Make Wcf Service IntegratedWindowsAuthentication

Question

I m getting the following error when I did set the Windows Authentication enable and anonymous to disabled in IIS.

The authentication schemes configured on the host ('IntegratedWindowsAuthentication') do not allow those configured on the binding 'BasicHttpBinding' ('Anonymous'). Please ensure that the SecurityMode is set to Transport or TransportCredentialOnly. Additionally, this may be resolved by changing the authentication schemes for this application through the IIS management tool, through the ServiceHost.Authentication.AuthenticationSchemes property, in the application configuration file at the element, by updating the ClientCredentialType property on the binding, or by adjusting the AuthenticationScheme property on the HttpTransportBindingElement.

My Wcf Service's web.config is as follows...

<?xml version="1.0"?> <configuration>   <appSettings>     <add key="aspnet:UseTaskFriendlySynchronizationContext" value="true" />   </appSettings>   <system.web>     <compilation debug="true" targetFramework="4.5" />     <httpRuntime targetFramework="4.5"/>   </system.web>   <system.serviceModel>     <bindings>       <basicHttpBinding>         <binding name="BasicHttpEndpointBinding">           <security mode="TransportCredentialOnly">             <transport clientCredentialType="Windows" />           </security>         </binding>       </basicHttpBinding>     </bindings>     <client>       <endpoint binding="basicHttpBinding"          bindingConfiguration="BasicHttpEndpointBinding"         contract="Test.IService1" name="BasicHttpEndpoint" />     </client>     <behaviors>       <serviceBehaviors>         <behavior>           <serviceAuthenticationManager               authenticationSchemes="IntegratedWindowsAuthentication"/>           <serviceMetadata httpGetEnabled="true" httpsGetEnabled="false"/>           <serviceDebug includeExceptionDetailInFaults="true"/>         </behavior>       </serviceBehaviors>     </behaviors>     <protocolMapping>         <add binding="basicHttpBinding" scheme="http" />     </protocolMapping>         <serviceHostingEnvironment aspNetCompatibilityEnabled="true"          multipleSiteBindingsEnabled="true" />   </system.serviceModel>   <system.webServer>     <modules runAllManagedModulesForAllRequests="true"/>     <directoryBrowse enabled="true"/>   </system.webServer> </configuration> 

Please advice..

Answer 1

In .Net 4.0+, Simplified WCF configuration uses the 'anonymous' configurations when configurations are not explicitly set on a per-services basis in the <services> section. If you remove the name="BasicHttpEndpointBinding" from the <binding> element, or if you duplicate that <binding> element as a new element with no name attribute, it will become the default, anonymous binding that your WCF services will use. This is often useful in cases where you need to serve as well as consume WCF services that may not all have the same config - but at least you can set a default config for the services that do not have a specific config set. The default/anonymous concept is also applicable to <behavior> elements.

<bindings>   <basicHttpBinding>     <binding> <!--Notice, no name attribute set-->       <security mode="TransportCredentialOnly">         <transport clientCredentialType="Windows" />       </security>     </binding>   </basicHttpBinding> </bindings> 

Also, I might add that if your WCF services require authentication, this means that you will either need to consume the service using a real user account, or you will need to grant the the DOMAIN\CLIENTCOMPUTERNAME$ account access to the service - so, perhaps the proper solution for many people may be to alter the configuration to instead allow anonymous access (which is not discussed in my answer). Still, I do sometimes actually elect to secure my WCF services with Windows (Kerberos) authentication.

Answer 2

Adding this worked for me.

        <bindings>         <webHttpBinding>             <binding>                 <security mode="TransportCredentialOnly">                     <transport clientCredentialType="Windows" />                 </security>             </binding>         </webHttpBinding>     </bindings>