I have a SharePoint 2010 web part and WCF service deployed to a web application using Kerberos authentication. The service was developed based on the walkthrough from MSDN with the only difference that
ClientCredentialType = HttpClientCredentialType.Windows so that Kerberos is used.
The web application is being reverse-published through ISA. However we've never had an issue with this before.
When the web part calls the service, a 401 error occurs with the following exception message:
The HTTP request is unauthorized with client authentication scheme 'Negotiate'. The authentication header received from the server was 'NTLM'.
I configured Fiddler on the web application running the web part and found that both Kerberos and NTLM authentication headers are being returned:
HTTP/1.1 401 Unauthorized Server: Microsoft-IIS/7.5 SPRequestGuid: 541e724c-85a7-47a0-b045-827e1c50793c WWW-Authenticate: Negotiate oXsweaADCgEBoQsGCSqGSIL3EgECAqJlBGNgYQYJKoZIhvcSAQICAwB+UjBQoAMCAQWhAwIBHqQRGA8yMDEwMDkxNDA1MjY1NlqlBQIDDgespgMCASmpDBsKREVDUy5MT0NBTKoXMBWgAwIBAaEOMAwbCnNwX3dlYmFwcDE= WWW-Authenticate: NTLM X-Powered-By: ASP.NET MicrosoftSharePointTeamServices: 188.8.131.5262 Date: Tue, 14 Sep 2010 05:26:56 GMT Content-Length: 0 Proxy-Support: Session-Based-Authentication
Why then is the Kerberos authentication not accepted? (As a side note, why is NTLM returned as well?)