NetworkCredentials and Authorization in WebApi

Question

I am having a few problems trying to connect to a ASP.NET webapi service (which I am running myself) from a sample console app using WebClient. The webapi is the typical sample site from MVC4:

public HttpResponseMessage Get()
{
    return Request.CreateResponse(HttpStatusCode.OK, new string[] { "value1", "value2" });
}

The Controller is decorated with a custom Authenticate attribute:

public override void OnAuthorization(System.Web.Http.Controllers.HttpActionContext actionContext)
{
    if (actionContext.Request.Headers.Authorization == null)
    {
        var response = new HttpResponseMessage(HttpStatusCode.Unauthorized);
        response.Headers.Add("WWW-Authenticate", "Basic realm=\"localhost\"");
        actionContext.Response = response;
        return;
    }
}

The client code is the usual:

 var wb = WebRequest.Create("http://localhost:64921/Values");
 wb.Credentials = new NetworkCredential("xxx", "xxx");

 var aaa = wb.GetResponse();
 Console.WriteLine(aaa);
 Console.ReadLine();

Now, I know that the WebClient or WebRequest are supposed to wait for a 401 before sending credentials and that is exactly what I am trying to do here.

Needless to say with the setup above nothing works. I have gone into the IIS express config and changed the following:

<basicAuthentication enabled="true" /> (in the security section)
<add name="BasicAuthenticationModule" lockItem="false" /> (in the modules section)

The problem that I am having is that the 401 gets returned even before the server code is actualy hit. I mean that if I stick a breakpoint into the Controller or the Attribute they are not hit. The details of the error are the usual long text about error 401.2 which I reckon is something to do with IIS configs, but using IIS express and not the nice IIS I do not have a nice GUI to fix this. Can anyone help?

Thanks a lot!

Answer 1

In the IIS config, you have enabled Basic auth processing, so IIS returns the 401 if there are no credentials or the credentials are invalid.

If you want your code to do the basic auth processing, then you need to tell IIS to allow anonymous access.

EDIT from comments

If you ask IIS to do basic auth it will check credentials against Windows accounts. This will act before the server code runs, so the Custom Auth Filter will not be hit. In this case the headers returned will be correct and you will see the WebClient performing the double request (one anonymous, one with credentials). If the WebClient does not use a computer or domain account (with read permissions on the folder where the site is located), the request will fail.

If you want to do authentication/authorization yourself, you need to tell IIS express not to do any auth and then do it all yourself... this basically means leaving everything as it is in the config (in your case reverting the pieces of config shown in the question) and sending the correct headers, which you already do. If you debug, you will see the Authenticate filter being hit twice, the first time it will be an anonymous that will go inside the if and generate your HTTP 401 Challenge response, the second time it will have credentials in the form of a standard Basic Authorization header: Basic <BASE64_ENCODED_CREDENTIALS>