通过

Preventing Anonymous Access

  • 项目

How do I prevent clients from accessing my service anonymously? I've changed the settings in IIS from Anonymous Access to Integrated Windows Authentication. However, now I'm getting the error message: "Security settings for this service require 'Anonymous' Authentication but it is not enabled for the IIS application that hosts this service."

Disabling anonymous access requires coordinating the settings in IIS and in your service configuration. Those two sources must be in agreement about whether anonymous access is expected. IIS is already using Windows authentication in this case, so let's look at what needs to happen to the service configuration file. I'm assuming that this is IIS6 so the only network transport we're talking about here is HTTP.

There are two cases depending on whether you want the protocol that gets exposed to be HTTP or HTTPS. The simplest is to keep using HTTP since that's probably what you were using if anonymous access was allowed in the past. To switch off anonymous access with HTTP, you need to set the security mode to TransportCredentialOnly.

 <basicHttpBinding>
  <binding>
    <security mode="TransportCredentialOnly">
      <transport clientCredentialType="Windows" />
    </security>
  </binding>
</basicHttpBinding>

Note that TransportCredentialOnly is not supported for every binding (in this case we're using BasicHttp). For WSHttp, the only choice is going to be to use HTTPS. To switch off anonymous access with HTTPS, you need to set the security mode to Transport.

 <wsHttpBinding>
  <binding>
    <security mode="Transport">
      <transport clientCredentialType="Windows" />
    </security>
  </binding>
</wsHttpBinding>

Other bindings can be made to work in this situation as well, including custom bindings. I'm just showing you the most common examples. The key in both cases though is that we're getting transport security with the right kind of credentials associated.

Next time: Writing Binding Element Essentials

Comments

  • Anonymous
    March 23, 2007
    I've created a custom implementation of GetProperty for my binding but now I'm getting errors when I

  • Anonymous
    March 27, 2007
    Hi, Can we provide claim based security for SQL Server 2005 Reporting Services? Regards Amit

  • Anonymous
    April 03, 2007
    How do I enable Kerberos authentication for my web service? Kerberos is a very good authentication protocol

  • Anonymous
    June 18, 2009
    The web is great for learning patterns and practices when you are planning to deploy a solution. With Silverlight learning how to configure IIS for best results in a very secured environment is&#160; a huge task, what happens if you just configure IIS

  • Anonymous
    June 18, 2009
    The web is great for learning patterns and practices when you are planning to deploy a solution. With