SharePoint User Group UK

Hello all,

I have a Sharepoint workflow running on a document library.
The workflow does lots of different things but I am haveing an issue with the following:

Endpoint that points to a built in Sharepoint webservice (Lists.asmx):
<endpoint address="http://teleportvm/docs/_vti_bin/lists.asmx" binding="basicHttpBinding" bindingConfiguration="GetDocumentsBinding" contract="GetClarityDocumentsServiceRef.ListsSoap" name="GetDocumentsEndPoint" />

        <binding name="GetDocumentsBinding" closeTimeout="00:01:00" openTimeout="00:01:00" receiveTimeout="00:10:00" sendTimeout="00:01:00" allowCookies="false" bypassProxyOnLocal="false" hostNameComparisonMode="StrongWildcard" maxBufferSize="65536" maxBufferPoolSize="524288" maxReceivedMessageSize="65536" messageEncoding="Text" textEncoding="utf-8" transferMode="Buffered" useDefaultWebProxy="true">
          <readerQuotas maxDepth="32" maxStringContentLength="8192" maxArrayLength="16384" maxBytesPerRead="4096" maxNameTableCharCount="16384" />
          <security mode="TransportCredentialOnly">
            <transport clientCredentialType="Ntlm" proxyCredentialType="None" />
            <!--<message clientCredentialType="UserName" algorithmSuite="Default" />-->
          </security>
        </binding>
      </basicHttpBinding>

Here is the code that instantiates and calls my WCF service:
GetClarityDocumentsServiceRef.ListsSoapClient listService = new Telereal.PFA.Attachments.Grabber.GetClarityDocumentsServiceRef.ListsSoapClient();
                   
listService.ClientCredentials.Windows.AllowedImpersonationLevel = System.Security.Principal.TokenImpersonationLevel.Impersonation;

listService.ClientCredentials.UserName.UserName = @"domain\username";
listService.ClientCredentials.UserName.Password = "password";

System.Xml.XmlNode nodeListItems = listService.GetListItems(listName, null, query, viewFields, rowLimit, queryOptions, null);

But no matter what I do I get the following error:
System.ServiceModel.Security.MessageSecurityException: The HTTP request is unauthorized with client authentication scheme 'Ntlm'. The authentication header received from the server was 'NTLM'

As you can see the service is expecting NTLM but the client is sending ntlm.
There is one blog that I can find that tells you how to fix this weird error:
http://blogs.msdn.com/ashishme/archive/2006/11/10/ntlm-vs-kerberos-windows-communication-foundation.aspx

look for the paragraph:
"But now when you run the Web Application again you will encounter the following error - Client authentication header was passed as Ntlm where as the Server authentication header received is NTLM. By looking it seem that client is passing Ntlm and server is expecting NTLM (note the case), but the real reason for this is that NTLM identity is not passed across virtual folders / remote processes when NTLM authentication is used, thus it fails."

The guy tells you what the issues are and how to fix them but I have tried them all and nothing works.

The Sharepoint server is set to NTLM and I have confirmed this using cscript as mentioned in the above mentioned post.

Has anyone had this issue before and if so how did you get around it?

thanks
RuSs

---

Regards
Russell McCloy
http://russellmccloy.blogspot.com/

I had exactly the same problem and it turned out to be because the application that was calling the sharepoint services was hosted in IIS 5.1. as soon as i moved the application to a server with IIS 6.0 the problem disappeared. Even more it seems that IIS 5.1 send in the header "Ntlm" for NTLM authentication, sends "Negotiate" for Kerberos and IIS 6.0 expects "Negotiate, NTLM" for Kerberos.

Hi Royce,

    Were you able to solve this issue? I too am getting the same issue, and it is killing me for the past 1 week. Kindly share the solution, if you were able to get one.

Thanks,

Sello