I have a SharePoint 2010 web part and WCF service deployed to a web application using Kerberos authentication. The service was developed based on the walkthrough from MSDN with the only difference that ClientCredentialType = HttpClientCredentialType.Windows so that Kerberos is used.

The web application is being reverse-published through ISA. However we've never had an issue with this before.

When the web part calls the service, a 401 error occurs with the following exception message:

The HTTP request is unauthorized with client authentication scheme 'Negotiate'. The authentication header received from the server was 'NTLM'.

I configured Fiddler on the web application running the web part and found that both Kerberos and NTLM authentication headers are being returned:

HTTP/1.1 401 Unauthorized
Server: Microsoft-IIS/7.5
SPRequestGuid: 541e724c-85a7-47a0-b045-827e1c50793c
WWW-Authenticate: NTLM
X-Powered-By: ASP.NET
Date: Tue, 14 Sep 2010 05:26:56 GMT
Content-Length: 0
Proxy-Support: Session-Based-Authentication

Why then is the Kerberos authentication not accepted? (As a side note, why is NTLM returned as well?)

2 Answers 2


Is the web service on the same machine as SharePoint? If so, is it the ol' loopback check problem?

Another common issue with WCF is that you must pass an identity (any, even fake ones) to get it past .net 3.5 sp1.

EndpointIdentity epi = EndpointIdentity.CreateUpnIdentity("unknown");
EndpointAddress epa = new EndpointAddress(new Uri(address), epi);

For a full sample see the OpenService() method on this blog post.

  • It's not loopback check, and unfortunately the fake identity didn't make any difference.
    – Alex Angas
    Commented Sep 15, 2010 at 0:08

The system admin only configured Kerberos for one web application. The web part was querying the WCF service for a different web application which only had NTLM configured.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.