IIS Anonymous Authentication enabled but credentials required

Question

We have a some web services hosted in IIS8 that were running fine with anonymous authentication set. Then a couple of days ago anonymous authentication was disabled in favour for windows authentication which made it impossible to connect to the web services. Now we have reverted to anonymous authentication but the site still asks for windows credentials:

The HTTP request is unauthorized with client authentication scheme 'Anonymous'. The authentication header received from the server was 'Negotiate,NTLM'.

What we have done is this: in web.config:

<system.serviceModel>
<bindings>
    <basicHttpBinding>
        <binding name="CustomHttpBinding" maxBufferSize="2147483647" maxReceivedMessageSize="2147483647">
            <security mode="None">
                <transport clientCredentialType="None" />
            </security>
        </binding>
    </basicHttpBinding>
</bindings>

and in IIS Manager we only have Anonymous Authentication checked:

In the applicationHost.config file everything seems correct:

    <location path="Path/WebServices">
    <system.webServer>
        <security>
            <authentication>
                <windowsAuthentication enabled="false" useKernelMode="true">
                    <providers>
                        <clear />
                        <add value="NTLM" />
                        <add value="Negotiate" />
                    </providers>
                    <extendedProtection tokenChecking="None" />
                </windowsAuthentication>
                <anonymousAuthentication enabled="true" />
                <basicAuthentication enabled="false" />
            </authentication>
        </security>
    </system.webServer>

App-pools, site, and server have all been restarted/recycled.

Where else should I look? Thanks.

Rich-Lang Rich-Lang · Accepted Answer · 2019-04-09T13:11:23

I agree that everything looks correct from what you've shown. I would recommend reviewing all your visible configuration for any anonymous/Windows auth that may apply that you may not be seeing. To do this, in IIS Manager click on the Server on the Left, then select Configuration Editor. On the right, select Search Configuration. The search at the top only accepts "section names" so things like WindowsAuthentication and AnonymousAuthentication are good searches. Review each place in your config that may apply to your site/app.

IIS Anonymous Authentication enabled but credentials required

2 Answers