Error with Windows Authentication and les-services

I have Livelink working with Windows Authentication. I can login to the interface with a domain account. I also have a seperate alias setup to not use Integrated Authentication so that regular users, such as Admin, can login. I have the les-services setup for Integrated Auth. If I use Internet Explorer to access a page such as http://localhost/les-services/ContentService.svc I get challenged for my domain user info, and then the page is displayed to me. I can access the les-services from any machine on the domain and the page displays fine.

I have an application that was working fine when Livelink wasn't using Windows Authentication. I could add, edit and search documents and the like. I have updated the Service References for the application and can see that the security sections for the endpoints have been updated properly. I have followed the recommendations in thread https://knowledge.opentext.com/knowledge/llisapi.dll?func=ll&objId=16593319&objAction=viewincontainer and no longer attempt to get a token from the AuthenticationClient service.

The issue is that I am getting a 401 error. The call from my application to the livelink services are server to server connections, whereas when you directly use Internet Explorer to bring up a .svc file it's client to server. The error that is thrown back is "The HTTP request is unauthorized with client authentication scheme 'Negotiate'. The authentication header received from the server was 'Negotiate,NTLM'". If I look in the IIS log files it does show that it is a 401 error.

Normally in a .NET server to server service communications you can set the credentials to pass the user/pass information properly (objX.Credentials = System.Net.CredentialCache.DefaultCredentials). There is no way to do so with the Livelink services. I'm not sure if this is relevant or not, but I thought it worth mentioning.

Has anyone ran into this before or know how to resolve the issue?

Find more posts tagged with

Comments

sgrasley

Hi, Darko.

Can you set the credentials like this?

objX.ClientCredentials.Windows.ClientCredential.Domain = "DOMAIN";
objX.ClientCredentials.Windows.ClientCredential.UserName = "username";
objX.ClientCredentials.Windows.ClientCredential.Password = "password";

Thanks,

Scott

Darko_Poletto

The DocumentManagementClient object that I have has the ClientCredentials property, but it is read-only. There is no other credential property that I can see for it.

sgrasley

Hi, Darko.

Have you configured the binding(s) in your WCF client to use Windows authentication? Something like this:
                    <security mode="TransportCredentialOnly">
                        <transport clientCredentialType="Windows" proxyCredentialType="None"
                            realm="" />
                        <message clientCredentialType="UserName" algorithmSuite="Default" />
                    </security>

Thanks,

Scott

Darko_Poletto

I misread your question. You can ignore the last reply.

I can set the objDocMan.ClientCredentials.Windows.ClientCredential = System.Net.CredentialCache.DefaultCredentials,but that does not work. I then tried setting the domain, user and pass manually, but I still get the same error.

Darko_Poletto

As was originally mentioned the bindings are set and working when it's a client to server request. I also updated the web.config on my machine and you can see the new settings for the bindings there as well.

Quoted Scott Grasley (sgrasley) on 2010/05/11 13:49:

Hi, Darko.

Thanks,

Scott

Ferdinand Prantl

Are you setting the credentials for the .NET machinery in the SoapHttpClientProtocol which the proxies inherit from?

DocumentManagement service = ...;
service.Credentials = CredentialCache.DefaultCredentials;

--- Ferda

Darko_Poletto

From looking at that code I assume it's C# or something similar. I'm using VB.NET and there is no Credentials property on the object. The closest that I can get is objDocMan.ClientCredentials.Windows.ClientCredential = System.Net.CredentialCache.DefaultCredentials and that still produces an error

Quoted Ferdinand Prantl (ferdipr) on 2010/05/11 13:57:

Are you setting the credentials for the .NET machinery in the SoapHttpClientProtocol which the proxies inherit from?

DocumentManagement service = ...;
service.Credentials = CredentialCache.DefaultCredentials;

--- Ferda

Ferdinand Prantl

Kind'a strange. Whatever the language, the proxies should be the same. This is what the wizard generated in my project under WebReferences\DocumentManagement\Reference.cs:

    /// <remarks/>
    [System.CodeDom.Compiler.GeneratedCodeAttribute("System.Web.Services", "4.0.21006.1")]
    [System.Diagnostics.DebuggerStepThroughAttribute()]
    [System.ComponentModel.DesignerCategoryAttribute("code")]
    [System.Web.Services.WebServiceBindingAttribute(Name="BasicHttpBinding_DocumentManagement", Namespace="urn:DocMan.service.livelink.opentext.com")]
    [System.Xml.Serialization.XmlIncludeAttribute(typeof(ServiceDataObject1))]
    [System.Xml.Serialization.XmlIncludeAttribute(typeof(ServiceDataObject))]
    public partial class DocumentManagement : System.Web.Services.Protocols.SoapHttpClientProtocol {

I think that the Scott's post about the web config should be the right way. It looks like that I did not update the web.config and set the property directly to get it working.

--- Ferda

Darko_Poletto

I don't have a .cs file in my DocMan reference folder. I have the following files:

configuration.svcinfo

DocumentManagement1.xsd

DocumentManagement2.xsd

DocumentManagement.disco

DocumentManagement.wsdl

DocumentManagement.xsd

Reference.svcmap

My application is a Visual Studio 2008 web service.

Quoted Ferdinand Prantl (ferdipr) on 2010/05/11 14:30:

Kind'a strange. Whatever the language, the proxies should be the same. This is what the wizard generated in my project under WebReferences\DocumentManagement\Reference.cs:

I think that the Scott's post about the web config should be the right way. It looks like that I did not update the web.config and set the property directly to get it working.

--- Ferda

Ferdinand Prantl

So is mine (a VS 2008 application). Look here for a VB example: http://support.microsoft.com/kb/813834.

--- Ferda

Darko_Poletto

What they say to do in that link basically what I have done. There is no Credentials property on the DocMan object. The closest thing is .ClientCredentials.Windows.ClientCredential and I have tried setting that to System.Net.CredentialCache.DefaultCredentials, but I still get the same error when doing so.

Quoted Ferdinand Prantl (ferdipr) on 2010/05/11 14:43:

So is mine (a VS 2008 application). Look here for a VB example: http://support.microsoft.com/kb/813834.

--- Ferda

sgrasley

Hi, Darko.

It looks like you're using a Web Reference. Is it possible to use a Service Reference instead?

Thanks,

Scott

Darko_Poletto

I am running a service reference (you actually helped me get up an running with this a few months back when I was trying to add it as a web reference under VS 2005). If you are noticing a difference in the files created I think that is because I am using VB and you are using C#.

When not using Windows Authentication the communication between my app and the les-services is problem free. It is just an issue of the server -> server interaction with Integrated Auth turned on.

Quoted Scott Grasley (sgrasley) on 2010/05/12 09:09:

Hi, Darko.

It looks like you're using a Web Reference. Is it possible to use a Service Reference instead?

Thanks,

Scott

sgrasley

Hi, Darko.

What about using System.Net.CredentialCache.DefaultNetworkCredentials instead of DefaultCredentials?

Also, do you need to set the impersonation level?

objX.ClientCredentials.Windows.AllowedImpersonationLevel = System.Security.Principal.TokenImpersonationLevel.Impersonation;

This post might be helpful: http://social.msdn.microsoft.com/Forums/en/wcf/thread/0aac0110-187e-4a00-a597-f15b768cf16c

Thanks,

Scott

Darko_Poletto

objDocMan.ClientCredentials.Windows.AllowedImpersonationLevel = System.Security.Principal.TokenImpersonationLevel.Impersonation

objDocMan.ClientCredentials.Windows.ClientCredential = System.Net.CredentialCache.DefaultNetworkCredentials

WIth those lines in place I get, "An unknown error occured." If I comment out the AllowedImpersonationLevel line the error reverts to the one about the Negotiation issue.

Quoted Scott Grasley (sgrasley) on 2010/05/12 10:51:

Hi, Darko.

What about using System.Net.CredentialCache.DefaultNetworkCredentials instead of DefaultCredentials?

Also, do you need to set the impersonation level?

objX.ClientCredentials.Windows.AllowedImpersonationLevel = System.Security.Principal.TokenImpersonationLevel.Impersonation;

This post might be helpful: http://social.msdn.microsoft.com/Forums/en/wcf/thread/0aac0110-187e-4a00-a597-f15b768cf16c

Thanks,

Scott