Simple Microsoft demo wcf service works on classic authentication web app, but fails on a claims based web app. Why?

Question

This must be something very simple I just don't get.

I create the demo wcf service by Microsoft: http://msdn.microsoft.com/en-us/library/ff521581.aspx

I create two web applications on my SP2010 development farm, one with Claims, one with Classic. I add a site collection to both.

Next I deploy the simple demo service to both. And try to call it from visual studio console application.

I add the following line to on the client (in order to use Ntlm authentication)

using (MyClient client = new MyClient()) { client.ClientCredentials.Windows.AllowedImpersonationLevel = System.Security.Principal.TokenImpersonationLevel.Impersonation; }

This works for the classic web application but gives the following error on the claims web application: "The HTTP request is unauthorized with client authentication scheme 'Ntlm'. The authentication header received from the server was 'NTLM'."

Answer 1

If your web application is configured for Claims mode authentication, then you cannot pass NTLM credentials/tokens. You must get a FedAuth token from the identity provider and pass it to the service.

I suggest that you read Vittorio's book on Windows Identity Framework programming.http://www.amazon.com/Programming-Windows-Identity-Foundation-Dev/dp/0735627185