I'm stumped by a double-hop problem where Internet Explorer calls a
webservice on server-A that calls the dws.CreateFolder webservice in
Sharepoint Portal Server (SPS) on server-B. The dws webservice returns
a 401: Unauthorized HTTP error when default credentials are used by the
Server-A webservice. The problem goes away if the Server-A webservice
creates and passes new credentials from an authorized user's login and
password strings.
I need to use default credentials as SPS has to show the identity of
the user responsible for the creation of each folder.
According to the security logs from both servers, the user's
credentials are properly arriving from the client and validating on
Server-A. But, when passed from the webservice on Server-A to the dws
webservice on Server-B, the log shows Anomynous User is transmitted
instead of the credentials of the user that logged in as a client.
I've read alot of posts about double hops, and its not quite clear what
needs to be done. I've tried setting delegation as perscribed in MSDN
and so far nothing has worked. I don't know if this problem is because
of the combination of hardware and O/S or their configuration. I'ld
appreciate hearing from you if you've had similar experiences or any
remedies - thanks
The hardware configuration is:
(porportional font table)
Computer: Client Server-A
Server-B
OS: Windows XP Windows SBS Windows
Server 2003
Domain: MYWORLD MYWORLD MYWORLD
Network Dir: Server-A Active Directory
Member of Server-A
user account Domain Controller
Active Directory
Delegation: Use Windows User account can No special
settings
Integrated delegate and IIS is
trusted to delegate.
The webservice is
set to use windows
integrated
authentication
(fixed pitch font table)
Computer: Client Server-A Server-B
OS: Windows XP Windows SBS Windows Server
2003
Domain: MYWORLD MYWORLD MYWORLD
Network Dir: Server-A Active Directory Member of
Server-A
user account Domain Controller Active Directory
Delegation: Use Windows User account can No special
settings
Integrated delegate and IIS is
trusted to delegate.
The webservice is
set to use windows
integrated authentication
The credentials VB.NET code in the Server-A webservice is:
dws = New ServerB.Dws
dws.Url = http://ServerB/Sites/MySite/_vti_bin/DWS.asmx
'next line fails
dws.Credentials = System.Net.CredentialCache.DefaultCredentials
'next line works
dws.Credentials = New System.Net.NetworkCredential("username",
"password", "MYWORLD")