Call SharePoint custom WCF service from within same SharePoint site

Question

I've built a custom WCF web service that is hosted on a SharePoint server. The service combined SharePoint data with data from a separate database. The service can successfully be called from a Silverlight application on another server (same domain).

This is the code used to call the service from the Silverlight app:

        string wcfUrl = "http://server.domain.com:20000/_vti_bin/SearchService/Search.svc"
        var client_binding = new System.ServiceModel.BasicHttpBinding();
        client_binding.Security.Mode = BasicHttpSecurityMode.TransportCredentialOnly;
        client_binding.MaxReceivedMessageSize = 200000;
        SearchService.SearchClient client = new SearchService.SearchClient(client_binding, new EndpointAddress(wcfUrl));

When I try to call the service the same way from a custom SharePoint application page, I get the error "The HTTP request is unauthorized with client authentication scheme 'Anonymous'. The authentication header received from the server was 'NTML'"

It makes sense since I haven't set any credentials, and this farm is not set up to allow anonymous identification, but why would it work from outside SP, but not from within?

Since that didn't work, I've tried setting:

• the BasicHttpBinding.Security.Transport.ClientCredential to HttpClientCredentialType.Ntml and
• set the client.ClientCredentials.Windows.AllowedImpersonationLevel to TokenImpersonationLevel.Impersonation and
• set client.ClientCredentials.Windows.ClientCredential to DefaultNetworkCredentials

without success. I get the slightly different error "The HTTP request is unauthorized with client authentication scheme 'Ntlm'. The authentication header received from the server was 'NTLM'."

The security settings on the farm are:

• Disable anonymous access
• Enable Windows Authentication, with Integrated Windows authentication being NTML
• Enable Client Integration
• Disable Forms Based Authentication

Answer 1

This appears to be the common double-hop authentication issue. The NTLM protocol does not allow SharePoint to forward your credentials over to the WCF service. So, you authenticate against SharePoint and the call to your WCF or web service fails as NT AUTHORITY/ANONYMOUS. You have to implement Kerberos onto your SharePoint web application. See more details on this blog post. Enabling Kerberos authentication requires configuration on the web application via Central Administration as well as domain admins access to create SPN (Service Principal Names) and Delegation for the SharePoint Application Pool identity running your web application. Check this Kerberos Guide.