The HTTP request is unauthorized with client authentication scheme Negotiate The authentication header received from the server was NTLM

Question

Few days ago I had quite a headache with authentication problems when using Windows authentication between client and wcf web service  The error I was getting was  The HTTP request is unauthorized with client authentication scheme  Negotiate   The authentication header received from the server was  NTLM   None of the solutions on stack worked because most of them were related to old methods

User · Answer

The solution for me was to set the AppPool from using the AppPoolIdentity to the NetworkService identity

User · Answer

I have upgraded my older version of WCF to WCF 4 with below changes  hope you can also make the similar changes   1  Web config    lt system serviceModel gt         lt bindings gt           lt basicHttpBinding gt             lt binding name  Demo BasicHttp  gt               lt security mode  TransportCredentialOnly  gt                 lt transport clientCredentialType  InheritedFromHost   gt               lt  security gt             lt  binding gt           lt  basicHttpBinding gt         lt  bindings gt         lt services gt           lt service name  DemoServices CalculatorService ServiceImplementation CalculatorService  behaviorConfiguration  Demo ServiceBehavior  gt             lt endpoint address    binding  basicHttpBinding                bindingConfiguration  Demo BasicHttp  contract  DemoServices CalculatorService ServiceContracts ICalculatorServiceContract  gt               lt identity gt                 lt dns value  localhost   gt               lt  identity gt             lt  endpoint gt             lt endpoint address  mex  binding  mexHttpBinding  contract  IMetadataExchange    gt           lt  service gt         lt  services gt         lt behaviors gt           lt serviceBehaviors gt             lt behavior name  Demo ServiceBehavior  gt               lt  -- To avoid disclosing metadata information  set the values below to false before deployment -- gt               lt serviceMetadata httpGetEnabled  true  httpsGetEnabled  true   gt               lt  -- To receive exception details in faults for debugging purposes  set the value below to true   Set to false before deployment to avoid disclosing exception information -- gt               lt serviceDebug includeExceptionDetailInFaults  false   gt             lt  behavior gt           lt  serviceBehaviors gt         lt  behaviors gt         lt protocolMapping gt           lt add scheme  http  binding  basicHttpBinding  bindingConfiguration  Demo BasicHttp   gt         lt  protocolMapping gt         lt serviceHostingEnvironment aspNetCompatibilityEnabled  true  multipleSiteBindingsEnabled  true    gt       lt  system serviceModel gt    2  App config        lt system serviceModel gt       lt bindings gt         lt basicHttpBinding gt           lt binding name  BasicHttpBinding ICalculatorServiceContract  maxBufferSize  2147483647  maxBufferPoolSize  33554432  maxReceivedMessageSize  2147483647  closeTimeout  00 10 00  sendTimeout  00 10 00  receiveTimeout  00 10 00  gt             lt readerQuotas maxArrayLength  2147483647  maxBytesPerRead  4096    gt             lt security mode  TransportCredentialOnly  gt               lt transport clientCredentialType  Ntlm  proxyCredentialType  None  realm      gt             lt  security gt           lt  binding gt         lt  basicHttpBinding gt       lt  bindings gt       lt client gt         lt endpoint address  http   localhost 24357 CalculatorService svc  binding  basicHttpBinding  bindingConfiguration  BasicHttpBinding ICalculatorServiceContract  contract  ICalculatorServiceContract  name  Demo BasicHttp    gt       lt  client gt     lt  system serviceModel gt

User · Answer

For me the solution was besides using  Ntlm  as credential type       XxxSoapClient xxxClient   new XxxSoapClient        ApplyCredentials userName  password  xxxClient ClientCredentials        private static void ApplyCredentials string userName  string password  ClientCredentials clientCredentials                clientCredentials UserName UserName   userName          clientCredentials UserName Password   password          clientCredentials Windows ClientCredential UserName   userName          clientCredentials Windows ClientCredential Password   password          clientCredentials Windows AllowNtlm   true          clientCredentials Windows AllowedImpersonationLevel   System Security Principal TokenImpersonationLevel Impersonation

User · Answer

THE ANSWER  The problem was all of the posts for such an issue were related to older kerberos and IIS issues where proxy credentials or AllowNTLM properties were helping  My case was different  What I have discovered after hours of picking worms from the ground was that somewhat IIS installation did not include Negotiate provider under IIS Windows authentication providers list  So I had to add it and move up  My WCF service started to authenticate as expected  Here is the screenshot how it should look if you are using Windows authentication with Anonymous auth OFF   You need to right click on Windows authentication and choose providers menu item     Hope this helps to save some time

User · Answer

I had the same problem  to solve it set specific user from domain in iis -  action sidebar- Basic Settings -  Connect as    -  specific user

User · Answer

Not this exact problem  but this is the top result when googling for almost the exact same error    If you see this problem calling a WCF Service hosted on the same machine  you may need to populate the BackConnectionHostNames registry key    In regedit  locate and then click the following registry subkey  HKEY LOCAL MACHINE SYSTEM CurrentControlSet Control Lsa MSV1 0 Right-click MSV1 0  point to New  and then click Multi-String Value  In the Name column  type BackConnectionHostNames  and then press ENTER  Right-click BackConnectionHostNames  and then click Modify  In the Value data box  type the CNAME or the DNS alias  that is used for the local shares on the computer  and then click OK     Type each host name on a separate line     See Calling WCF service hosted in IIS on the same machine as client throws authentication error for details

[c#] The HTTP request is unauthorized with client authentication scheme 'Negotiate'. The authentication header received from the server was 'NTLM'

Examples related to c#

Examples related to windows

Examples related to wcf

Examples related to authentication