Public WCF service requires authentication, despite no security being specified

Question

I have published a WCF service (MyService.svc) on an ASP.NET site, in a sub-folder called WebServices.

When running on the local ASP.NET web server it works fine. When published to an IIS-run site and I try to access, for example, /WebServices/MyService.svc/jsdebug, I get 401 Unauthorized. The rest of the site works fine.

Does anyone have any idea why?

---

Here are the contents of MyService.svc:

<%@ServiceHost 
    Language="C#"
    Debug="true" 
    Service="MyApp.Core.MyService, MyApp.Core"
    Factory="System.ServiceModel.Activation.WebScriptServiceHostFactory"
%>

MyApp.Core.MyService is a class implementing IMyService (which has the attribute ServiceContract and method declarations with the attribute OperationContract).

Answer 1

And what does the web.config say? Do you have authentication there, either on the service itself, or the directory? Is transport security on or off? Message security?

The svc files do not configure security, that's part of the config file

Answer 2

There are 3 possible places where the call is getting blocked:

• The IIS Settings, check that anonymous authentication is enabled
• NTFS File access settings, check that the user that is the identity of the application pool has read access.
• the web.config, check that authentication mode is None.

All of the above are before it gets to what could be blocking it in the WCF configuration. But from your comment to blowdart it looks like you have not configured WCF security.

Check also your IIS log for 401 errors. And check if this post is relevant.

Answer 3

By default, a WCF service will do Windows authentication unless configured otherwise. I think the following should do the trick:

  <bindings>
    <wsHttpBinding>
      <binding name="wsHttp">
        <security mode="None"/>
      </binding>
    </wsHttpBinding>
  </bindings>

..and configure your endpoint to use this binding config.