Take the 2-minute tour ×
SharePoint Stack Exchange is a question and answer site for SharePoint enthusiasts. It's 100% free, no registration required.

I have a SharePoint 2010 web part and WCF service deployed to a web application using Kerberos authentication. The service was developed based on the walkthrough from MSDN with the only difference that ClientCredentialType = HttpClientCredentialType.Windows so that Kerberos is used.

The web application is being reverse-published through ISA. However we've never had an issue with this before.

When the web part calls the service, a 401 error occurs with the following exception message:

The HTTP request is unauthorized with client authentication scheme 'Negotiate'. The authentication header received from the server was 'NTLM'.

I configured Fiddler on the web application running the web part and found that both Kerberos and NTLM authentication headers are being returned:

HTTP/1.1 401 Unauthorized
Server: Microsoft-IIS/7.5
SPRequestGuid: 541e724c-85a7-47a0-b045-827e1c50793c
WWW-Authenticate: Negotiate oXsweaADCgEBoQsGCSqGSIL3EgECAqJlBGNgYQYJKoZIhvcSAQICAwB+UjBQoAMCAQWhAwIBHqQRGA8yMDEwMDkxNDA1MjY1NlqlBQIDDgespgMCASmpDBsKREVDUy5MT0NBTKoXMBWgAwIBAaEOMAwbCnNwX3dlYmFwcDE=
WWW-Authenticate: NTLM
X-Powered-By: ASP.NET
MicrosoftSharePointTeamServices: 14.0.0.4762
Date: Tue, 14 Sep 2010 05:26:56 GMT
Content-Length: 0
Proxy-Support: Session-Based-Authentication

Why then is the Kerberos authentication not accepted? (As a side note, why is NTLM returned as well?)

share|improve this question

2 Answers 2

Is the web service on the same machine as SharePoint? If so, is it the ol' loopback check problem?

Another common issue with WCF is that you must pass an identity (any, even fake ones) to get it past .net 3.5 sp1.

EndpointIdentity epi = EndpointIdentity.CreateUpnIdentity("unknown");
EndpointAddress epa = new EndpointAddress(new Uri(address), epi);

For a full sample see the OpenService() method on this blog post.

share|improve this answer
    
It's not loopback check, and unfortunately the fake identity didn't make any difference. –  Alex Angas Sep 15 '10 at 0:08
up vote 0 down vote accepted

The system admin only configured Kerberos for one web application. The web part was querying the WCF service for a different web application which only had NTLM configured.

(Sigh.)

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.