Error while log in with ECL.NET

When I try to log in with the ECL.NET I get this error:

The HTTP request is unauthorized with client authentication scheme 'Anonymous'. The authentication header received from the server was 'Negotiate,NTLM'.

How can I solve this?

Thanks in advance...

Find more posts tagged with

BPM

Comments

Iain_Lindsay

You need to make sure your client security configuration matches what the ECL.WS is expecting

So you can either apply the following change in the security section of your basicHttpBinding in the ECL.WS web.config file:

<security mode="None">
    <transport clientCredentialType="None" proxyCredentialType="None"></transport>
    <message clientCredentialType="UserName" algorithmSuite="Default"></message>
</security>

Or you can update the security section of basicHttpBinding in your client config file (app.config/web.config) as follows:

<security mode="TransportCredentialOnly">
        <transport clientCredentialType="Windows"></transport>
        <message clientCredentialType="UserName" algorithmSuite="Default"></message>
</security>

The former configuration is fine for forms authentication however I believe you will need to use the latter if you want to authenticate using Single Sign On.

iain

Sven Lorenz

Thanks for the quick reply...

I checked that already. Here is my app.config:

<system.serviceModel>
    <bindings>
      <basicHttpBinding>
        <binding name="MetastormECL" closeTimeout="00:01:00"
          openTimeout="00:01:00" receiveTimeout="00:10:00" sendTimeout="00:01:00"
          allowCookies="false" bypassProxyOnLocal="false" hostNameComparisonMode="StrongWildcard"
          maxBufferSize="65536" maxBufferPoolSize="524288" maxReceivedMessageSize="65536"
          messageEncoding="Text" textEncoding="utf-8" transferMode="Buffered"
          useDefaultWebProxy="true">
          <readerQuotas maxDepth="32" maxStringContentLength="16384" maxArrayLength="16384"
            maxBytesPerRead="4096" maxNameTableCharCount="16384" />
          <security mode="TransportCredentialOnly">
            <transport clientCredentialType="None" proxyCredentialType="None"
              realm=""/>
            <message  clientCredentialType="UserName" algorithmSuite="Default" />
          </security>
        </binding>
      </basicHttpBinding>
    </bindings>
    <client>
      <endpoint address="<a data-ignore="a/b" target="_blank" href="http://192.168.97.43/ECL.WS/Service.svc">http://192.168.97.43/ECL.WS/Service.svc</a>"
        binding="basicHttpBinding" bindingConfiguration="MetastormECL"
        contract="Service" name="MetastormECL" />
    </client>
  </system.serviceModel>

It is the one from the ECL samples. I only changed the endpoint adress.

this one also doesn't work:

<transport clientCredentialType="Windows" proxyCredentialType="None">

Iain_Lindsay

What happens if you change the transport section's clientCredentialType property from "None" to "Windows"?

iain

Sven Lorenz

It's the same result.

Iain_Lindsay

This is how I have my dev environment set up (Windows Server 2008 R2).

In IIS:

- ECL.WS web application is configured to use Anonymous Authentication, ASP.Net Impersonation and Windows Authentication (providers for Windows Authentication are Negotiate and NTLM)

- BPMEngine.NET is configured to use Windows Authentication (providers for Windows Authentication are Negotiate and NTLM)

- MetastormECLWSAppPool application pool is configured to run under my trusted account

- MetastormEngineDotNetAppPool application pool is configured to run under my trusted account

In the ECL.WS web.config I have the following defined for basichttpBinding

<basicHttpBinding>
            <binding name="basicHttpBinding_Service" closeTimeout="00:01:00" openTimeout="00:01:00" receiveTimeout="00:10:00" sendTimeout="00:01:00" allowCookies="false" bypassProxyOnLocal="false" hostNameComparisonMode="StrongWildcard" maxBufferSize="41943040" maxBufferPoolSize="524288" maxReceivedMessageSize="41943040" messageEncoding="Text" textEncoding="utf-8" transferMode="Buffered">
                <readerQuotas maxDepth="32" maxStringContentLength="41943040" maxArrayLength="41943040" maxBytesPerRead="4096" maxNameTableCharCount="16384"></readerQuotas>
                <security mode="TransportCredentialOnly">
                    <transport clientCredentialType="Windows" />
                    <message clientCredentialType="UserName" algorithmSuite="Default"></message>
                </security>
            </binding>
        </basicHttpBinding>

I have also uncommented the following line:

<serviceAuthorization impersonateCallerForAllOperations="true" />

In my client application I have the following configured in my app.config:

<system.serviceModel>
  <behaviors>
    <endpointBehaviors>
      <behavior name="SsoBehavior">
        <clientCredentials>
          <windows allowedImpersonationLevel="Impersonation" />
        </clientCredentials>
      </behavior>
    </endpointBehaviors>
  </behaviors>
  <bindings>
    <basicHttpBinding>
      <binding name="MetastormECL" closeTimeout="00:01:00" openTimeout="00:01:00" receiveTimeout="00:10:00" sendTimeout="00:01:00"
        allowCookies="false" bypassProxyOnLocal="false" hostNameComparisonMode="StrongWildcard" maxBufferSize="41943040" maxBufferPoolSize="524288" maxReceivedMessageSize="41943040"
        messageEncoding="Text" textEncoding="utf-8" transferMode="Buffered" useDefaultWebProxy="true">
        <readerQuotas maxDepth="32" maxStringContentLength="41943040" maxArrayLength="41943040" maxBytesPerRead="4096" maxNameTableCharCount="16384" />
        <security mode="TransportCredentialOnly">
          <transport clientCredentialType="Windows" proxyCredentialType="None"
            realm=""/>
          <message clientCredentialType="UserName" algorithmSuite="Default" />
        </security>
      </binding>
    </basicHttpBinding>
  </bindings>
  <client>
    <endpoint address="http://localhost/ECL.WS/Service.svc" behaviorConfiguration="SsoBehavior"
      binding="basicHttpBinding" bindingConfiguration="MetastormECL"
      contract="Service" name="MetastormECL" />
  </client>
</system.serviceModel>

The above configuration works for me using ECL.WS directly or going via ECL.NET with both basic login and Single Sign On.

Cheers

iain