title: 401 Client 'Negotiate', Server 'Negotiate,NTLM' When Calling WCF Server to Server
body: <p>Ok, I've read every thread &amp; question I can find with this error and surprisingly have not found a solution. I'm trying to require Windows authentication on my IIS hosted WCF service (.NET 4.0) which, until now, has been optional. I have had a Windows authentication enabled endpoint available on the server for a while with several remote applications successfully using it. I'm now trying to switch our web applications and other server apps that use the WCF service over to this secured endpoint by giving them the exact same client configuration as the working remote clients, but the server apps are receiving a 401 with the message:</p>
  
  <p><code>The HTTP request is unauthorized with client authentication scheme 'Negotiate'. The authentication header received from the server was 'Negotiate,NTLM'.]</code></p>
  
  <p>I have Anonymous and Windows authentication enabled for the WCF hosting site. The web application I've started with is hosted on a different server than the WCF service and is running on ASP.NET 2.0 and Windows Server 2008 R2 Enterprise. I have both created a client behavior with allowNtlm and set the NetworkSecurity: LAN Manager authentication level to Send LM &amp; NTLM... on the client end. On the hosting end, it is set to Send NTLMv2 Response Only...I don't know if that affects how the server/service handles authentication. I've also tried setting allowedImpersonationLevel to Impersonation on the client which, thankfully, didn't work (because impersonation shouldn't be necessary). We seem to get the same result for a Windows service and console app running on the same server as the web app.</p>
  
  <p>Here is my server config:</p>
  
  <pre><code>&lt;binding name="WindowsSecuredBinding"&gt;
      &lt;security mode="Transport"&gt;
          &lt;transport clientCredentialType="Windows" /&gt;
      &lt;/security&gt;
  &lt;/binding&gt;
  ...
  &lt;service behaviorConfiguration="OMWebServices.QueueServiceBehavior"
      name="OMWebServices.QueueService"&gt;
      &lt;endpoint address="" binding="basicHttpBinding" name="QueueEndpoint"
        bindingName="" contract="OMWebServices.IQueueService" /&gt;
      &lt;endpoint binding="basicHttpBinding" bindingConfiguration="WindowsSecuredBinding"
        name="QueueSecuredEndpoint" contract="OMWebServices.IQueueService" /&gt;
      &lt;endpoint address="mex" binding="mexHttpBinding" name="QueueMetadataEndpoint"
        contract="IMetadataExchange" /&gt;
    &lt;/service&gt;
  ...
  &lt;behavior name="OMWebServices.QueueServiceBehavior"&gt;
      &lt;serviceMetadata httpGetEnabled="true" /&gt;
      &lt;serviceDebug includeExceptionDetailInFaults="true" /&gt;
  &lt;/behavior&gt;
  </code></pre>
  
  <p>And here is the client config:</p>
  
  <pre><code>&lt;endpoint address="https://.../QueueService.svc" binding="basicHttpBinding" bindingConfiguration="QueueSecuredEndpoint" behaviorConfiguration="OMServiceBehavior" contract="OMQueueService.IQueueService" name="QueueSecuredEndpoint" /&gt;
  
  &lt;binding name="QueueSecuredEndpoint" closeTimeout="00:01:00" openTimeout="00:01:00" receiveTimeout="00:10:00" sendTimeout="00:01:00" allowCookies="false" bypassProxyOnLocal="false" hostNameComparisonMode="StrongWildcard" maxBufferSize="65536" maxBufferPoolSize="524288" maxReceivedMessageSize="65536" messageEncoding="Text" textEncoding="utf-8" transferMode="Buffered" useDefaultWebProxy="true"&gt;
    &lt;readerQuotas maxDepth="32" maxStringContentLength="8192" maxArrayLength="16384" maxBytesPerRead="4096" maxNameTableCharCount="16384" /&gt;
    &lt;security mode="Transport"&gt;
      &lt;transport clientCredentialType="Windows" proxyCredentialType="None" realm="" /&gt;
      &lt;message clientCredentialType="UserName" algorithmSuite="Default" /&gt;
    &lt;/security&gt;
  &lt;/binding&gt;
  ....
  &lt;!-- The behavior I tried that didn't make a difference --&gt;
  &lt;behavior name="OMServiceBehavior"&gt;
    &lt;clientCredentials&gt;
      &lt;windows allowedImpersonationLevel="Impersonation" allowNtlm="True"/&gt;
    &lt;/clientCredentials&gt;
  &lt;/behavior&gt;
  </code></pre>
  
  <p>My first question is, what is this error message really telling me? It says the client scheme is Negotiate and the server's responding with Negotiate,NTLM. If the server offers Negotiate and and client is using Negotiate, what's the problem?</p>
  
  <p>Second question is, obviously, what's wrong and how do I make it work?</p>
  
  <p><strong>EDIT</strong><br>
  Well this is stupid. The problem seems to be there are no credentials being passed. Way back when the web site was in development, I started writing code to explicitly set the credentials in code, but in the process, <a href="https://stackoverflow.com/questions/12712704/how-does-wcf-windows-authentication-work-without-explicitly-setting-credentials">found that it was already working without explicitly setting them</a>. So that code has remained commented out. This was running on IIS 6. Now running on IIS 7, it seems to only work if I explicitly set the credentials in my code. Can I get it automatically using the w3wp process' account?</p>