Hatteras has three tiers: client, middle, and data. The middle tier is an ASP.NET web service on a Windows 2003 Server running IIS 6. When the client (we use C# for both it and the middle tier) connects to the middle tier, it must authenticate with IIS 6. Depending upon the IIS configuration, that may be negotiate, NTLM, Kerberos, basic, or digest authentication. Here’s a page on Internet Authentication<\/A> in .NET.<\/P>\n NOTE: The code below uses the .NET 2.0 framework (Visual Studio 2005).<\/P>\n In order to authenticate, the client must have credentials that the server recognizes as valid. For Windows Integrated Authentication (comprising NTLM and Kerberos) using the current logged-on user, the client can use CredentialCache.DefaultCredentials<\/A>. Here’s how it looks in code.<\/P>\n class Creds\n{\n public static void Main(string[] args)\n {\n Uri uri = new Uri(args[0]);<\/p>\n HttpWebRequest req = (HttpWebRequest)WebRequest.Create(uri);\n req.Credentials = CredentialCache.DefaultCredentials;<\/p>\n \/\/ Get the response.\n using (HttpWebResponse res = (HttpWebResponse)req.GetResponse())\n {\n StreamReader sr = new StreamReader(res.GetResponseStream());\n Console.WriteLine(sr.ReadToEnd());\n }\n }\n}<\/PRE><\/BLOCKQUOTE>\n You can find that same type of sample code in MSDN. However, it gets more interesting if you want to use basic or digest authentication or use credentials other than the current logged-on user.<\/P>\n One interesting fact is that the HttpWebRequest.Credentials property is of type ICredentials, but it only uses instances of NetworkCredential and CredentialCache. If you implement ICredentials on your own class that is not one of those two classes, you can assign it to the Credentials property, but HttpWebRequest will silently ignore it.<\/P>\n To go further, we need to look at the CredentialCache<\/A> class itself. This class is used to hold a set of credentials that are associated with hosts and authentication types. It has two static properties, one of which we used above, that are the “authentication credentials for the current security context in which the application is running,” which means the logged-on user in our case.<\/P>\n The difference is very subtle. The documentation for DefaultCredentials says, “The ICredentials<\/B> instance returned by DefaultCredentials<\/B> cannot be used to view the user name, password, or domain of the current security context.” The instance returned by DefaultNetworkCredentials, being new in .NET 2.0 and of type NetworkCredential, would presumably let you get the user name and domain, but it didn’t work for me when I tried it with the following code (UserName returned an empty string).<\/P>\n The NetworkCredential class implements both the ICredentials (NetworkCredential GetCredential(Uri uri, String authType)<\/FONT>) and ICredentialsByHost<\/A> (NetworkCredential GetCredential(String host, int port, String authType)<\/FONT>) interfaces. The ICredentialsByHost interface is new in .NET 2.0.<\/P>\n The CredentialCache class has methods that let you add, get, and remove credentials for particular hosts and authentication types. Using this class, we can manually construct what setting req.Credentials = CredentialCache.DefaultCredentials<\/FONT> accomplished in the original example.<\/P>\n The authentication type can also be explicitly specified as “NTLM” and “Kerberos” in separate calls to Add()<\/FONT>. This page on authentication schemes<\/A> explains using Negotiate as follows.<\/P>\n Negotiates with the client to determine the authentication scheme. If both client and server support Kerberos, it is used; otherwise NTLM is used.<\/P><\/BLOCKQUOTE>\n Let’s say you want to work with basic or digest authentication. The documentation for CredentialsCache.DefaultCredentials and CredentialsCache.DefaultNetworkCredential says that neither will work with basic or digest. If we add basic to credentials cache, we get a runtime exception.<\/P>\n The exception is thrown by the Add()<\/FONT> method.<\/P>\n So, in order to use basic or digest, we must create a NetworkCredential object, which is also what we need to do in order to authenticate as some identity other than the logged-on user. To do that, we create NetworkCredential object and add it to the CredentialCache as follows.<\/P>\n Basic authentication sends the password across the wire in plain text. That’s okay for a secure connection, such as one using SSL, and for situations where you don’t need much security. Digest authentication hashes the password along with other data from the server before sending a response over the wire. It’s a significant step up from basic.<\/P>\n Now we need to have the user name and password to create the NetworkCredential object. There are two parts to this. First is prompting the user for the name and password. The second is storing the information. For prompting there is the Windows dialog that pops up any time you go to a web site that requires authentication. That dialog includes a “Remember my password” checkbox. I don’t yet know what the managed API is for that.<\/P>\n To store and retrieve the information, there is the new managed DPAPI explained by Shawn Farkas<\/A> in several blog postings.<\/P>\n [Update 3:44pm] The Windows dialog used when IE prompts for name and password is created by the CredUIPromptForCredentials<\/A>() function. CredUIConfirmCredentials<\/A>() is used to save credentials that authenticated successfully, if desired. Duncan Mackenzie’s MSDN article Using Credential Management in Windows XP and Windows Server 2003<\/A> explains how to use it from .NET.<\/P>\n [UPDATE 4\/10\/2006] I updated the MSDN links that were broken.<\/P><\/p>\n","protected":false},"excerpt":{"rendered":" Hatteras has three tiers: client, middle, and data. The middle tier is an ASP.NET web service on a Windows 2003 Server running IIS 6. When the client (we use C# for both it and the middle tier) connects to the middle tier, it must authenticate with IIS 6. Depending upon the IIS configuration, that may […]<\/p>\n","protected":false},"author":94,"featured_media":10268,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[1],"tags":[2],"class_list":["post-5483","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-uncategorized","tag-c"],"acf":[],"blog_post_summary":" Hatteras has three tiers: client, middle, and data. The middle tier is an ASP.NET web service on a Windows 2003 Server running IIS 6. When the client (we use C# for both it and the middle tier) connects to the middle tier, it must authenticate with IIS 6. Depending upon the IIS configuration, that may […]<\/p>\n","_links":{"self":[{"href":"https:\/\/devblogs.microsoft.com\/buckh\/wp-json\/wp\/v2\/posts\/5483","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/devblogs.microsoft.com\/buckh\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/devblogs.microsoft.com\/buckh\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/buckh\/wp-json\/wp\/v2\/users\/94"}],"replies":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/buckh\/wp-json\/wp\/v2\/comments?post=5483"}],"version-history":[{"count":0,"href":"https:\/\/devblogs.microsoft.com\/buckh\/wp-json\/wp\/v2\/posts\/5483\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/buckh\/wp-json\/wp\/v2\/media\/10268"}],"wp:attachment":[{"href":"https:\/\/devblogs.microsoft.com\/buckh\/wp-json\/wp\/v2\/media?parent=5483"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/buckh\/wp-json\/wp\/v2\/categories?post=5483"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/buckh\/wp-json\/wp\/v2\/tags?post=5483"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}using System;\nusing System.IO;\nusing System.Net;<\/p>\n
\n
Console.WriteLine(“User name: ” + CredentialCache.DefaultNetworkCredentials.UserName);<\/PRE><\/BLOCKQUOTE>\n
CredentialCache credCache = new CredentialCache();\n credCache.Add(new Uri(“http:\/\/localhost”), “Negotiate”,\n CredentialCache.DefaultNetworkCredentials);\n HttpWebRequest req = (HttpWebRequest)WebRequest.Create(uri);\n req.Credentials = credCache;<\/PRE><\/BLOCKQUOTE>\n
\n
credCache.Add(new Uri(“http:\/\/localhost”), “Basic”,\n CredentialCache.DefaultNetworkCredentials);<\/PRE><\/BLOCKQUOTE>\n
Unhandled Exception: System.ArgumentException: Default credentials cannot be supplied for the Basic authentication scheme.\nParameter name: authType\nat System.Net.CredentialCache.Add(Uri uriPrefix, String authType, NetworkCredential cred)<\/PRE><\/BLOCKQUOTE>\n
credCache.Add(new Uri(“http:\/\/localhost”), “Basic” \/* or “Digest” *\/,\n new NetworkCredential(“me”, “foo”, “DOMAIN”));<\/PRE><\/BLOCKQUOTE>\n
\n