WebServiceHost not working after disabling anonymous authentication in IIS - asp.net

Question

I have an rest wcf service integrated with asp.net and deployed in IIS. This is working fine when anonymous authentication is enabled. When it's disabled it's throwing 401 error when i use the rest api call in postman. In IIS anonymous authentication and Forms authentication are enabled. Now i disabled Anonymous and Forms and enabled windows authentication only.
My code is below:
public class SampleWebServiceHostFactory : WebServiceHostFactory
{
private Type ContractServiceType;
private static readonly log4net.ILog log = log4net.LogManager.GetLogger(System.Reflection.MethodBase.GetCurrentMethod().DeclaringType);
public SampleWebServiceHostFactory(Type contractServiceType):base()
{
ContractServiceType = contractServiceType;
}
protected override ServiceHost CreateServiceHost(Type serviceType, Uri[] baseAddresses)
{
WebServiceHost host = (WebServiceHost)base.CreateServiceHost(serviceType,baseAddresses);
ServicePointManager.SecurityProtocol = SecurityProtocolType.Tls12;
WebHttpBinding mybinding = new WebHttpBinding(WebHttpSecurityMode.Transport);
mybinding.Security.Transport.ClientCredentialType = HttpClientCredentialType.Windows;
mybinding.MaxReceivedMessageSize = 2147483647;
mybinding.TransferMode = TransferMode.StreamedRequest;
mybinding.ReaderQuotas.MaxDepth = 1204;
mybinding.ReaderQuotas.MaxStringContentLength = 2147483647;
mybinding.ReaderQuotas.MaxArrayLength = 2147483647;
mybinding.ReaderQuotas.MaxBytesPerRead = 2147483647;
mybinding.ReaderQuotas.MaxNameTableCharCount = 2147483647;
mybinding.SendTimeout = new TimeSpan(4,0,0);
mybinding.ReceiveTimeout = new TimeSpan(4,0,0);
host.AddServiceEndpoint(ContractServiceType, mybinding, "");
host.Description.Behaviors.Add(new RestServiceBehavior());
log.Info("Testing1");
return host;
}
}
the below code in config file
<system.serviceModel>
<client/>
<serviceHostingEnvironment aspNetCompatibilityEnabled="true" multipleSiteBindingsEnabled="true"/>
<behaviors>
<serviceBehaviors>
<behavior>
<serviceMetadata httpGetEnabled="false" httpsGetEnabled="false"/>
<serviceDebug httpHelpPageEnabled="false" httpsHelpPageEnabled="false" includeExceptionDetailInFaults="true"/>
</behavior>
</serviceBehaviors>
</behaviors>
<bindings>
<webHttpBinding>
<binding receiveTimeout="00:10:00" sendTimeout="00:10:00" maxReceivedMessageSize="2147483647">
<readerQuotas maxDepth="64" maxStringContentLength="2147483647" maxArrayLength="2147483647" maxBytesPerRead="2147483647" maxNameTableCharCount="2147483647"/>
</binding>
</webHttpBinding>
</bindings>
</system.serviceModel>
I have enabled logging in Global.asax to see where issue occurs. After the Session_Start method fired i see the log line "Testing1" in the above code. After that no logging and it threw 401 error in postman and keep on asking for username and password when i use the url in in browser.

Answer 1

Now that we have already set up the configuration in the constructor of the WebServiceHostFactory, It is unnecessary to configure it in the configuration file separately.
<webHttpBinding>
<binding receiveTimeout="00:10:00" sendTimeout="00:10:00" maxReceivedMessageSize="2147483647">
<readerQuotas maxDepth="64" maxStringContentLength="2147483647" maxArrayLength="2147483647" maxBytesPerRead="2147483647" maxNameTableCharCount="2147483647"/>
</binding>
</webHttpBinding>
I suggest you refer to the below configuration for Windows Authentication.
<system.serviceModel>
<services>
<service name="WcfService3.Service1">
<endpoint address="" behaviorConfiguration="rest" contract="WcfService3.IService1" binding="webHttpBinding" bindingConfiguration="https"></endpoint>
</service>
</services>
<behaviors>
<serviceBehaviors>
<behavior>
<serviceMetadata httpGetEnabled="true" httpsGetEnabled="true" />
<serviceDebug includeExceptionDetailInFaults="true"/>
</behavior>
</serviceBehaviors>
<endpointBehaviors>
<behavior name="rest">
<webHttp helpEnabled="true"/>
</behavior>
</endpointBehaviors>
</behaviors>
<bindings>
<webHttpBinding>
<binding name="https">
<security mode="Transport">
<transport clientCredentialType="Windows">
</transport>
</security>
</binding>
</webHttpBinding>
</bindings>
</system.serviceModel>
After that, disable other authentication modes in IIS. We need to provide a pair of windows credentials while calling the service.
The credential is actually the windows account on the server-side, which enables us to access the website.
Feel free to let me know if the problem still exists.