Windows 8.1 WCF client fails to connect to service with digest authentication over BasicHttpBinding

Question

I am having an issue with my WCF application when connecting a client from Windows 8.1. I've been going crazy over this the last couple of days, and cannot get to the bottom of it. Here is the scenario:

My WCF service is fairly straight forward. It uses a basicHttpBinding, with TransportCredentialOnly security mode, and digest client credential type. (The web.config file is here: http://pastebin.com/LsWmcfTs). It does it this way as I need the windows identity on the server side.

My client is a console application, the failure happens when it attempts to invoke the 'Ping' method in my service (which simply returns the text 'Pong') The code used to connect to the service is below:

var basicBinding = new BasicHttpBinding(BasicHttpSecurityMode.TransportCredentialOnly);
basicBinding.Security.Transport.ClientCredentialType = HttpClientCredentialType.Digest;

var client = new TestExecutionEngineClient(basicBinding, new EndpointAddress(uri));

client.Open();

client.Ping();

This has been working for over a year on all connecting clients All except for Windows 8.1 that is, where it never has worked.

When it hits client.Ping(); I get the exception below:

Exception:

The HTTP request is unauthorized with client authentication scheme 'Digest'. The authentication header received from the server was 'Digest qop="auth",algorithm=MD5-sess,nonce="+Upgraded+v1c1d404aaeb7edbba8daf132fea97aa12243033a0f40acf01376892331a408411c85513f482eab750b18498cb2d420b2fb99998b5b8b071a2",charset=utf-8,realm="Digest"'.

Inner Exception:

The remote server returned an error: (401) Unauthorized.

Base Exception:

No credentials are available in the security package

From what i can tell, it looks like server side is requesting digest (correctly) and the client is authenticating in digest, but it won't accept it.....

Any and all help would be greatly appreciated. Thanks

Answer 1

The problem is that Microsoft have enhanced the security in the LSAS in 8.1 / 2012 R2. BasicHttpBinding is no longer supported for sending the users identity information over the network. You must use WSHttpBinding instead.

This solved my problem