6

I have a SharePoint 2010 web application that allows both claims authentication and classic authentication. The Default claims provider for the web application has "Enable Windows Authentication" and "Enable Forms Based Authentication (FBA)" checked. For "Enable Windows Authentication" I have "Integrated Windows authentication" checked and NTLM chosen.

I also have a HttpHandler that is used for custom REST-based (non-SOAP) web services. It is a pattern I used in SharePoint 2007 and has been ported to SharePoint 2010 (if I had just started with SharePoint 2010 then I could go with full-blown WCF, but that wasn't an option).

I want to allow a web service call initiated from another machine (using Java, so no .NET stuff here) to authenticate to the web service. This works fine if the web application is limited to Windows Authentication only.

In my initial tests I see a 403 in the IIS logs and realize that the request is probably trying to do something like redirect the request to another page. I also have tried the Firefox REST client and in that I see a 200, but instead of an XML web service response I see HTML that asks me to select Windows Authentication or Forms Authentication.

My guess is that the SPRequest HttpModule is getting in the way. I want that HttpModule to run so that it sets up SPContext.Current, but I don't want it doing this.

My question is how can I prevent this and let this work just as if I was only using NTLM for the web service requests? Maybe there something that I can put on the request header?

Note that I use custom web.config files for my web services so that I can define the HttpHandler for the request. If there is something I can put in those web.config files that would be fine too.

Improve this question
1

1 Answer 1

Reset to default
4

I can add "X-FORMS_BASED_AUTH_ACCEPTED" in the request header with a value of "f" and then I get the NTLM challenge that I want. This works in both Firefox REST client and when I updated the Java code (the code that makes the request) everything works :-).

I found this little tidbit at http://buyevich.blogspot.com/2011/03/accessing-mixed-authentication-web-app.html.

Improve this answer
1
  • That did the trick! I'll try to remember to accept this answer in a couple of days as I am not allowed to accept my answer right away.
    – Kirk Liemohn
    Jun 7, 2011 at 18:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.