Restful WCF and Basic Authentication via Fidder - wcf

Question

I have created a WCF rest web service. However the client has requested the service be locked down with Basic Authentication but allow them to present the authorization token on first response rather than a challenge. Unfortunately I only have IIS 6 on my test machine
I only really need to simulate Basic Authentication so I doing this over anonymous and throwing an error if the Authorisation token is incorrect. However auth token is not available to the WCF
http://localhost/test.svc/get/token/
Content-Type: application/x-www-form-urlencoded
Authorization: Basic Base64Value
If I remove anonymous and add basic in IIS. All's I get is a 401. Which I guess in IIS doing the authentication before the WCF.
Ideally I'd just like anoymous access and be able to access the authorization header.
How can I get the auth header

Answer 1

Your assumption for this beeing an issue of IIS 6 is probably right.
I just created a WCF service "xxx.svc" and hosted it in the IIS (7.5), and when I requested it with fiddler2 with a correct Authorization header, it did not send a HTTP 401.
I will post my code so that you test it on IIS 6. If it still gives you HTTP 401, then this is surely an IIS 6 issue, if not try to compare and contrast your code with mine and see what configurations are different.
web.config:
<configuration>
<system.web>
<compilation debug="true" targetFramework="4.0" />
</system.web>
<system.serviceModel>
<bindings>
<webHttpBinding>
<binding name="webHttpBindConfig">
<security mode="TransportCredentialOnly">
<transport clientCredentialType="Basic" proxyCredentialType="None" />
</security>
</binding>
</webHttpBinding>
</bindings>
<services>
<service name="MyTestSvc.MyService">
<endpoint address="http://localhost/TestBasicAuth/Service1.svc" behaviorConfiguration="webHttpEndpointBehavior"
binding="webHttpBinding" bindingConfiguration="webHttpBindConfig"
name="webHttpBindingEndpoint" contract="MyTestSvc.IMyService" />
<host>
<baseAddresses>
</baseAddresses>
</host>
</service>
</services>
<behaviors>
<endpointBehaviors>
<behavior name="webHttpEndpointBehavior">
<webHttp />
</behavior>
</endpointBehaviors>
</behaviors>
</system.serviceModel>
<system.webServer>
<modules runAllManagedModulesForAllRequests="true"/>
</system.webServer>
</configuration>
Service1.svc
<%# ServiceHost Language="C#" Debug="true" Service="MyTestSvc.MyService" CodeBehind="Service1.svc.cs" %>
IService1.cs
using System;
using System.Collections.Generic;
using System.Linq;
using System.Runtime.Serialization;
using System.ServiceModel;
using System.ServiceModel.Web;
using System.Text;
namespace MyTestSvc
{
// NOTE: You can use the "Rename" command on the "Refactor" menu to change the interface name "IService1" in both code and config file together.
[ServiceContract]
public interface IMyService
{
[OperationContract]
[WebGet(UriTemplate=#"/Hello")]
string GetData();
}
}
and finally: Service1.svc.cs
using System;
using System.Collections.Generic;
using System.Linq;
using System.Runtime.Serialization;
using System.ServiceModel;
using System.ServiceModel.Web;
using System.Text;
namespace MyTestSvc
{
// NOTE: You can use the "Rename" command on the "Refactor" menu to change the class name "Service1" in code, svc and config file together.
public class MyService : IMyService
{
public string GetData()
{
WebOperationContext webCtx = WebOperationContext.Current;
IncomingWebRequestContext incomingCtx = webCtx.IncomingRequest;
string hdrVal = incomingCtx.Headers["Authorization"];
return string.Format("Authorization: {0}", hdrVal);
}
}
}
fiddler Results: