How do I avoid redirection for web service authentication in SharePoint 2010 when both claims and classic auth is allowed?

Question

I have a SharePoint 2010 web application that allows both claims authentication and classic authentication. The Default claims provider for the web application has "Enable Windows Authentication" and "Enable Forms Based Authentication (FBA)" checked. For "Enable Windows Authentication" I have "Integrated Windows authentication" checked and NTLM chosen.

I also have a HttpHandler that is used for custom REST-based (non-SOAP) web services. It is a pattern I used in SharePoint 2007 and has been ported to SharePoint 2010 (if I had just started with SharePoint 2010 then I could go with full-blown WCF, but that wasn't an option).

I want to allow a web service call initiated from another machine (using Java, so no .NET stuff here) to authenticate to the web service. This works fine if the web application is limited to Windows Authentication only.

In my initial tests I see a 403 in the IIS logs and realize that the request is probably trying to do something like redirect the request to another page. I also have tried the Firefox REST client and in that I see a 200, but instead of an XML web service response I see HTML that asks me to select Windows Authentication or Forms Authentication.

My guess is that the SPRequest HttpModule is getting in the way. I want that HttpModule to run so that it sets up SPContext.Current, but I don't want it doing this.

My question is how can I prevent this and let this work just as if I was only using NTLM for the web service requests? Maybe there something that I can put on the request header?

Note that I use custom web.config files for my web services so that I can define the HttpHandler for the request. If there is something I can put in those web.config files that would be fine too.

Answer 1

I can add "X-FORMS_BASED_AUTH_ACCEPTED" in the request header with a value of "f" and then I get the NTLM challenge that I want. This works in both Firefox REST client and when I updated the Java code (the code that makes the request) everything works :-).

I found this little tidbit at http://buyevich.blogspot.com/2011/03/accessing-mixed-authentication-web-app.html.