title: WCF service authentication using iisexpress transport security and basic authentication always returning 401
body: <p>I have a WCF service configured to use Transport security and basic authentication.  </p>
  
  <p>The service is hosted in iiexpress withing vs2010.</p>
  
  <p>I am able to connect from my client code but always receive:</p>
  
  <pre><code>"The HTTP request is unauthorized with client authentication scheme 'Anonymous'. The authentication header received from the server was 'Basic realm=realm'."
  </code></pre>
  
  <p>And this has an inner exception of:</p>
  
  <pre><code>"The remote server returned an error: (401) Unauthorized."
  </code></pre>
  
  <p>Similar to <a href="https://stackoverflow.com/questions/1365163/can-not-call-web-service-with-basic-authentication-using-wcf">Can not call web service with basic authentication using WCF</a> although my client code already has the settings set out in the answer.</p>
  
  <p>I also followed <a href="http://www.leastprivilege.com/HTTPBasicAuthenticationAgainstNonWindowsAccountsInIISASPNETPart3AddingWCFSupport.aspx" rel="nofollow noreferrer">HTTP Basic Authentication against Non-Windows Accounts in IIS/ASP.NET (Part 3 - Adding WCF Support)</a> and the previous blog to set up a Module and the IAuthorizationPolicy classes.</p>
  
  <p>IISExpress is configed in classic mode with anonymous and windows authentication disabled and SSL enabled.</p>
  
  <p>Client Config:</p>
  
  <pre><code>&lt;system.serviceModel&gt;
      &lt;bindings&gt;
        &lt;basicHttpBinding&gt;
          &lt;binding name="NotificationHttpBinding"&gt;
            &lt;security mode="Transport"&gt;
              &lt;transport clientCredentialType="Basic" /&gt;
            &lt;/security&gt;
          &lt;/binding&gt;
        &lt;/basicHttpBinding&gt;
      &lt;/bindings&gt;
      &lt;client&gt;
        &lt;endpoint address="https://localhost/NotificationService.svc"
           binding="basicHttpBinding" bindingConfiguration="NotificationHttpBinding"
           contract="NotificationPortType" name="BasicHttpBinding_NotificationPortType" /&gt;
      &lt;/client&gt;
    &lt;/system.serviceModel&gt;
  </code></pre>
  
  <p>Service Config:</p>
  
  <pre><code>&lt;system.serviceModel&gt;
  
      &lt;serviceHostingEnvironment aspNetCompatibilityEnabled="true" multipleSiteBindingsEnabled="true" /&gt;
  
      &lt;services&gt;
        &lt;service name="Notification.NotificationService" behaviorConfiguration="NotificationServiceBehavior"&gt;
          &lt;endpoint binding="basicHttpBinding" contract="NotificationPortType" bindingConfiguration="NotificationHttpBinding" &gt;
          &lt;/endpoint&gt;
         &lt;/service&gt;
      &lt;/services&gt;
  
      &lt;behaviors&gt;
        &lt;serviceBehaviors&gt;
          &lt;behavior name="NotificationServiceBehavior"&gt;
            &lt;serviceMetadata /&gt;
            &lt;serviceDebug includeExceptionDetailInFaults="false"/&gt;
            &lt;serviceAuthorization&gt;
              &lt;authorizationPolicies&gt;
                &lt;add policyType="Notification.HttpContextIdentityPolicy, Notification" /&gt;
              &lt;/authorizationPolicies&gt;
            &lt;/serviceAuthorization&gt;
          &lt;/behavior&gt;
        &lt;/serviceBehaviors&gt;
      &lt;/behaviors&gt;
  
      &lt;bindings&gt;
        &lt;basicHttpBinding&gt;
          &lt;binding name="NotificationHttpBinding"&gt;
            &lt;security mode="Transport"&gt;
              &lt;transport clientCredentialType="Basic" /&gt;
            &lt;/security&gt;
  
          &lt;/binding&gt;
        &lt;/basicHttpBinding&gt;
      &lt;/bindings&gt;
  
    &lt;/system.serviceModel&gt;
  
  
    &lt;system.webServer&gt;
      &lt;modules runAllManagedModulesForAllRequests="true"/&gt;
    &lt;/system.webServer&gt;
  
    &lt;system.web&gt;
  
      &lt;httpModules&gt;
        &lt;add name="CustomBasicAuthentication" type="Notification.CustomBasicAuthenticationModule, Notification"/&gt;
      &lt;/httpModules&gt;
  
      &lt;membership defaultProvider="SampleProvider"&gt;
        &lt;providers&gt;
          &lt;add name="SampleProvider"  type="Notification.HardcodedSecurityProviders, Notification" /&gt;
        &lt;/providers&gt;
      &lt;/membership&gt;
  
    &lt;/system.web&gt;
  </code></pre>
  
  <p>Client Code is nothing major:</p>
  
  <pre><code>static void Main(string[] args)
          {
              ServicePointManager.ServerCertificateValidationCallback = (sender, certificate, chain, sslPolicyErrors) =&gt; { return true; };
  
              NotificationPortTypeClient client = new NotificationPortTypeClient("BasicHttpBinding_NotificationPortType");
  
              client.ClientCredentials.UserName.UserName = "Test";
              client.ClientCredentials.UserName.Password = "PWD";
  
  
              client.sendNotification(new NotificationRequest());
          }
  </code></pre>
  
  <p><strong>Alternatively</strong>
  If someone can show me an alternative of how to use IIS6 to host a service WCF which using basic http authentication while requiring SSL (https) I'll be happy with that!</p>
  
  <hr>
  
  <p><strong>UPDATE</strong>
  Seems this was my culprit all along:
  <a href="http://plainoldstan.blogspot.com/2008/07/avoid-http-401-roundtrip-with-adding.html" rel="nofollow noreferrer">Avoid http 401 round trip</a></p>
  
  <p>However, I found that my modules fired fine (in integrated mode) but I was then presented with a service error telling me that basic integration is required but not enabled on the host.  </p>
  
  <p>Opened up iisexpress applicationhost.config file and sure enough I found:</p>
  
  <pre><code>&lt;section name="basicAuthentication" overrideModeDefault="Deny" /&gt;
  </code></pre>
  
  <p>followed by</p>
  
  <pre><code>&lt;basicAuthentication enabled="false" /&gt;
  </code></pre>
  
  <p>further down</p>
  
  <p>I've changed these to <code>&lt;section name="basicAuthentication" overrideModeDefault="Allow" /&gt;</code></p>
  
  <p>and tried to enable in my web.config...no dice :(</p>