views:

444

answers:

1

As far as I can tell i'm doing everything by the book, but the .NET client is simply not sending an authentication header when making requests to my (PHP) SOAP Web Service. I have verified this by logging the raw post data at the PHP end of things and .NET never sends any auth headers.

This is the code I am running before making calls on my ExampleWebService Web Service:

ExampleWebService.PreAuthenticate = true;
NetworkCredential myCred = new NetworkCredential("myusername","mypassword");

CredentialCache myCache = new CredentialCache();
myCache.Add(new Uri(ExampleWebService.Url), "Basic", myCred);
ExampleWebService.Credentials = myCache;

As I understand it, PreAuthenticate should force the sending of my HTTP Basic Auth Credentials on every request regardless of challenge. Does this only work with IIS hosted services? I haven't found this documented anywhere.

Any light that someone more experienced than I in the world of .NET could shed on this would be greatly appreciated, as I'm close to pulling my hair out ;-)

+1  A: 

The HttpWebRequest class actually does not send the Authorization header on the first request, even with PreAuthenticate = true. It will though send the Authorization header on subsequent calls to the same realm as long as you use the same CredentialsCache instance. Some recommend adding the headers explictly.

Remus Rusanu
is that a 'feature' or a 'bug'? ;-)
WibblePoop
According to http://tools.ietf.org/html/rfc2617#page-5, is the correct behavior. The client should get a challenge and a *realm* from the server, even for Basic.
Remus Rusanu
The WebService in question does not present a challenge as authentication is optional, so I assume this to be the root cause of the problem. Other SOAP clients obvioiusly aren't following the spec to the letter and brute forcing the credentials on each and every request, hence I've not run into this problem until testing against .NET
WibblePoop
You can modify your proxy client that GetWebRequest adds the Authorization to the request `Headers`.
Remus Rusanu
I'll certainly bear that in mind, but my ultimate goal is to make my PHP WebService as easy as possible to consume using .NET (where simple == working out of the box with the proxy class that Visual Studio generates from the WSDL) so I might have to have a little bit of a re-think on the whole HTTP Authentication scheme
WibblePoop