WCF windows authentication doesn't work after deploy - wcf

Question

I have WCF service with windows authentication. After deploying it to another server I received the following exception:
System.ServiceModel.Security.MessageSecurityException: The HTTP request is unauthorized with client authentication scheme 'Anonymous'. The authentication header received from the server was 'Negotiate,NTLM'. ---> System.Net.WebException: The remote server returned an error: (401) Unauthorized
The client configuration doesn't changed and looks like this:
<ws2007HttpBinding>
<binding name="autoSecureBinding">
<security mode="TransportWithMessageCredential">
<transport clientCredentialType="Windows" proxyCredentialType="None" realm=""></transport>
<message clientCredentialType="Windows" negotiateServiceCredential="true" establishSecurityContext="false"/>
</security>
</binding>
</ws2007HttpBinding>
EDIT: When I open my service in browser I receive the following error:
Security settings for this service require 'Anonymous' Authentication but it is not enabled for the IIS application that hosts this service.
Does anybody know what could be the problem?

Answer 1

Is another server under the same active directory domain?
Also You want to go to target IIS and see if Site / Application Authentication settings have "Windows Authentication" set to "Enabled". (See screens for IIS7 below)

Answer 2

Here is a working web.config of a Win auth only WCF service that I am using (Only Windows Authentication is enabled in IIS).
<?xml version="1.0" encoding="UTF-8"?>
<configuration>
<system.web>
<compilation debug="true" targetFramework="4.0" />
</system.web>
<system.serviceModel>
<behaviors>
<serviceBehaviors>
<behavior>
<!-- To avoid disclosing metadata information, set the value below to false and remove the metadata endpoint above before deployment -->
<serviceMetadata httpGetEnabled="true" />
<!-- To receive exception details in faults for debugging purposes, set the value below to true. Set to false before deployment to avoid disclosing exception information -->
<serviceDebug includeExceptionDetailInFaults="true" />
</behavior>
</serviceBehaviors>
</behaviors>
<serviceHostingEnvironment aspNetCompatibilityEnabled="true" multipleSiteBindingsEnabled="true" />
<bindings>
<basicHttpBinding>
<binding name="MyBindingForWindowsAuth">
<security mode="TransportCredentialOnly">
<transport clientCredentialType="Ntlm" />
<!--<transport clientCredentialType="Windows" />-->
</security>
</binding>
</basicHttpBinding>
</bindings>
<services>
<service name="DataAccessService.Service">
<endpoint address="" binding="basicHttpBinding" bindingConfiguration="MyBindingForWindowsAuth" contract="DataAccessService.IService" />
<endpoint address="mex" binding="basicHttpBinding" bindingConfiguration="MyBindingForWindowsAuth" contract="IMetadataExchange" />
</service>
</services>
</system.serviceModel>
<system.webServer>
<modules runAllManagedModulesForAllRequests="true" />
<directoryBrowse enabled="true" />
</system.webServer>
</configuration>
With this setup in place, if you want to pass ASP.NET user identity to WCF you have 3 options:
Option 1:
client.ClientCredentials.Windows.ClientCredential = new NetworkCredential("phil.morris", "P4ssW0rd", "mydomain");
Option 2:
Use impersonate:
using (((WindowsIdentity)HttpContext.Current.User.Identity).Impersonate())
{
string s = client.GetUserInfo();
retVal = "Wcf User: " + s;
}
Option 3:
ENABLE ASP.NET Impersonation in the caller ASP.NET application