but you will have to configure the service section too

Source
http://www.pvle.be/2008/10/soap-12-message-format-with-basichttpbinding/

<system.serviceModel>
<serviceHostingEnvironment aspNetCompatibilityEnabled=”true” />
</system.serviceModel>

What a shock, the module didn’t work…WCF uses security separated from the IIS authentication system.

WCF accepts custom security but only if certificates or https is used. Apparently the credentials are sent in clear mode…

What a crap… I understand why, but leave the choice to the developers. Only they know their environments.

After a complete week of intensive research I found the solution thanks to this project

http://custombasicauth.codeplex.com/

I didn’t like it very much because it implies that you create a new authentication mode and the program is not the same if it is used for IIS 6 or IIS 7. But it lead me to the necessary changes so I can continue using your incredible module.

The magic is:

And in your Service class add the following above your class declaration

[AspNetCompatibilityRequirements(RequirementsMode = AspNetCompatibilityRequirementsMode.Required)]
public class Service

So simple, and yet so hard to find out.

Dim req3 As HttpWebRequest
req3 = CType(WebRequest.Create(uri), HttpWebRequest)

req3.Credentials = New NetworkCredential(“myuser”, “mypass”)

I need a client making the authentication programmatically (not via browser).

So, create the 1st request and I catch the WebException.Response. Now I have access to the nonce and to all parameters. In order to authenticate, I need to send the authenticated request, according to the RFC (I mean I’ve to create the header using nonce, user, pass, MD5,..). Do you have any working code to create this response ?
thanks in advance.
Frank

First, name it CustomDigestAuthenticationModule in the web.config.

Second, to make it works with Integrated pipeline, add this section:

<system.webServer>
<validation validateIntegratedModeConfiguration=”false”/>
<modules>
<add name=”CustomeDigestAuthenticationModule” type=”Rassoc.Samples.DigestAuthenticationModule, DigestAuthMod”/>
</modules>
</system.webServer>

This way it will work as well with integrated pipeline as without it. If you only want to make it work in integrated pipeline mode, erase httpmodule section and add only

<system.webServer>
<modules>
<add name=”CustomeDigestAuthenticationModule” type=”Rassoc.Samples.DigestAuthenticationModule, DigestAuthMod”/>
</modules>
</system.webServer>

The section <validation validateIntegratedModeConfiguration=”false”/> is only there to avoid validation by IIS between the configuration and the integrated mode which doesn’t accept an httpModule section.

——————————————
# Chinh said:
August 24th, 2009 at 2:09 pm

For anyone trying to get this to work with IIS7, you need to do this:

- In web.config, change the name of the httpModule to “CustomBasicAuthenticationModule”. In IIS7, there’s already a built-in module named “BasicAuthenticationModule”.
- Follow the instructions here http://bdotnet.in/blogs/navaneeth/archive/2008/07/06/2056.aspx

Chinh

To make it accept the module in integrated module. Don’t get the 500 error message anymore but it doesn’t ask my login and password. Instead it throws a “401 Refused Access” directly.