Windows authentication on a Web service returning Access Denied (401).

[Daniel Bass]

Hey,

[ Background ]
I've been asked to look into network security where an IIS virtual directory
is configure to not have anonymous access, but rather to go with the windows
authentication (what the user signs in as at client). This is in the context
of a ASP.Net web service running on an intranet.

[ What I have done ]
- I've ticked and unticked all the right boxes in IIS.
- I've also added the
"myserviceproxy .Credentials =
System.Net.Cred entialCache.Def aultCredentials ;"
to the client side [ Web / Windows ] Application so that they are passed
through to the server for the request message.
- I've also ensured that my user account on the client side, is registered
as a user on the server on which the web service resides.

[ The problem ]
But when I try to process any messages, I get back an HTTP 401: Access
Denied message.
What am I doing wrong, or not doing at all?
I'm very new to all this, so if I'm missing something obvious, please
forgive me.

Thanks for your time.
Daniel.

[Paul]

Daniel,

What happens when you just go to the .asmx page using IE?

-Paul

"Daniel Bass" <I'm really @ sick of spam> wrote in message
news:%2******** ********@TK2MSF TNGP09.phx.gbl. ..

Hey,

[ Background ]
I've been asked to look into network security where an IIS virtual directory is configure to not have anonymous access, but rather to go with the windows authentication (what the user signs in as at client). This is in the context of a ASP.Net web service running on an intranet.

[ What I have done ]
- I've ticked and unticked all the right boxes in IIS.
- I've also added the
"myserviceproxy .Credentials =
System.Net.Cred entialCache.Def aultCredentials ;"
to the client side [ Web / Windows ] Application so that they are passed through to the server for the request message.
- I've also ensured that my user account on the client side, is registered
as a user on the server on which the web service resides.

[ The problem ]
But when I try to process any messages, I get back an HTTP 401: Access
Denied message.
What am I doing wrong, or not doing at all?
I'm very new to all this, so if I'm missing something obvious, please
forgive me.

Thanks for your time.
Daniel.

[Daniel Bass]

Paul

That works as you'd expect, giving you that page with the avialable methods
on the web service.

Dan

"Paul" <[e-mail]> wrote in message
news:OO******** ******@TK2MSFTN GP12.phx.gbl...
Daniel,

What happens when you just go to the .asmx page using IE?

-Paul

"Daniel Bass" <I'm really @ sick of spam> wrote in message
news:%2******** ********@TK2MSF TNGP09.phx.gbl. ..

Hey,

[ Background ]
I've been asked to look into network security where an IIS virtual directory is configure to not have anonymous access, but rather to go with the windows authentication (what the user signs in as at client). This is in the context of a ASP.Net web service running on an intranet.

[ What I have done ]
- I've ticked and unticked all the right boxes in IIS.
- I've also added the
"myserviceproxy .Credentials =
System.Net.Cred entialCache.Def aultCredentials ;"
to the client side [ Web / Windows ] Application so that they are passed through to the server for the request message.
- I've also ensured that my user account on the client side, is registered
as a user on the server on which the web service resides.

[ The problem ]
But when I try to process any messages, I get back an HTTP 401: Access
Denied message.
What am I doing wrong, or not doing at all?
I'm very new to all this, so if I'm missing something obvious, please
forgive me.

Thanks for your time.
Daniel.

[Ed]

Daniel or Paul,

Was there any resolution to this problem? I am having the same
problem as Daniel describes. I have even gone as far as making a
"dummy" method on the web service that returns the
System.Net.Secu rity.WindowsPri ncipal.Identity and it shows my user
name.... When I try to connect to a SQL Server DB from that same Web
Service, using SSPI, it tries to connect as anonymous.

Is there some setting that I am missing?

Thanks, any information would be helpful.

Ed Castaneda
"Daniel Bass" <I'm really @ sick of spam> wrote in message news:<Om******* *******@TK2MSFT NGP10.phx.gbl>. ..

Paul

That works as you'd expect, giving you that page with the avialable methods
on the web service.

Dan

"Paul" <[e-mail]> wrote in message
news:OO******** ******@TK2MSFTN GP12.phx.gbl...
Daniel,

What happens when you just go to the .asmx page using IE?

-Paul

"Daniel Bass" <I'm really @ sick of spam> wrote in message
news:%2******** ********@TK2MSF TNGP09.phx.gbl. ..

Hey,

[ Background ]
I've been asked to look into network security where an IIS virtual

directory

is configure to not have anonymous access, but rather to go with the

windows

authentication (what the user signs in as at client). This is in the

context

of a ASP.Net web service running on an intranet.

[ What I have done ]
- I've ticked and unticked all the right boxes in IIS.
- I've also added the
"myserviceproxy .Credentials =
System.Net.Cred entialCache.Def aultCredentials ;"
to the client side [ Web / Windows ] Application so that they are

passed

through to the server for the request message.
- I've also ensured that my user account on the client side, is registered
as a user on the server on which the web service resides.

[ The problem ]
But when I try to process any messages, I get back an HTTP 401: Access
Denied message.
What am I doing wrong, or not doing at all?
I'm very new to all this, so if I'm missing something obvious, please
forgive me.

Thanks for your time.
Daniel.

[Christian Boult]

Have you setup directory permissions (ACL's) on the base directory of the
web app allowing at least read access to the domain users / groups that are
to access the webservice ?
This is how it is set up for us and it works very well.

You might be authenticated all right but you don't have any access to the
directory so IIS dosen't allow you in.

Chris.

"Ed" <ed************ *@yahoo.com> wrote in message
news:15******** *************** ***@posting.goo gle.com...

Daniel or Paul,

Was there any resolution to this problem? I am having the same
problem as Daniel describes. I have even gone as far as making a
"dummy" method on the web service that returns the
System.Net.Secu rity.WindowsPri ncipal.Identity and it shows my user
name.... When I try to connect to a SQL Server DB from that same Web
Service, using SSPI, it tries to connect as anonymous.

Is there some setting that I am missing?

Thanks, any information would be helpful.

Ed Castaneda
"Daniel Bass" <I'm really @ sick of spam> wrote in message

news:<Om******* *******@TK2MSFT NGP10.phx.gbl>. ..

Paul

That works as you'd expect, giving you that page with the avialable methods on the web service.

Dan

"Paul" <[e-mail]> wrote in message
news:OO******** ******@TK2MSFTN GP12.phx.gbl...
Daniel,

What happens when you just go to the .asmx page using IE?

-Paul

"Daniel Bass" <I'm really @ sick of spam> wrote in message
news:%2******** ********@TK2MSF TNGP09.phx.gbl. ..

Hey,

[ Background ]
I've been asked to look into network security where an IIS virtual

directory

is configure to not have anonymous access, but rather to go with the

windows

authentication (what the user signs in as at client). This is in the

context

of a ASP.Net web service running on an intranet.

[ What I have done ]
- I've ticked and unticked all the right boxes in IIS.
- I've also added the
"myserviceproxy .Credentials =
System.Net.Cred entialCache.Def aultCredentials ;"
to the client side [ Web / Windows ] Application so that they are

passed

through to the server for the request message.
- I've also ensured that my user account on the client side, is registered as a user on the server on which the web service resides.

[ The problem ]
But when I try to process any messages, I get back an HTTP 401: Access
Denied message.
What am I doing wrong, or not doing at all?
I'm very new to all this, so if I'm missing something obvious, please
forgive me.

Thanks for your time.
Daniel.