Why do I get a 401 error when calling a WCF service from a web part?

Question

I have a SharePoint 2010 web part and WCF service deployed to a web application using Kerberos authentication. The service was developed based on the walkthrough from MSDN with the only difference that ClientCredentialType = HttpClientCredentialType.Windows so that Kerberos is used.

The web application is being reverse-published through ISA. However we've never had an issue with this before.

When the web part calls the service, a 401 error occurs with the following exception message:

The HTTP request is unauthorized with client authentication scheme 'Negotiate'. The authentication header received from the server was 'NTLM'.

I configured Fiddler on the web application running the web part and found that both Kerberos and NTLM authentication headers are being returned:

HTTP/1.1 401 Unauthorized
Server: Microsoft-IIS/7.5
SPRequestGuid: 541e724c-85a7-47a0-b045-827e1c50793c
WWW-Authenticate: Negotiate oXsweaADCgEBoQsGCSqGSIL3EgECAqJlBGNgYQYJKoZIhvcSAQICAwB+UjBQoAMCAQWhAwIBHqQRGA8yMDEwMDkxNDA1MjY1NlqlBQIDDgespgMCASmpDBsKREVDUy5MT0NBTKoXMBWgAwIBAaEOMAwbCnNwX3dlYmFwcDE=
WWW-Authenticate: NTLM
X-Powered-By: ASP.NET
MicrosoftSharePointTeamServices: 14.0.0.4762
Date: Tue, 14 Sep 2010 05:26:56 GMT
Content-Length: 0
Proxy-Support: Session-Based-Authentication

Why then is the Kerberos authentication not accepted? (As a side note, why is NTLM returned as well?)

Answer 1

Is the web service on the same machine as SharePoint? If so, is it the ol' loopback check problem?

Another common issue with WCF is that you must pass an identity (any, even fake ones) to get it past .net 3.5 sp1.

EndpointIdentity epi = EndpointIdentity.CreateUpnIdentity("unknown");
EndpointAddress epa = new EndpointAddress(new Uri(address), epi);

For a full sample see the OpenService() method on this blog post.

Answer 2

The system admin only configured Kerberos for one web application. The web part was querying the WCF service for a different web application which only had NTLM configured.

_(Sigh.)