GetListItems "request failed with HTTP status 401: Unauthorized"

Question

I have an asp.net web application without ssl enabled using lists.asmx on a sharepoint 2010 site with ssl enabled. I have added the lists.asmx as a web reference called "myref".

The code I'm using is below:

Web.config snippet

    <system.web>
        <identity impersonate="true"/>
        <authentication mode="Windows"/>
        ..........
    </system.web>

aspx code

<%@ Import Namespace="System" %>
<%@ Import Namespace="System.IO" %>
<%@ Import Namespace="System.Net" %>
<%@ Import Namespace="System.xml" %>
<%@ Import Namespace="myref" %>
<%
Dim xmlDoc As XmlDocument = New System.Xml.XmlDocument()
Dim myQuery As XmlNode = xmlDoc.CreateNode(XmlNodeType.Element, "Query","") 
myQuery.InnerXml = "<Where><Eq><FieldRef Name='_ModerationStatus' /><Value Type='ModStat'>2</Value></Eq></Where>"
Dim myViewFields As XmlNode = xmlDoc.CreateNode(XmlNodeType.Element, "ViewFields","") 
myViewFields.InnerXml ="<FieldRef Name='_Status' /><FieldRef Name='owshiddenversion' />"
Dim myQueryOptions as XmlNode= xmlDoc.CreateNode(XmlNodeType.Element, "QueryOptions","") 
myQueryOptions.InnerXml = "<Folder>my list</Folder>"

Dim mylist As new myref.Lists()
mylist.UseDefaultCredentials = true
mylist.PreAuthenticate = True

Dim ndLists As XmlNode = mylist.GetListItems("my list","",myQuery,myViewFields,100,myQueryOptions,"")
Response.Write(ndLists.outerxml)
%>

if I use the above I get the error:

Line 514:        [System.Web.Services.Protocols.SoapDocumentMethodAttribute("http://schemas.microsoft.com/sharepoint/soap/GetListItems", RequestNamespace="http://schemas.microsoft.com/sharepoint/soap/", ResponseNamespace="http://schemas.microsoft.com/sharepoint/soap/", Use=System.Web.Services.Description.SoapBindingUse.Literal, ParameterStyle=System.Web.Services.Protocols.SoapParameterStyle.Wrapped)] 
Line 515:        public System.Xml.XmlNode GetListItems(string listName, string viewName, System.Xml.XmlNode query, System.Xml.XmlNode viewFields, string rowLimit, System.Xml.XmlNode queryOptions, string webID) { 
Line 516:            object[] results = this.Invoke("GetListItems", new object[] { 
Line 517:            listName, 
Line 518:            viewName,

if I use:

Dim cache As CredentialCache = New CredentialCache()
cache.Add(New Uri(mylist.Url), "Negotiate", New NetworkCredential("userid", "password", "domain"))

instead of

mylist.UseDefaultCredentials = true

it works fine. The problem is I want to pass through the logged on details of the user accessing the asp.net site and not a hard coded userid.

To complicate things though the same code that doesn't work on a browser on my local machine works fine if I log directly onto the asp.net sites server and access directly via localhost/sitename/pagename.aspx.

Checking the application event log on the web server shows the following extra info that the web page doesn't show:

Thread account name: NT AUTHORITY\NETWORK SERVICE 
Is impersonating: False

which to me seems to show that its trying to use the network service to connect to the web service and not the logged in user details, except when you are logged onto the server directly.

• The asp.net app has Windows Authentication on (not anonymous)
• windows authentication is required to be passed to the sharepoint web service
• code that doesn't work via local machine works fine when logged directly onto the web server
• Impersonation is enabled in the web.config file (although if you turn it off you get no error, but you also get no items back from sharepoint)
• authentication mode in the web.config file is set at windows
• If I output WindowsIdentity.GetCurrent.name and disable the getlistitems call I can see that it definately has my details when accessed via the server or my local machine.

Any idea why this is happening?

Answer 1

This was resolved by kerberos delegation. In Active Directory under the DELEGATION tab, the Trust this computer for delegation to any service (Kerberos only) option was chosen.

It took a few hours after that for it to actually then start working though (I think it should have been within about 30 seconds but took longer than that for some reason).