Authentication NTLM to Sharepoint Services failed on List.asmx but works for copy.asm

Question

I have a simple .NET WPF application. I added service reference. to

//server:port/sites/site_collection_name/_vti_bin/lists.asmx

and call it ListServ. I typed followed code

       ListsSoapClient client = new ListsSoapClient();
       if (client.ClientCredentials != null)
       client.ClientCredentials.Windows.AllowedImpersonationLevel =   System.Security.Principal.TokenImpersonationLevel.Impersonation;         

       try
       {
               client.Open();
               Console.WriteLine(client.State);
               System.Xml.Linq.XElement listCollection = client.GetListCollection();
       }
}

From app.config

          <binding name="ListsSoap">
            <security mode="TransportCredentialOnly">
              <transport clientCredentialType="Ntlm" proxyCredentialType="Ntlm"
                  realm="" />
              <message clientCredentialType="UserName" algorithmSuite="Default" />
            </security>
          </binding>

Above code catchs CommunicationException:

System.ServiceModel.Security.MessageSecurityException: 
The HTTP request is unauthorized with client authentication scheme 'Ntlm'. 
The authentication header received from the server was 'NTLM'. ---> 
System.Net.WebException: The remote server returned an error: (401) Unauthorized.
   at System.Net.HttpWebRequest.GetResponse()
   at System.ServiceModel.Channels.HttpChannelFactory`1.HttpRequestChannel.HttpChannelRequest.WaitForReply(TimeSpan timeout)
   --- End of inner exception stack trace ---

Server stack trace: 
   at System.ServiceModel.Channels.HttpChannelUtilities.ValidateAuthentication
   HttpWebRequest request, HttpWebResponse response, WebException responseException, HttpChannelFactory`1 factory)

I have enabled windows autentication on ISS where sharepoint is. What is very odd is that I used similar code to successfuly add document to document library. All credential correct describes added document on sharepoint list.

I even tried deprecated: client.ClientCredentials.Windows.AllowNtlm = true;

NotVonKaiser NotVonKaiser · Accepted Answer · 2013-05-22T19:14:01

If you're trying to call this web service from another farm, you're going to run into the double hop issue, explained here. Basically, NTLM has no way of knowing what a SharePoint user's windows credentials are. You can get around this by:

hardcoding credentials,
allowing anonymous access, or
setting up Kerberos authentication.

Authentication NTLM to Sharepoint Services failed on List.asmx but works for copy.asm

2 Answers