Home All Groups Group Topic Archive Search About

Windows Authentication Newbie Question

Author
21 Apr 2005 2:30 PM
Bill
My goal is to use Windows Authentication (WA) to access sensitive web
services from a compact framework (CF) application. My web site on the
development server(Windows Server 2003 running IIS 6.0) is set for WA. I have
created the web service, tested it and shown that it works, and configuted
its web.config file to to accomodate WA by adding;    

<authentication mode="Windows" />
<identity impersonate="true" />

Of course supplying credentials for a CF app is one of the challenges since
login is not a requirement on a PDA.  O'Reilly's "Programming .NET Web
Services" suggests that the following code could be used in calling the web
service (notice the use of explicity supplied credentials):

mammoth.POE_WebServices wert = new PreProcEval.mammoth.POE_WebServices();
wert.Credentials = new NetworkCredential( "userid", "password", "domain" );
wert.PreAuthenticate = true;

String error = String.Empty;

try
{
    DataSet myData = wert.POE_FindPatient( "Z99999", String.Empty,
String.Empty, error );

    foreach( DataRow myRow in myData.Tables[0].Rows )
    {
        lvPatientSelector.Items.Add( new ListViewItem(
myRow.ItemArray[0].ToString() ));
    }
}
catch( WebException wex )
{
    MessageBox.Show( wex.Status.ToString() );
}

Currently this code is producing a WebException status of "ProtocolError".
If I dig deeply enough into the WebException in the watch window I find the
401 status code "Unauthorized".  I've done what my references suggested but
I'm still missing something. A nudge in the right direction would be greatly
appreciated.

Bill

Author
21 Apr 2005 4:24 PM
Joe Kaplan (MVP - ADSI)
You might want to ask the CF guys this because I don't know, but does the CF
IE browser support the authentication protocol you are using on your web
service?  I'm assuming you are using Windows Integrated auth in your server.
Does the CF browser support IWA and does the CF WebRequest class support
IWA?

It is entirely possible that you may need to change protocols to a version
that is supported on CF.  I would be surprised if Basic authentication
didn't work, but once again, this is a question for the CF guys.  With
Basic, you are essentially obligated to use SSL as well.

Otherwise, this should work.

Whether or not you actually need impersonation depends on the details of the
web service.

HTH,

Joe K.

Show quoteHide quote
"Bill" <B***@discussions.microsoft.com> wrote in message
news:43289ED9-FE70-493E-BEC3-1F05A1B5752B@microsoft.com...
> My goal is to use Windows Authentication (WA) to access sensitive web
> services from a compact framework (CF) application. My web site on the
> development server(Windows Server 2003 running IIS 6.0) is set for WA. I
> have
> created the web service, tested it and shown that it works, and configuted
> its web.config file to to accomodate WA by adding;
>
> <authentication mode="Windows" />
> <identity impersonate="true" />
>
> Of course supplying credentials for a CF app is one of the challenges
> since
> login is not a requirement on a PDA.  O'Reilly's "Programming .NET Web
> Services" suggests that the following code could be used in calling the
> web
> service (notice the use of explicity supplied credentials):
>
> mammoth.POE_WebServices wert = new PreProcEval.mammoth.POE_WebServices();
> wert.Credentials = new NetworkCredential( "userid", "password",
> "domain" );
> wert.PreAuthenticate = true;
>
> String error = String.Empty;
>
> try
> {
>    DataSet myData = wert.POE_FindPatient( "Z99999", String.Empty,
> String.Empty, error );
>
>    foreach( DataRow myRow in myData.Tables[0].Rows )
>    {
>        lvPatientSelector.Items.Add( new ListViewItem(
> myRow.ItemArray[0].ToString() ));
>    }
> }
> catch( WebException wex )
> {
>    MessageBox.Show( wex.Status.ToString() );
> }
>
> Currently this code is producing a WebException status of "ProtocolError".
> If I dig deeply enough into the WebException in the watch window I find
> the
> 401 status code "Unauthorized".  I've done what my references suggested
> but
> I'm still missing something. A nudge in the right direction would be
> greatly
> appreciated.
>
> Bill
Author
21 Apr 2005 5:43 PM
Bill
Joe,
Thanks for your response.  I have posted this on the CF newsgroup but have
had no response.  CF does support IWA but because logins are seldom used on
PDAs credentials must be explicitly specified using NetworkCredential (.NET
CF Core Ref. page 408).  When in IE on my iPaq I can successfully navigate to
the web service URL and bring up the test page, the browser prompts you with
a login screen at the appropriate time.  I should be very close to making
this work but I probably just missed something along the way.

Regards,
Bill

Show quoteHide quote
"Joe Kaplan (MVP - ADSI)" wrote:

> You might want to ask the CF guys this because I don't know, but does the CF
> IE browser support the authentication protocol you are using on your web
> service?  I'm assuming you are using Windows Integrated auth in your server.
> Does the CF browser support IWA and does the CF WebRequest class support
> IWA?
>
> It is entirely possible that you may need to change protocols to a version
> that is supported on CF.  I would be surprised if Basic authentication
> didn't work, but once again, this is a question for the CF guys.  With
> Basic, you are essentially obligated to use SSL as well.
>
> Otherwise, this should work.
>
> Whether or not you actually need impersonation depends on the details of the
> web service.
>
> HTH,
>
> Joe K.
>
> "Bill" <B***@discussions.microsoft.com> wrote in message
> news:43289ED9-FE70-493E-BEC3-1F05A1B5752B@microsoft.com...
> > My goal is to use Windows Authentication (WA) to access sensitive web
> > services from a compact framework (CF) application. My web site on the
> > development server(Windows Server 2003 running IIS 6.0) is set for WA. I
> > have
> > created the web service, tested it and shown that it works, and configuted
> > its web.config file to to accomodate WA by adding;
> >
> > <authentication mode="Windows" />
> > <identity impersonate="true" />
> >
> > Of course supplying credentials for a CF app is one of the challenges
> > since
> > login is not a requirement on a PDA.  O'Reilly's "Programming .NET Web
> > Services" suggests that the following code could be used in calling the
> > web
> > service (notice the use of explicity supplied credentials):
> >
> > mammoth.POE_WebServices wert = new PreProcEval.mammoth.POE_WebServices();
> > wert.Credentials = new NetworkCredential( "userid", "password",
> > "domain" );
> > wert.PreAuthenticate = true;
> >
> > String error = String.Empty;
> >
> > try
> > {
> >    DataSet myData = wert.POE_FindPatient( "Z99999", String.Empty,
> > String.Empty, error );
> >
> >    foreach( DataRow myRow in myData.Tables[0].Rows )
> >    {
> >        lvPatientSelector.Items.Add( new ListViewItem(
> > myRow.ItemArray[0].ToString() ));
> >    }
> > }
> > catch( WebException wex )
> > {
> >    MessageBox.Show( wex.Status.ToString() );
> > }
> >
> > Currently this code is producing a WebException status of "ProtocolError".
> > If I dig deeply enough into the WebException in the watch window I find
> > the
> > 401 status code "Unauthorized".  I've done what my references suggested
> > but
> > I'm still missing something. A nudge in the right direction would be
> > greatly
> > appreciated.
> >
> > Bill
>
>
>
Author
21 Apr 2005 6:56 PM
Joe Kaplan (MVP - ADSI)
I'm really not sure here then, but I think I'd start by sniffing the network
traffic to see if the authentication headers tell you anything.

Just out of curiosity, does the same client proxy code work fine from a
normal Windows .NET app?

Sorry to not be of much use.

Joe K.

Show quoteHide quote
"Bill" <B***@discussions.microsoft.com> wrote in message
news:E760931F-B111-4D6E-9418-E44FEE848017@microsoft.com...
> Joe,
> Thanks for your response.  I have posted this on the CF newsgroup but have
> had no response.  CF does support IWA but because logins are seldom used
> on
> PDAs credentials must be explicitly specified using NetworkCredential
> (.NET
> CF Core Ref. page 408).  When in IE on my iPaq I can successfully navigate
> to
> the web service URL and bring up the test page, the browser prompts you
> with
> a login screen at the appropriate time.  I should be very close to making
> this work but I probably just missed something along the way.
>
> Regards,
> Bill
>
> "Joe Kaplan (MVP - ADSI)" wrote:
>
>> You might want to ask the CF guys this because I don't know, but does the
>> CF
>> IE browser support the authentication protocol you are using on your web
>> service?  I'm assuming you are using Windows Integrated auth in your
>> server.
>> Does the CF browser support IWA and does the CF WebRequest class support
>> IWA?
>>
>> It is entirely possible that you may need to change protocols to a
>> version
>> that is supported on CF.  I would be surprised if Basic authentication
>> didn't work, but once again, this is a question for the CF guys.  With
>> Basic, you are essentially obligated to use SSL as well.
>>
>> Otherwise, this should work.
>>
>> Whether or not you actually need impersonation depends on the details of
>> the
>> web service.
>>
>> HTH,
>>
>> Joe K.
>>
>> "Bill" <B***@discussions.microsoft.com> wrote in message
>> news:43289ED9-FE70-493E-BEC3-1F05A1B5752B@microsoft.com...
>> > My goal is to use Windows Authentication (WA) to access sensitive web
>> > services from a compact framework (CF) application. My web site on the
>> > development server(Windows Server 2003 running IIS 6.0) is set for WA.
>> > I
>> > have
>> > created the web service, tested it and shown that it works, and
>> > configuted
>> > its web.config file to to accomodate WA by adding;
>> >
>> > <authentication mode="Windows" />
>> > <identity impersonate="true" />
>> >
>> > Of course supplying credentials for a CF app is one of the challenges
>> > since
>> > login is not a requirement on a PDA.  O'Reilly's "Programming .NET Web
>> > Services" suggests that the following code could be used in calling the
>> > web
>> > service (notice the use of explicity supplied credentials):
>> >
>> > mammoth.POE_WebServices wert = new
>> > PreProcEval.mammoth.POE_WebServices();
>> > wert.Credentials = new NetworkCredential( "userid", "password",
>> > "domain" );
>> > wert.PreAuthenticate = true;
>> >
>> > String error = String.Empty;
>> >
>> > try
>> > {
>> >    DataSet myData = wert.POE_FindPatient( "Z99999", String.Empty,
>> > String.Empty, error );
>> >
>> >    foreach( DataRow myRow in myData.Tables[0].Rows )
>> >    {
>> >        lvPatientSelector.Items.Add( new ListViewItem(
>> > myRow.ItemArray[0].ToString() ));
>> >    }
>> > }
>> > catch( WebException wex )
>> > {
>> >    MessageBox.Show( wex.Status.ToString() );
>> > }
>> >
>> > Currently this code is producing a WebException status of
>> > "ProtocolError".
>> > If I dig deeply enough into the WebException in the watch window I find
>> > the
>> > 401 status code "Unauthorized".  I've done what my references suggested
>> > but
>> > I'm still missing something. A nudge in the right direction would be
>> > greatly
>> > appreciated.
>> >
>> > Bill
>>
>>
>>