Question

So I’m attempting to configure a WCF 4 REST app to utilize multiple standard endpoints (for the help functionality). The reason for this is that my hosting IIS process has both Anonymous and Windows Authentication enabled, and certain endpoints within my WCF app require one or the other (both results in an exception).

Previously, I was able to do this by defining some bindings:

<bindings>
  <webHttpBinding>
    <binding name="Anonymous">
      <security mode="None" />
    </binding>

    <binding name="WindowsAuthentication">
      <security mode="TransportCredentialOnly">
        <transport clientCredentialType="Windows" />
      </security>
    </binding>
  </webHttpBinding>
</bindings>

And then defining the services like so:

<services>
  <service name="Host.SubscriberInfoHost">
    <endpoint address="" binding="webHttpBinding" bindingConfiguration="WindowsAuthentication" contract="Host.ISubscriberInfoHost" />
  </service>
  <service name="Utilities.Instrumentation.ServiceStatus.ServiceStatusHost">
    <endpoint address="" binding="webHttpBinding" bindingConfiguration="Anonymous" contract="Utilities.Instrumentation.ServiceStatus.IServiceStatusHost" />
  </service>
</services>

This is what I’ve tried to do so far while utilizing the standard endpoints model:

    <standardEndpoints>
        <webHttpEndpoint>
            <standardEndpoint name="Host.SubscriberInfoHost" helpEnabled="true" automaticFormatSelectionEnabled="true">
              <security mode="TransportCredentialOnly">
                <transport clientCredentialType="Windows" />
              </security>
             </standardEndpoint>

            <standardEndpoint name="Utilities.Instrumentation.ServiceStatus.IServiceStatusHost" helpEnabled="true" automaticFormatSelectionEnabled="true">
              <security mode="None" />
            </standardEndpoint>
        </webHttpEndpoint>
    </standardEndpoints>

However doing this gets the service confused, as I receive:

System.InvalidOperationException: IIS specified authentication schemes 'Negotiate, Anonymous', but the binding only supports specification of exactly one authentication scheme. Valid authentication schemes are Digest, Negotiate, NTLM, Basic, or Anonymous. Change the IIS settings so that only a single authentication scheme is used

Which is exactly what I’m trying to get away from. Could anyone possibly give me a hand on how I would set this situation up using the new standard endpoints model? Thanks!

Answer 1

Found the answer to this after some experimentation. It turns out that the “name” attribute for standard endpoints is actually an endpoint configuration. So, you would use the following standard endpoints:

<standardEndpoint name="WindowsAuthentication" helpEnabled="true" automaticFormatSelectionEnabled="true"> 
          <security mode="TransportCredentialOnly"> 
            <transport clientCredentialType="Windows" /> 
          </security> 
 </standardEndpoint> 

 <standardEndpoint name="Anonymous" helpEnabled="true" automaticFormatSelectionEnabled="true"> 
          <security mode="None" /> 
 </standardEndpoint> 

And then, you would also configure a service such as the following (the “kind” and “endpointConfiguration” attributes must be set in order to tie this endpoint to the standard endpoint above)

  <service name="SomeEndpoint">
    <endpoint address="" kind="webHttpEndpoint" endpointConfiguration="WindowsAuthentication" contract="ISomeEndpoint" />
  </service>

This allows you to mix authentication styles while maintaining the handy service help page.