Welcome to MSDN Blogs Sign in | Join | Help

Application Security Arena

Nimrod Luria
Microsoft ACE Team
What to do When IIS MMC doesn't do the work

for example- if you want to use WCF and windows integarted security you will need to conifgure the IIS for windows integrated authentication.

even when you do that you can get an execption like:

System.ServiceModel.ServiceHostingEnvironment+HostingManager/27836922

 Exception: System.ServiceModel.ServiceActivationException: The service '/internetbanksignon.svc' cannot be activated due to an exception during compilation.  The exception message is: Security settings for this service require Windows Authentication but it is not enabled for the IIS application that hosts this service.. --->

in this case you will need to set windows authentication and change the iis metabase manualy

  1. On your IIS server, start Notepad, and then open the \system32\inetsrv\Metabase.xml file located on the hard disk.
  2. In the <IIsWebServer> section, locate the following line:
  3. NTAuthenticationProviders="NTLM"
  4. Modify the line so that it reads exactly as follows:
  5. NTAuthenticationProviders="Negotiate,NTLM"

Check also the <AuthFlags> attribute of the solution  vdir at the metabse.xml.

Posted: Monday, May 21, 2007 10:36 PM by nluria
Filed under: ,

Comments

Zuker On Foundations said:

I can&#39;t believe I wasted 10minutes on something that should be the simplest ever. You might encounter

# August 10, 2008 7:05 AM

foson said:

When will this not work just using IIS MMC?  Why?

# January 8, 2009 2:20 PM

Zuker On Foundations said:

I can&#39;t believe I wasted 10minutes on something that should be the simplest ever. You might encounter

# January 15, 2009 8:25 AM

mc21 said:

Another way, perhaps easier is:

cscript adsutil.vbs set w3svc/<identifier>/root/<VirtualDirectory>/NTAuthenticationProviders "Negotiate,NTLM"

If there is no virtual directory then remove it from the above command.

Be sure to do an 'iisreset' to make the changes take affect.

Cheers!

# June 9, 2009 6:33 PM

mc21 said:

Be sure to be in the C:\Inetpub\adminscripts directory when doing the above command.

# June 9, 2009 6:34 PM
Anonymous comments are disabled
Page view tracker