Question

I currently have the following bindings on a WCF service:

  <basicHttpBinding>
    <binding name="BasicHttpEndpointBinding">
      <security mode="TransportCredentialOnly">
        <transport clientCredentialType="Ntlm" />
        <message clientCredentialType="UserName" algorithmSuite="Default" />
      </security>
    </binding>
  </basicHttpBinding>

and

  <webHttpBinding>
    <binding name="WebHttpEndpointBinding">
      <security mode="None" />
    </binding>
  </webHttpBinding>

With the corresponding endpoints:

    <endpoint address=""
              binding="basicHttpBinding"
              bindingConfiguration="BasicHttpEndpointBinding"
              bindingNamespace="http://services.company.net/MyWcfService"
              contract="MyWcfService.Interface.IMyWcfService">
    </endpoint>
    <endpoint address="RestService"
              behaviorConfiguration="restServiceBehavior"
              binding="webHttpBinding"
              bindingConfiguration="WebHttpEndpointBinding"
              contract="MyWcfService.Interface.IMyWcfService" />
  </service>

The idea is to have clients invoking the ‘BasicHttpEndpointBinding’ binding to require NTLM authentication, and the clients that are invoking the ‘WebHttpEndpointBinding’ to be able to do so anonymously (RESTful calls via jQuery).

While this seems to work on my machine, does this seem possible in an IIS 7.5 hosted environment?

Thanks.

Answer 1

This works in IIS with Anonymous and Windows authentication enabled.