7

We are using web service with basic authentication. It all worked all fine, till owners of web service implemented balancing service. Which is simply redirects requests to different instances of web service.

The problem is that after being redirected basic authentication fails. There is "request authentication credentials was not passed" exception.

Additional info:

  1. We have to create request manually.

        var req = (HttpWebRequest)WebRequest.CreateDefault(new Uri(Settings.Default.HpsmServiceAddress));

    req.Headers.Add("Authorization", "Basic aaaaaaaaaaa");
    req.PreAuthenticate = true;
    req.AuthenticationLevel = AuthenticationLevel.MutualAuthRequested;
    req.UserAgent = "Apache-HttpClient/4.1.1 (java 1.5)";
    req.KeepAlive = false;

    ServicePointManager.Expect100Continue = false;

    req.ContentType = "text/xml; charset=utf-8";
    req.Method = "POST";
    req.Accept = "gzip,deflate";
    req.Headers.Add("SOAPAction", actionName);
    byte[] buffer = Encoding.UTF8.GetBytes(envelop);
    Stream stm = req.GetRequestStream();
    stm.Write(buffer, 0, buffer.Length);
    stm.Close();

    WebResponse response = req.GetResponse();
    string strResponse = new StreamReader(response.GetResponseStream()).ReadToEnd();
    response.Dispose();

  2. We are redirected with HTTP 307 redirect

Saw
  • 6,199
  • 11
  • 53
  • 104
Pavel Luzhetskiy
  • 789
  • 1
  • 8
  • 26

2 Answers2

2

Follow the MSDN for HttpWebRequest.AllowAutoRedirect Property i found this :

The Authorization header is cleared on auto-redirects and HttpWebRequest automatically tries to re-authenticate to the redirected location. In practice, this means that an application can't put custom authentication information into the Authorization header if it is possible to encounter redirection. Instead, the application must implement and register a custom authentication module. The System.Net.AuthenticationManager and related class are used to implement a custom authentication module. The AuthenticationManager.Register method registers a custom authentication module.

Solution is to write a custom Authentication Module.

Here what i've found about it :

http://msdn.microsoft.com/en-us/library/system.net.authenticationmanager.aspx

And here the AllowAutoRedirect properties page :

http://msdn.microsoft.com/en-us/library/system.net.httpwebrequest.allowautoredirect.aspx

UPDATE

Can you try to use CredentialCache instead of add header to webrequest ? 

CredentialCache myCache = new CredentialCache();

myCache.Add(
new Uri("http://www.contoso.com/"),"Basic",new NetworkCredential(UserName,SecurelyStoredPassword));
req.Credentials = myCache;
2GDev
  • 2,478
  • 1
  • 20
  • 32
  • Tnx. It looks like solution but still doesnt work. =( I ve added this few lines: req.AllowAutoRedirect = true; AuthenticationManager.Unregister("Basic"); AuthenticationManager.Register(new CustomBasic()); req.Credentials = new NetworkCredential("user", "password"); Where CustomBasic() is just code from your link example. It Works fine with service instance but fails after redirect. Any ideas what i do wrong? Tnx. – Pavel Luzhetskiy Dec 28 '12 at 06:11
  • 1
    It works!!!! Can you plz comment what is the difference and why usual credentials didnt work? – Pavel Luzhetskiy Dec 28 '12 at 13:10
0

Indeed, CredentialCache is working correctly. However, if you would like to add multiple basic auth credentials (for example if there is redirection that you are aware of) you can use following function that I have made:

private void SetNetworkCredential(Uri uriPrefix, string authType, NetworkCredential credential)
{
    if (request.Credentials == null)
    {
        request.Credentials = new CredentialCache();
    }

    if (request.Credentials.GetCredential(uriPrefix, authType) == null)
    {
        (request.Credentials as CredentialCache).Add(uriPrefix, authType, credential);
    }
}

I hope it will help somebody in the future.

Gucu112
  • 877
  • 10
  • 12