Configure NTLM Authentication Using WCF for Sharepoint Web Services

Question

I'm having difficulty setting up a WCF service to talk to Sharepoint web services, in particular, I'm trying to use List.asmx and Copy.asmx services.

I worked using the http link for sharepoint for development, but now we need to switch to the HTTPS link. I got the configuration of web links and updated this link, but when it tries to call a service (for example, GetListItems), it gives an error with the following error: Request failed with HTTP status 401: Unauthorized.

Then I tried to figure out what type of authentication our Sharepoint server uses, which turned out to be NTLM. Then I tried to configure the web.config file for this. Here is the whole web.config file:

<?xml version="1.0"?> <configuration> <configSections> <sectionGroup name="applicationSettings" type="System.Configuration.ApplicationSettingsGroup, System, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089"> <section name="InventoryService.Properties.Settings" type="System.Configuration.ClientSettingsSection, System, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" requirePermission="false"/> </sectionGroup> </configSections> <appSettings/> <connectionStrings/> <system.web> <compilation debug="true" targetFramework="4.0"> </compilation> <!-- The <authentication> section enables configuration of the security authentication mode used by ASP.NET to identify an incoming user. --> <authentication mode="Windows"/> <!-- The <customErrors> section enables configuration of what to do if/when an unhandled error occurs during the execution of a request. Specifically, it enables developers to configure html error pages to be displayed in place of a error stack trace. <customErrors mode="RemoteOnly" defaultRedirect="GenericErrorPage.htm"> <error statusCode="403" redirect="NoAccess.htm" /> <error statusCode="404" redirect="FileNotFound.htm" /> </customErrors> --> <pages controlRenderingCompatibilityVersion="3.5" clientIDMode="AutoID"/></system.web> <!-- The system.webServer section is required for running ASP.NET AJAX under Internet Information Services 7.0. It is not necessary for previous version of IIS. --> <system.serviceModel> <bindings> <basicHttpBinding> <binding name="NewBinding0"> <security mode="TransportCredentialOnly"> <transport clientCredentialType="Ntlm" proxyCredentialType="None" /> </security> </binding> </basicHttpBinding> </bindings> <services> <service behaviorConfiguration="InventoryService.Service1Behavior" name="InventoryService.InventoryService"> <endpoint address="" binding="basicHttpBinding" bindingConfiguration="NewBinding0" contract="InventoryService.IInventoryService"> <identity> <dns value="localhost" /> </identity> </endpoint> <endpoint address="mex" binding="mexHttpBinding" contract="IMetadataExchange" /> </service> </services> <behaviors> <serviceBehaviors> <behavior name="InventoryService.Service1Behavior"> <!-- To avoid disclosing metadata information, set the value below to false and remove the metadata endpoint above before deployment --> <serviceMetadata httpGetEnabled="true"/> <!-- To receive exception details in faults for debugging purposes, set the value below to true. Set to false before deployment to avoid disclosing exception information --> <serviceDebug includeExceptionDetailInFaults="true"/> </behavior> </serviceBehaviors> </behaviors> </system.serviceModel> <applicationSettings> <InventoryService.Properties.Settings> <setting name="InventoryService_WSCopy_Copy" serializeAs="String"> <value>http://site/_vti_bin/Copy.asmx</value> </setting> <setting name="InventoryService_SharepointLists_Lists" serializeAs="String"> <value>https://site/_vti_bin/Lists.asmx</value> </setting> </InventoryService.Properties.Settings> </applicationSettings> </configuration> 

If anyone has a key, if I configure this configuration file for NTLM correctly, it will be really useful.

If this is configured correctly, I think I will move on to the next question about whether I will configure the credentials correctly:

 inventoryList = new SharepointLists.Lists(); inventoryList.Url = "https://fullsiteurl/_vti_bin/Lists.asmx"; inventoryList.Credentials = new System.Net.NetworkCredential("user", "pass", "domain"); 

If someone can solve this, it will also be very helpful.

Again, I know that the configuration file is quite long, and I really appreciate if you go through it, let me know if I am setting up NTLM authentication correctly.

If all this is checked in order, then I don’t know where to start when the HTTPS connection with the working environment works (the existing HTTP sharepoint link is still available until I can get the service to work with HTTPS).

Answer 1

Verify that the specified user has access to ASMX with a browser.

Ensure that the user has (at least) permission to read the target library.

In addition, make sure that the user has the Use Remote Interfaces prefix (WSS 3.0: site settings, advanced permissions, settings - permission levels, select the appropriate permission level).

In addition, if you are using MOSS 2007, SOAP access may be disabled in the central admin.

I do not have Sharepoint 2010 at the moment, so I can’t check, but I expect the settings to match.

Edit

If everything works fine with plain HTTP, I would see how HTTPS was enabled.

Take a look at this site, “How to Enable SSL in a SharePoint 2010 Web Application, ” especially the second part (about 1/3 of the page regarding adding an alternate access mapping).

Hope this helps.

Answer 2

You get this error because you did not indicate that mexHttpBinding also uses the binding configuration "NewBinding0". What happens is that before your actual call to the WCF service, the WCF tries to get some information about the service. This request will not succeed if it does not transfer any client credential information to the service because it is protected and you will receive a 401 response from the server (not authorized). Make sure your mexHttpBinding also sends NTLM credentials.

You can also delete the mexHttpBinding file