemention. This normally helps me determine if it is my code or how the web service functions.