CODEWITHSUNDEEP
sql-serverentity-frameworkasp.net-web-api
alfoks
alfoks

Reputation: 4654

WebApi using EF, Windows Authentication failed

I have built a RESTful web service using WebApi. I'm using Entity Framework to connect to the database. Localy works ok. When I upload the site to a host provider and make a request, I get back a 401 result, along with the following headers:

HTTP/1.1 401 Unauthorized
Cache-Control: no-cache
Pragma: no-cache
Expires: -1
Server: Microsoft-IIS/8.0
X-AspNet-Version: 4.0.30319
WWW-Authenticate: Negotiate
WWW-Authenticate: NTLM
X-Powered-By: ASP.NET
X-Powered-By-Plesk: PleskWin
Date: Thu, 20 Jun 2013 11:28:47 GMT
Content-Length: 0
Proxy-Support: Session-Based-Authentication

The first strange thing is that if instead of EF I use the classic SqlConnection and SqlCommand it works fine. The second strange this is that if I run the project local and in connection string I connect to the remote server, it also works!

A though just came to me. Could it be that my connection string is like this, using System.Data.SqlClient as provider?

<add name="MyContext" connectionString="Data Source=(local);Initial Catalog=MyDB;User Id=user;Password=password;MultipleActiveResultSets=True" providerName="System.Data.SqlClient" />

I tried some of the suggestions in this SO question, but nothing worked. Disable Windows Authentication for WebAPI

Any suggestions please? I've been strugling with this 3 days now, implemented HttpModules, custom Attributes, reading about handlers. I'm really overwhelmed now.

Upvotes: 1

Views: 1075

Answers (1)

Badrinarayanan Lakshmiraghavan
Badrinarayanan Lakshmiraghavan

Reputation: 19321

It is clearly the case of Windows Authentication kicking in, as you see from the WWW-Authenticate headers.

WWW-Authenticate: Negotiate
WWW-Authenticate: NTLM

You must disable Windows authentication. If you can use IIS manager, ensure authentication settings are like this.

enter image description here

Or you can use web.config (assuming IIS 7 integrated).

<system.webServer>
  <security>
    <authentication>
      <anonymousAuthentication enabled="false" />
      <basicAuthentication enabled="false" />
      <windowsAuthentication enabled="false" />
    </authentication>
  </security>
  ...
<system.webServer>

Upvotes: 1

Related Questions