I've created an AppEventReceiver for my High Trust Remote app, when I deploy the app through Visual Studio 2012 I get the following error

The remote event receiver callout failed

The HTTP request is unauthorized with client authentication scheme 'Anonymous'. The authentication header received from the server was 'Negotiate,NTLM'.

My remote app is published to an IIS website with Windows Authentication enabled and Annoymous disabled as detailed in the instructions to set this up in the MSDN docs.

If I turn on Anonymous Authentication it trips up the TokenHelper class (I think because there is no Windows Identity)

From the error message it seems like SharePoint is trying to call the AppEventReceiver endpoint using Anonymous authenctication and my IIS site is expecting NTLM.

They are both hosted on the same server in the same IIS instance.

Am I missing some configuration or setting here?

If I remove the AppEventReceiver, the app deploys without any problems

  • Did you find any resolution to this problem? I am having the same issue. – Nadeem Yousuf Jan 3 '14 at 16:11

Usually an unauthorised (Anonymous) error occurs when a credential is passed on more than once (double hop). This sounds like the issue you are having. This is a security mechanism to help prevent other applications using your credentials.

You can trace it back by logging credential info (username) at different points in your app (e.g. event receiver).

This can be solved using the following approaches:

  • Configure and enable kerberos - this will allow credentials to be passed on more than once. However, this requires a lot of configuration and should be considered carefully at an enterprise level.

  • Use service accounts - Have the user authenticated through the front end of your application (e.g. sharepoint access), then use application to authenticate with resources such as databases.
    You can impersonate a service account inside your application using SPSecurity.Runwithelevatedprivileges. This then runs as the application pool identity of the sharepoint web application.


I am having the same issue, and so far, the only resolution I've found is to enable anonymous authentication on the WCF service. It seems that SharePoint just won't do NTLM / windows authentication when calling the remote event receiver service.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.