title: C# Problem authenticating webservice between two webapplications
body: <p>I'm working on a webapplication which runs central at a company. This webapplication needs to make a call to a service which is part of a second webapplication.</p>
  
  <p>In the central webapplication i have this piece of code;</p>
  
  <pre><code>var clientUri = "http://website.localhost/Services/Info.svc/account";
  var uri = new Uri(clientUri);
  var networkCredentials = new NetworkCredential(_configuration.ServiceUserName, _configuration.ServicePassword);
  var httpClient = new HttpClient();
  
  httpClient.DefaultHeaders.Authorization = Credential.CreateBasic(_configuration.ServiceUserName,                                                                                   _configuration.ServicePassword);
  httpClient.TransportSettings.PreAuthenticate = true;
  
  HttpResponseMessage respone = httpClient.Get(uri);
  HttpContent content = respone.Content;
  </code></pre>
  
  <p>In the webservice in the other application, which is (Info.svc), i have the following code in the Constructor of the service.</p>
  
  <pre><code>var validator = new UserNamePasswordValidator();
  var cred = System.Net.CredentialCache.DefaultCredentials; //this one is empty, maybe a solution?
  validator.Validate("Username", "Password");
  
  if (!HttpContext.Current.User.Identity.IsAuthenticated)
  {
  //This throws a 401 unauthorize, which is shown as a 500 error in the central application
  throw new WebProtocolException(HttpStatusCode.Unauthorized, "You must be authorized to perform this action.", null);
  }
  else
  {
  _userIsAbleToUseService = true;
  }
  </code></pre>
  
  <p>Instead of Username and Password in the validate function i want to use the Network Credentials sent over from the other webservice, can this be achieved? And how? Any other suggestions are welcome! I can harcode the password now in the validate function, but this isn't what i want.</p>
  
  <p>--UPDATE--
  This is the configuration in the web.config for the central application</p>
  
  <pre><code>&lt;authorization&gt;
              &lt;allow roles="administrators"/&gt;
              &lt;deny roles="datareaders"/&gt;
              &lt;deny users="?"/&gt;
          &lt;/authorization&gt;
  
  &lt;authentication mode="Forms"&gt;
              &lt;forms loginUrl="~/Logon/Logon" timeout="2880"/&gt;
          &lt;/authentication&gt;
          &lt;membership&gt;
              &lt;providers&gt;
                  &lt;clear/&gt;
                  &lt;add name="AspNetSqlMembershipProvider" type="System.Web.Security.SqlMembershipProvider, System.Web, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" connectionStringName="ApplicationServices" enablePasswordRetrieval="false" enablePasswordReset="true" requiresQuestionAndAnswer="false" requiresUniqueEmail="false" passwordFormat="Hashed" maxInvalidPasswordAttempts="5" minRequiredPasswordLength="6" minRequiredNonalphanumericCharacters="0" passwordAttemptWindow="10" passwordStrengthRegularExpression="" applicationName="CentralApplication"/&gt;
              &lt;/providers&gt;
          &lt;/membership&gt;
  </code></pre>
  
  <p>
              
                  
                  
                  
              
          </p>
  
  <p>This part is for the web.config in the second webapplication</p>
  
  <pre><code>&lt;authentication mode="Forms"&gt;
        &lt;forms name="AllPages" loginUrl="~/Logon/" timeout="360" enableCrossAppRedirects="false" /&gt;
      &lt;/authentication&gt;
      &lt;authorization&gt;
        &lt;!-- NOTE: See Web.config under Private folder for specifics on secure pages. --&gt;
        &lt;deny users="?" /&gt;
      &lt;/authorization&gt;
  
  &lt;membership defaultProvider="NHMembershipProvider"&gt;
        &lt;providers&gt;
          &lt;clear /&gt;
          &lt;add name="NHMembershipProvider" applicationName="Website" type="Website.Security.Authentication.Membership.CmsMembershipProvider" description="Stores and retrieves membership data from SQL server using Nhibernate" connectionStringName="NHibernate" enablePasswordRetrieval="true" enablePasswordReset="true" requiresQuestionAndAnswer="false" requiresUniqueEmail="true" passwordFormat="Hashed" maxInvalidPasswordAttempts="5" minRequiredPasswordLength="6" minRequiredNonalphanumericCharacters="0" passwordAttemptWindow="10" passwordStrengthRegularExpression="" /&gt;
        &lt;/providers&gt;
      &lt;/membership&gt;
      &lt;roleManager enabled="true" defaultProvider="NHRoleProvider"&gt;
        &lt;providers&gt;
          &lt;clear /&gt;
          &lt;add name="NHRoleProvider" applicationName="Website" type="Website.Security.Authentication.Membership.CmsRoleProvider" /&gt;
        &lt;/providers&gt;
      &lt;/roleManager&gt;
  </code></pre>
  
  <p>Already being logged to the central application using the membership provider i'm trying to call the webservice from there using a simple hyperlink (just for now). The webservice called in the central admin gathers some data and sends this over to the url for the webservice of the second application. Both application are webapplications (containing webservices) so that is why the authentication mode is set to Forms.</p>