Question

we have devloped a SL4 application with a WCF service. The SL application and the service are hosted in IIS 7 with windows authentication enabled and everything else disabled.
In the wwroot i have this client access policy file:

<?xml version="1.0" encoding="utf-8"?>
<access-policy>
 <cross-domain-access>
<policy>
  <allow-from http-request-headers="*">
    <domain uri="*"/>
  </allow-from>
  <grant-to>
    <resource path="/" include-subpaths="true"/>
  </grant-to>
</policy>

and this crossdomain file:

<?xml version="1.0"?>
<!DOCTYPE cross-domain-policy SYSTEM "http://www.macromedia.com/xml/dtds/cross-domain-policy.dtd">
<cross-domain-policy>
 <allow-http-request-headers-from domain="*" headers="*"/>
</cross-domain-policy>

the service config of the silverlight xap looks like this in the client section:

 <binding name="SilverlightEndpoint" maxBufferSize="2147483647"
        maxReceivedMessageSize="2147483647">
      <security mode="TransportCredentialOnly" />
    </binding>
    ....
    <client>
  <endpoint address="http://app.domain.intern/MyService/MyService.svc"
      binding="basicHttpBinding" bindingConfiguration="SilverlightEndpoint"
      contract="[interface]" name="SilverlightEndpoint" />
     </client>

Now when I open my application in internet explorer it prompts me to enter my windows login credentials, after that everything works fine. In my dev environment integrated authentication works without a hitch, i dont have to enter my credentials before accessing my application. In fact, integrated authentication worked in production as well when I had the following endpoint address in the client config: “http://[servername]/MyService/MyService.svc”.
Does anyone know how I can get my integrated authentication back?

Answer 1

Finally, I figured this out.
You really dont have to change anything in the client config. I just kept the endpoint address “http://[servername]/MyService/MyService.svc” and ignored the DNS alias.
The problem was with the browser security settings. In Internet Explorer 8, i had to manually add the dns alias to the trusted sites in the local INTRANET zone (that’s important). Then everything worked fine, whether I accessed the app with the server name or the dns alias and the authentication pop up went away.