The authentication scheme 'NTML' is not supported

[chen]

I posted this in the WCF forum and didn't see any response. Re-posting
here to a wider audience to see if anyone else has seen similar
behavior...

Created a simple service in WCF and hosted it on my XP box in IIS
(5.1) which works as expected. I was interested in exposing the
endpoint to both WCF & non-WCF clients: i.e. the service is exposed
using both wsHttpBinding as well as basicHttpBinding.
When I tried to setup the same service on a W2k3 m/c and i get this
error. The stack trace is presented below:
Code Snippet[NotSupportedException: The authentication scheme 'NTML'
is not supported.]

System.ServiceModel.Activation.MetabaseSettingsIis .RemapAuthenticationSchemes(AuthFlags
flags, String[] providers) +241

System.ServiceModel.Activation.MetabaseSettingsIis .GetAuthenticationSchemes(String
virtualPath) +25

System.ServiceModel.Channels.HttpChannelListener.A pplyHostedContext(VirtualPathExtension
virtualPathExtension, Boolean isMetadataListener) +33

System.ServiceModel.Activation.VirtualPathExtensio n.ApplyHostedContext(TransportChannelListener
listener, BindingContext context) +4347180

System.ServiceModel.Channels.HttpTransportBindingE lement.BuildChannelListener(BindingContext
context) +112

System.ServiceModel.Channels.BindingContext.BuildI nnerChannelListener()
+63

System.ServiceModel.Channels.DatagramChannelDemuxe r`2..ctor(BindingContext
context) +84
System.ServiceModel.Channels.ChannelDemuxer.GetTyp edDemuxer(Type
channelType, BindingContext context) +187

System.ServiceModel.Channels.ChannelDemuxer.BuildC hannelListener(BindingContext
context, ChannelDemuxerFilter filter) +56

System.ServiceModel.Channels.ChannelDemuxerBinding Element.BuildChannelListener(BindingContext
context) +178

System.ServiceModel.Channels.BindingContext.BuildI nnerChannelListener()
+63

System.ServiceModel.Channels.MessageEncodingBindin gElement.InternalBuildChannelListener(BindingConte xt
context) +67

System.ServiceModel.Channels.TextMessageEncodingBi ndingElement.BuildChannelListener(BindingContext
context) +46

System.ServiceModel.Channels.BindingContext.BuildI nnerChannelListener()
+63
System.ServiceModel.Channels.ChannelBuilder.BuildC hannelListener()
+57

System.ServiceModel.Security.SecuritySessionServer Settings.CreateInnerChannelListener()
+334

System.ServiceModel.Channels.SecurityChannelListen er`1.InitializeListener(ChannelBuilder
channelBuilder) +64

System.ServiceModel.Channels.SymmetricSecurityBind ingElement.BuildChannelListenerCore(BindingContext
context) +2436

System.ServiceModel.Channels.SecurityBindingElemen t.BuildChannelListener(BindingContext
context) +206

System.ServiceModel.Channels.BindingContext.BuildI nnerChannelListener()
+63

System.ServiceModel.Channels.TransactionFlowBindin gElement.BuildChannelListener(BindingContext
context) +178

System.ServiceModel.Channels.BindingContext.BuildI nnerChannelListener()
+63
System.ServiceModel.Channels.Binding.BuildChannelL istener(Uri
listenUriBaseAddress, String listenUriRelativeAddress, ListenUriMode
listenUriMode, BindingParameterCollection parameters) +125

System.ServiceModel.Description.DispatcherBuilder. MaybeCreateListener(Boolean
actuallyCreate, Type[] supportedChannels, Binding binding,
BindingParameterCollection parameters, Uri listenUriBaseAddress,
String listenUriRelativeAddress, ListenUriMode listenUriMode,
ServiceThrottle throttle, IChannelListener& result) +4348670

System.ServiceModel.Description.DispatcherBuilder. BuildChannelListener(StuffPerListenUriInfo
stuff, ServiceHostBase serviceHost, Uri listenUri, ListenUriMode
listenUriMode, IChannelListener& result) +758

System.ServiceModel.Description.DispatcherBuilder. InitializeServiceHost(ServiceDescription
description, ServiceHostBase serviceHost) +1240
System.ServiceModel.ServiceHostBase.InitializeRunt ime() +37
System.ServiceModel.ServiceHostBase.OnOpen(TimeSpa n timeout) +63
System.ServiceModel.Channels.CommunicationObject.O pen(TimeSpan
timeout) +268
System.ServiceModel.Channels.CommunicationObject.O pen() +30
System.ServiceModel.HostingManager.ActivateService (String
normalizedVirtualPath) +104
System.ServiceModel.HostingManager.EnsureServiceAv ailable(String
normalizedVirtualPath) +445

Authentication scheme NTML??? [not a typo!]
..NET 3.0 was recently installed on this m/c & i've verified that the
installation is correct. In fact, if i host the service in a console
app, it behaves correctly. Only hosting in IIS 6.0 seems to be
exhibiting this symptom.

Spelunking using Reflector, it appears that the
MetabaseSettingsIis.cctor sets up the DefaultAuthProviders to be
"negotiate" & "ntlm". It appears as if NTLM is somehow clobbered to
become "NTML" causing the above exception to be thrown. Any IIS
settings that i should check that would affect this? Any ideas or
pointers please? I've been struggling with this for almost a week
now...

TIA,
chen

[tiago.halm]

Better check what is set on the metabase. I would guess somehow the
NTAuthenticationProviders metabase key has wrong values.
Open a prompt and type:

# cd c:\inetpub\AdminScripts
# cscript adsutil.vbs get w3svc/NTAuthenticationProviders

If you find you have something like "Negotiate,NTML" then type:
# cscript adsutil.vbs set w3svc/NTAuthenticationProviders
"Negotiate,NTLM"
or delete the key, since IIS6 has this value by default
# cscript adsutil.vbs delete w3svc/NTAuthenticationProviders

By the way, you should probably check it also on the specific WebSite
where the service is setup, example:
# cscript adsutil.vbs get w3svc/1/ROOT/NTAuthenticationProviders

IIS6 already has "Negotiate, NTLM" by default.
http://support.microsoft.com/kb/215383

Tiago Halm

[chen]

I had checked w3svc/NTAuthenticationProviders as well as w3svc/1/
NTAuthenticationProviders earlier. Didn't realize i had to check w3svc/
NT/1/ROOT/AuthenticationProviders as well. Sure enough, this one had
Negotiate & NTML. Once it reset it to NTLM, it worked.

Thanks for the tip.

On Sep 10, 2:58 pm, [e-mail] wrote:

Better check what is set on the metabase. I would guess somehow the
NTAuthenticationProviders metabase key has wrong values.
Open a prompt and type:

# cd c:\inetpub\AdminScripts
# cscript adsutil.vbs get w3svc/NTAuthenticationProviders

If you find you have something like "Negotiate,NTML" then type:
# cscript adsutil.vbs set w3svc/NTAuthenticationProviders
"Negotiate,NTLM"
or delete the key, since IIS6 has this value by default
# cscript adsutil.vbs delete w3svc/NTAuthenticationProviders

By the way, you should probably check it also on the specific WebSite
where the service is setup, example:
# cscript adsutil.vbs get w3svc/1/ROOT/NTAuthenticationProviders

IIS6 already has "Negotiate, NTLM" by default.http://support.microsoft.com/kb/215383

Tiago Halm