Make Wcf Service IntegratedWindowsAuthentication

Question

I m getting the following error when I did set the Windows Authentication enable and anonymous to disabled in IIS.

The authentication schemes configured on the host ('IntegratedWindowsAuthentication') do not allow those configured on the binding 'BasicHttpBinding' ('Anonymous'). Please ensure that the SecurityMode is set to Transport or TransportCredentialOnly. Additionally, this may be resolved by changing the authentication schemes for this application through the IIS management tool, through the ServiceHost.Authentication.AuthenticationSchemes property, in the application configuration file at the element, by updating the ClientCredentialType property on the binding, or by adjusting the AuthenticationScheme property on the HttpTransportBindingElement.

My Wcf Service's web.config is as follows...

<?xml version="1.0"?>
<configuration>
  <appSettings>
    <add key="aspnet:UseTaskFriendlySynchronizationContext" value="true" />
  </appSettings>
  <system.web>
    <compilation debug="true" targetFramework="4.5" />
    <httpRuntime targetFramework="4.5"/>
  </system.web>
  <system.serviceModel>
    <bindings>
      <basicHttpBinding>
        <binding name="BasicHttpEndpointBinding">
          <security mode="TransportCredentialOnly">
            <transport clientCredentialType="Windows" />
          </security>
        </binding>
      </basicHttpBinding>
    </bindings>
    <client>
      <endpoint binding="basicHttpBinding" 
        bindingConfiguration="BasicHttpEndpointBinding"
        contract="Test.IService1" name="BasicHttpEndpoint" />
    </client>
    <behaviors>
      <serviceBehaviors>
        <behavior>
          <serviceAuthenticationManager 
             authenticationSchemes="IntegratedWindowsAuthentication"/>
          <serviceMetadata httpGetEnabled="true" httpsGetEnabled="false"/>
          <serviceDebug includeExceptionDetailInFaults="true"/>
        </behavior>
      </serviceBehaviors>
    </behaviors>
    <protocolMapping>
        <add binding="basicHttpBinding" scheme="http" />
    </protocolMapping>    
    <serviceHostingEnvironment aspNetCompatibilityEnabled="true"
         multipleSiteBindingsEnabled="true" />
  </system.serviceModel>
  <system.webServer>
    <modules runAllManagedModulesForAllRequests="true"/>
    <directoryBrowse enabled="true"/>
  </system.webServer>
</configuration>

Please advice..

I don't see a service definition in your config, just a client. If this is your service's config file and you're using .NET 4.0+, chances are you're getting a default endpoint, which may not have the security set properly. You need to assign the binding you create in your config file to your service as well. — Tim, Mar 07 '13 at 07:07
Thanks. Now its Error Free. But how to avoid the authentication .means how to avoid asking username and password when browsed the service via IIS. Please help. — user214471, Mar 07 '13 at 08:24
If the user is the same as machine login user, then please recommand a way to avoid this authentication when browsed a Wcf Service via IIS. — user214471, Mar 07 '13 at 08:47
I don't think you can avoid the username/password when browsing the service. You could remove the security settings on the service, but then you wouldn't have security when clients connect. — Tim, Mar 07 '13 at 16:31
I mean, I just need a second layer security. if the user is same as that is currently logged in, then it would not ask for authentication. Else, ask for authentication as part of Second layer security. please see my new thread also. http://stackoverflow.com/questions/15289066/adding-second-layer-security-for-wcf-service — user214471, Mar 08 '13 at 07:51

score 51 · Answer 1 · answered Oct 31 '13 at 18:48

In .Net 4.0+, Simplified WCF configuration uses the 'anonymous' configurations when configurations are not explicitly set on a per-services basis in the <services> section. If you remove the name="BasicHttpEndpointBinding" from the <binding> element, or if you duplicate that <binding> element as a new element with no name attribute, it will become the default, anonymous binding that your WCF services will use. This is often useful in cases where you need to serve as well as consume WCF services that may not all have the same config - but at least you can set a default config for the services that do not have a specific config set. The default/anonymous concept is also applicable to <behavior> elements.

<bindings>
  <basicHttpBinding>
    <binding> <!--Notice, no name attribute set-->
      <security mode="TransportCredentialOnly">
        <transport clientCredentialType="Windows" />
      </security>
    </binding>
  </basicHttpBinding>
</bindings>

Also, I might add that if your WCF services require authentication, this means that you will either need to consume the service using a real user account, or you will need to grant the the DOMAIN\CLIENTCOMPUTERNAME$ account access to the service - so, perhaps the proper solution for many people may be to alter the configuration to instead allow anonymous access (which is not discussed in my answer). Still, I do sometimes actually elect to secure my WCF services with Windows (Kerberos) authentication.

Thank you for response and explanation. I was exactly in the same case but for webHttpBinding. — AFract, Mar 31 '16 at 14:00
This worked for me! I had everything set correctly, all settings set as they should be, just had this attribute set and was getting 500 errors because of it. — pizza_coder, Feb 21 '23 at 10:59

score 14 · Answer 2 · answered Oct 31 '14 at 21:39

14

Adding this worked for me.

        <bindings>
        <webHttpBinding>
            <binding>
                <security mode="TransportCredentialOnly">
                    <transport clientCredentialType="Windows" />
                </security>
            </binding>
        </webHttpBinding>
    </bindings>

answered Oct 31 '14 at 21:39

Rian

141
1
2

This one didn't work in my scenario, but scradams answer did--the only difference seems to be scradam uses basicHttpBinding and this references webHttpBinding. What is the difference between these keywords? – Jeff Nov 06 '15 at 02:27
webHttpBinding is for REST JSON services (in a web application for example), basicHttpBinding is for SOAP. See http://stackoverflow.com/questions/2650785/basichttpbinding-vs-wshttpbinding-vs-webhttpbinding or WCF documentation about different bindings. – AFract Mar 31 '16 at 13:58
This was what I needed - I had been using examples based on SSL-type authentication, and while I had changed things to use the "TransportCredentialOnly" mode, was still getting the error messages because I had the clientCredentialType set to "Basic". Thanks! – Blaine DeLancey Feb 20 '17 at 22:01

score 2 · Answer 3 · edited Oct 21 '16 at 12:54

I got this error when updating from .NET 4.0 to .NET 4.5.2. I changed the clientCredentialType from

<security mode="TransportCredentialOnly">
    <transport clientCredentialType="None"/>
</security>

to

<security mode="TransportCredentialOnly">
    <transport clientCredentialType="InheritedFromHost"/>
</security>

However, setting clientCredentialType="Windows" works equally well.

score 2 · Answer 4 · answered May 03 '18 at 17:41

I had the same issue when consuming already existing WCF web URL. I tried all the answers mentioned here , but all in all finally only two things helped.

Changing the setting in "Turn windows Features on and off".

Enabling Anonymous authentication along with Windows Authentication in Local IIS server.

score 0 · Answer 5 · answered Mar 13 '13 at 12:41

<services>
      <service name="Test.Service1" behaviorConfiguration="TestName">
        <endpoint address="" binding="basicHttpBinding" bindingConfiguration="BasicHttpEndpointBinding" contract="Test.IService1" />
      </service>
    </services>

It solved my problem.

score 0 · Answer 6 · answered Apr 12 '14 at 19:55

Like the other answers, I needed to update the binding in my Web.config to this:

<basicHttpBinding>
  <binding name="basicHttpBindin1">
    <security mode="TransportCredentialOnly">
      <transport clientCredentialType="Windows" />
    </security>
  </binding>
</basicHttpBinding>

But I also needed to update my binding's instantiation:

var binding = new BasicHttpBinding { MaxReceivedMessageSize = 1000000, ReaderQuotas = { MaxDepth = 200 } };

binding.Security.Transport.ClientCredentialType = HttpClientCredentialType.Windows;
binding.Security.Mode = BasicHttpSecurityMode.TransportCredentialOnly;
binding.Security.Message.ClientCredentialType = BasicHttpMessageCredentialType.UserName;

score 0 · Answer 7 · answered Apr 06 '17 at 16:24

I had add a webHttpBinding and point my endpoint to that, which the security settings needed to work. Without that my endpoint used the default WCF config bindings:

    <services>
  <service behaviorConfiguration="ServiceBehavior" name="Service">
    <endpoint address="" binding="webHttpBinding" contract="IService" />
    <endpoint address="mex" binding="mexHttpBinding" contract="IMetadataExchange" />
  </service>
</services>
<behaviors>
  <serviceBehaviors>
    <behavior name="ServiceBehavior">
      <serviceMetadata httpGetEnabled="true" httpsGetEnabled="true" />
      <serviceDebug includeExceptionDetailInFaults="false" />
    </behavior>
  </serviceBehaviors>
</behaviors>
<serviceHostingEnvironment aspNetCompatibilityEnabled="true" multipleSiteBindingsEnabled="true" />
<bindings>
  <webHttpBinding>
      <binding>
        <!--Notice, no name attribute set-->
        <security mode="TransportCredentialOnly">
          <transport clientCredentialType="Windows" />
        </security>
      </binding>
  </webHttpBinding>

</bindings>

score 0 · Answer 8 · answered Jan 24 '18 at 05:13

I'm not entirely sure why, but when I added the 'Factory' attribute to my .SVC file (you need to explicitly drag it to Visual Studio), everything just works - without any changes to default settings in Web.config!

I added Factory="System.ServiceModel.Activation.WebServiceHostFactory" so my .SVC file went from this:

<%@ ServiceHost Language="C#" Debug="true" Service="ServiceNameSpace.ServiceName" CodeBehind="ServiceName.svc.cs" %>

to this:

<%@ ServiceHost Language="C#" Debug="true" Service="ServiceNameSpace.ServiceName" CodeBehind="ServiceName.svc.cs" Factory="System.ServiceModel.Activation.WebServiceHostFactory" %>

The only side effect seems to be that when you click on the .SVC file in the browser, you get an 'Endpoint not found' error, but the service works fine when you invoke it correctly anyway. As mentioned previously, I'm using a default Web.config with .NET 4.6 (Simplified WCF configuration), so I may yet need to add endpoint details for that to work again.

Make Wcf Service IntegratedWindowsAuthentication

8 Answers8

Linked