Setting up a SoapClient to use Windows Authentication

Setting up a soap client to use windows authentication is rather tricky as there many configuration options concerning ASP.NET security.

First of all make sure that IIS 7.0 is correctly configured to use Windows authentication instead of default anonymous user login. Therefore, the following has to be applied to the

This effectively forces IIS to use an authenticated windows user. If a user is already windows authenticated, the user does not need to log in. So, this setting is appropriate for use in intranet environments, not in intranet environments.

However, users do not interact with webservices, code interacts with webservices. To consume a web service a service reference has to be added to the project:

Adding a service reference to a project creates an app.config describing the binding of that service including the security settings. Default security settings only enable anonymous user to consume the code. If IIS is configured to use windows security this will result in a HTTP 401 error.

Therefore, the following section has to be modified:

                    <security mode="None">

                        <transport clientCredentialType="None" proxyCredentialType="None"

                            realm="" />

                        <message clientCredentialType="UserName" algorithmSuite="Default" />

                    </security>

To:

                    <security mode="TransportCredentialOnly">

                        <transport clientCredentialType="Windows" proxyCredentialType="None"

                            realm="" />

                        <message clientCredentialType="UserName" algorithmSuite="Default" />

                    </security>

Note: this section resides in the:

<configuration>

    <system.serviceModel>

        <bindings>

            <basicHttpBinding>

After adjusting the security section the code when run using an authorized windows user should work. But for an application with a web based user interface this is not required! The user will be prompted to log in, if required. So then the code is run with the authenticated user and the webservices can be consumed. I use the above to enable test code to run.