Authorization HTML Header going missing

[Shaun Wilde]

I am not sure if this is a .NET bug/feature and IIS5 one or a combination of
the 2 so here goes

I have a situation where when I call an ASP.NET webservice running under
windows 2000 (I assume IIS5) with a webservice client also in .NET that the
webservice request loses the Authorization HTML header.

This DOES NOT happen under Windows 2003.

I am using the followng (patch/fix) to preauthenticate the web request (this
is from a KB article, or newsgroup article I think)

Protected Overrides Function GetWebRequest(B yVal uri As System.Uri) As
System.Net.WebR equest
Dim webReq As System.Net.WebR equest = MyBase.GetWebRe quest(uri)
If Me.PreAuthentic ate Then
Dim cred As System.Net.Netw orkCredential =
Me.Credentials. GetCredential(u ri, "Basic")
If Not cred Is Nothing Then
Dim buff As Byte() = New
System.Text.UTF 8Encoding().Get Bytes(cred.User Name & ":" & cred.Password)
webReq.Headers( "Authorization" ) = "Basic " &
Convert.ToBase6 4String(buff)
End If
End If
Return webReq
End Function
Also webservice and client are running under the same process/application -
long story but it is to fake the fact that the server we are supposed to
talk to isn't available yet.

i.e. under my webservice I have 2 folders - in one folder I have the .asmx
files that our web application talks to and under the other folder I have a
..asmx that responds the way the 3rd party service is supposed to
with requests to the first folder causing a request to the second.

I hope someone can tell me what is going on.

Regards

Shaun

[Steven Cheng[MSFT]]

Hi Shaun,

Thanks for your followup. En, yes, I did tried both BAsic Authentication
turn ON and OFF when testing on my local w2k box. That's why I think the
problem is due to a enviroment specific issue.
Also, if you can leave your service as anonymous turn on in IIS, I think
you can try use a custom httpheader to carry the username/password info ,
does this work? Anyway, please feel free to post here if you got any
further findings.

Regards,

Steven Cheng
Microsoft Online Support

Get Secure! www.microsoft.com/security
(This posting is provided "AS IS", with no warranties, and confers no
rights.)

[Shaun Wilde]

Hi Steven

I have 4 different boxes it happens to. 2 developer boxes, 1 deployment box
and my own home machine. And it doesn't work on either and yet you say it
works on your machines then there is a bug somewhere (maybe a patch). Also
other posters in the past have noted the same issue (Google groups).
If it is patch related there is no way to determine and or fix it so I can't
rely on it working elsewhere. I think I am going to have to insist that
they use IIS basic Authentication in win2k machine.

Unfortunately I can't use a custom HTTP header as other (3rd party) clients
(java based) need to connect and the standard I am following requires that
we
use the Authorization header and preauthenticati on.

Shaun
"Steven Cheng[MSFT]" <v-******@online.m icrosoft.com> wrote in message
news:RK******** ******@cpmsftng xa10.phx.gbl...

Hi Shaun,

Thanks for your followup. En, yes, I did tried both BAsic Authentication
turn ON and OFF when testing on my local w2k box. That's why I think the
problem is due to a enviroment specific issue.
Also, if you can leave your service as anonymous turn on in IIS, I think
you can try use a custom httpheader to carry the username/password info ,
does this work? Anyway, please feel free to post here if you got any
further findings.

Regards,

Steven Cheng
Microsoft Online Support

Get Secure! www.microsoft.com/security
(This posting is provided "AS IS", with no warranties, and confers no
rights.)

[Steven Cheng[MSFT]]

Thanks for your reply Shaun,

Currently I haven't any definite ideas on this. But I'll hold on and wait
for the testing result (by the isapi I attached in the former message) from
you. That'll help us dig some further. Thanks.

Regards,

Steven Cheng
Microsoft Online Support

Get Secure! www.microsoft.com/security
(This posting is provided "AS IS", with no warranties, and confers no
rights.)

[Steven Cheng[MSFT]]

Hi Shuan,

Any further progress on this issue? If there're any updating or new
findings , please feel free to post here.
Thanks.

Regards,

Steven Cheng
Microsoft Online Support

Get Secure! www.microsoft.com/security
(This posting is provided "AS IS", with no warranties, and confers no
rights.)

[Shaun Wilde]

Hi

Nothing new as yet - got too much other things on that I haven't had time to
spend on this.

Its odd that on all windows sever 2000 machines I have test on with the
application runing on exhibits the problem and not platforms. As I said
since there does not seem a way to predict it then I'll have to assume worst
case scenario and treat all windows server 2000 machines as having the same
problem.

Shaun

"Steven Cheng[MSFT]" <v-******@online.m icrosoft.com> wrote in message
news:8Z******** ******@cpmsftng xa10.phx.gbl...

Hi Shuan,

Any further progress on this issue? If there're any updating or new
findings , please feel free to post here.
Thanks.

Regards,

Steven Cheng
Microsoft Online Support

Get Secure! www.microsoft.com/security
(This posting is provided "AS IS", with no warranties, and confers no
rights.)

[Steven Cheng[MSFT]]

Ok Shaun, if you have time to do some further investigate and got any
findings on this, please feel free to post here. Thanks.

Regards,

Steven Cheng
Microsoft Online Support

Get Secure! www.microsoft.com/security
(This posting is provided "AS IS", with no warranties, and confers no
rights.)