Troubleshooting: Web Service Calls Between Realms Fail Due to Mismatched IIS Authentication Settings

Version Affected: All
 
 

Overview

A realm using a Web Service (Multi-Datastore) configuration to call another, internal realm can fail to communicate with it, because the internal realm's IIS authentication settings don't match what's needed to accept an incoming Web Service call.
 

Cause

The internal (target) realm's IIS Authentication feature is configured for how a user's browser reaches it directly -- typically Forms Authentication and Anonymous Authentication enabled -- rather than for how another realm's Web Service call needs to reach it, which typically requires Windows Authentication and ASP.NET Impersonation enabled instead.

Resolution:

1. In IIS Manager, open the calling realm's Authentication feature and note which methods are enabled. In a working Web Service setup, this is typically Windows Authentication and ASP.NET Impersonation.
2. Open the internal (target) realm's Authentication feature and compare it against the calling realm's.
3. Enable whichever methods are enabled on the calling realm but not on the internal realm, and disable whichever methods don't match -- typically enabling Windows Authentication and ASP.NET Impersonation, and disabling Forms Authentication and Anonymous Authentication, on the internal realm.
4. Test the Web Service call again.

SecureAuth Knowledge Base Articles provide information based on specific use cases and may not apply to all appliances or configurations. Be advised that these instructions could cause harm to the environment if not followed correctly or if they do not apply to the current use case.

Customers are responsible for their own due diligence prior to utilizing this information and agree that SecureAuth is not liable for any issues caused by misconfiguration directly or indirectly related to SecureAuth products.