Unable to authenticate to ASP.NET Web Api service with HttpClient

by

I have investigated the source code of HttpClientHandler (the latest version I was able to get my hands on) and this is what can be found in SendAsync method:

// BeginGetResponse/BeginGetRequestStream have a lot of setup work to do before becoming async
// (proxy, dns, connection pooling, etc).  Run these on a separate thread.
// Do not provide a cancellation token; if this helper task could be canceled before starting then 
// nobody would complete the tcs.
Task.Factory.StartNew(startRequest, state);

Now if you check within your code the value of SecurityContext.IsWindowsIdentityFlowSuppressed() you will most probably get true. In result the StartRequest method is executed in new thread with the credentials of the asp.net process (not the credentials of the impersonated user).

There are two possible ways out of this. If you have access to yours server aspnet_config.config, you should set following settings (setting those in web.config seems to have no effect):

<legacyImpersonationPolicy enabled="false"/>
<alwaysFlowImpersonationPolicy enabled="true"/>

If you can’t change the aspnet_config.config you will have to create your own HttpClientHandler to support this scenario.

UPDATE REGARDING THE USAGE OF FQDN

The issue you have hit here is a feature in Windows that is designed to protect against “reflection attacks”. To work around this you need to whitelist the domain you are trying to access on the machine that is trying to access the server. Follow below steps:

  1. Go to Start –> Run –> regedit
  2. Locate HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\MSV1_0 registry key.
  3. Right-click on it, choose New and then Multi-String Value.
  4. Type BackConnectionHostNames (ENTER).
  5. Right-click just created value and choose Modify.
  6. Put the host name(s) for the site(s) that are on the local computer in the value box and click OK (each host name/FQDN needs to be on it’s own line, no wildcards, the name must be exact match).
  7. Save everything and restart the machine

You can read full KB article regarding the issue here.

More Related Contents:

  1. 401 response for CORS request in IIS with Windows Auth enabled
  2. ASP.NET Web API returns 404 for PUT only on some servers
  3. What’s the difference between WCF Web API and ASP.NET Web API
  4. How to pass json POST data to Web API method as an object?
  5. JSONP with ASP.NET Web API
  6. How to add Web API to an existing ASP.NET MVC 4 Web Application project?
  7. Simple post to Web Api
  8. Logging request/response messages when using HttpClient
  9. How to update a claim in ASP.NET Identity?
  10. Error :Request header field Content-Type is not allowed by Access-Control-Allow-Headers
  11. Redirect from asp.net web api post action
  12. WebAPI StreamContent vs PushStreamContent
  13. How to add global ASP.Net Web Api Filters?
  14. How to put conditional Required Attribute into class property to work with WEB API?
  15. Windows Authentication for ASP.NET MVC 4 – how it works, how to test it
  16. How to create ASP.NET Web API Url?
  17. Return HTML from ASP.NET Web API
  18. How to return raw string with ApiController?
  19. Using WebSockets with ASP.NET Web API
  20. Accessing post or get parameters in custom authorization MVC4 Web Api
  21. How to authorize CORS preflight request on IIS with Windows Authentication
  22. Return Json, but it includes backward slashes “\”, which I don’t want
  23. HTTP PUT not allowed in ASP.NET Web API
  24. WebApi Json.NET custom date handling
  25. How to create two footer rows in jqgrid
  26. How to add and get Header values in WebApi
  27. Web API in MVC solution in separate project
  28. Routing in Asp.net Mvc 4 and Web Api
  29. All requests to ASP.NET Web API return 404 error
  30. WebAPI CORS with Windows Authentication – allow Anonymous OPTIONS request

Leave a Comment