Access to WSDL files (authentication general practices - long)

[David]

We have a .NET web service that has IIS authentication set to "allow
anonymous". However, the web service does its own 'application-level'
authentication (by validating the HTTP authentication header against an
internal database) before allowing access to its various methods. Works fine.

However, using this approach means that client access to the WSDL file (via
....url/path/ws.aspx?wsdl) is ALSO 'application-authenticated'. Which means
that in order to simply see the definition of the service, the client must
supply authentication. So if you simply type our url?wsdl into a browser,
you'll get prompted for authentication info...a surprise to most users.

And the one dynamic service discovery mechanism with which I'm familiar -
the MS webservice.htc (HTML Component) - doesn't allow for specifying a
userid/password at the point when it is accessing the WSDL (when its
"useservice" function is invoked). Later on - when a method is invoked (via
its "callservice" function), you can specify userid/password. But it never
gets that far, since it can't access the WSDL.

===> So, in general, are WSDL files "expected" to be accessible via
anonymous connections? (at least for web services living on the public
Internet). Or is webservice.htc simply taking a shortcut, and a "complete
implementation" would allow for supplying a userid/password - even when
simply downloading a WSDL?

Thanks for any advice/insight,

DT Houston