Home | Contact Us | FAQ | Search & Site Map | Link to Us
Sign In | Join | Other 45 Sites in Network
HomeAnnouncementsFree MagazinesWhite PapersSubmit Content
Discussion GroupsASP.NETWindows FormsLanguages.NET FrameworkVisual Studio.NET
Articles.NET FrameworkASP.NETToolsWindows Forms
.NET DirectoryOpen Source ProjectsUser GroupsWeb Resources
Related Topics
Visual Basic 6SQL ServerMS AccessOther DB ProductsMS Server ProductsMore Topics ...

.NET Forum / ASP.NET / Web Services / March 2007

Tip: Looking for answers? Try searching our database.

Why does client send two soap messages when Credentials is used?

Thread view: 
Enable EMail Alerts  Start New Thread
Thread rating: 
Hao - 16 Mar 2007 21:57 GMT
There is a wield issue in inspecting the network traffic on the web service
client side. There are two soap calls if credentials are used. The first
call has no credentials and is rejected by the server. The second call has
credentials and works. They are done by .Net behind the scene. No exception
is generated. If I do not pass in credentials or pass in empty crenditials
(empty user id and password), only one soap message is sent.

I could not figure out how to configure the .Net to only send one soap
message. Why does .Net send the first soap message?

Below is my code. The BACnetWSCore is the generated ws client proxy.

In case of web service call with

System.Net.ServicePointManager.Expect100Continue = false;
System.Net.ServicePointManager.UseNagleAlgorithm = false;
BACnetWSCore service = new BACnetWSCore();
service.Url = address;
service.Credentials = new System.Net.NetworkCredential(userid, password);
service.SomeAPI();    // expect only a soap message is sent, but actually
two are sent. The first one failed while the second one succeeds.

Thanks.
Hao
Mariano Omar Rodriguez - 17 Mar 2007 03:04 GMT
Just use CredentialCache instead of NetworkCredentials and the
PreAuthenticate property in true.

Take a look to the following article
http://www.code-magazine.com/article.aspx?quickid=0307071&page=3

> There is a wield issue in inspecting the network traffic on the web
> service client side. There are two soap calls if credentials are used. The
[quoted text clipped - 20 lines]
> Thanks.
> Hao
Steven Cheng[MSFT] - 19 Mar 2007 04:53 GMT
Hello Hao,

The two-request behavior you saw is due to the authentication process of
windows intergated authentication, and this is a transport layer
authentication behavior rather than webservice code specific behavior.  
When performing windows authentication, the client browser will send
request without authentication credential info, and if server-side require
user authentication, it deny the access and then a second request goes.  So
far, one means for improve such authentication peformance is to se the
"PreAuthenticate" header of http request(webservice client proxy has a
property for this), however, only limited authentication scheme support
this "PreAuthenticate" setting. here is a webarticle which has mentioned
this:

#Web Service optimization
http://www.codeproject.com/soap/webserviceoptimization.asp

You can have a look to get more idea.

Hope this helps.

Sincerely,

Steven Cheng

Microsoft MSDN Online Support Lead



==================================================

Get notification to my posts through email? Please refer to
http://msdn.microsoft.com/subscriptions/managednewsgroups/default.aspx#notif
ications.



Note: The MSDN Managed Newsgroup support offering is for non-urgent issues
where an initial response from the community or a Microsoft Support
Engineer within 1 business day is acceptable. Please note that each follow
up response may take approximately 2 business days as the support
professional working with you may need further investigation to reach the
most efficient resolution. The offering is not appropriate for situations
that require urgent, real-time or phone-based interactions or complex
project analysis and dump analysis issues. Issues of this nature are best
handled working with a dedicated Microsoft Support Engineer by contacting
Microsoft Customer Support Services (CSS) at
http://msdn.microsoft.com/subscriptions/support/default.aspx.

==================================================



This posting is provided "AS IS" with no warranties, and confers no rights.
Hao - 19 Mar 2007 19:54 GMT
I've tried both PreAuthenticate to true and using the CredentialCache with
"Basic" schema. Only one messasge was sent, without the authentication
header, and therefore was rejected.
Any clue there? I also tried to override keepalive to either true or false,
did not make any difference.
Thanks.
Hao

> Hello Hao,
>
[quoted text clipped - 46 lines]
> This posting is provided "AS IS" with no warranties, and confers no
> rights.
Steven Cheng[MSFT] - 20 Mar 2007 07:14 GMT
Thanks for your reply Hao,

For the "PreAuthentication", if you're using basic authentication,  it
require client-side supply the basic authentication based credential and
the server-side(IIS application virtual dir) is configured as basic
authentication). Have you configured the IIS virtual directory to use basic
authentication also?

And no matter set "PreAuthenticate" to true or false, the first request
will always send non authentication header which result a 401 error, and
the "PreAuthentication" setting will take effect for all sequential
requests (avoid the intial 401 roundtrip). You can refer to the following
MSDN document about the behavior of using "PreAuthenticate" property:

#HttpWebRequest.PreAuthenticate Property
http://msdn2.microsoft.com/en-us/library/system.net.httpwebrequest.preauthen
ticate.aspx

Sincerely,

Steven Cheng

Microsoft MSDN Online Support Lead

This posting is provided "AS IS" with no warranties, and confers no rights.
Hans Liss - 31 Mar 2007 10:22 GMT
> Just use CredentialCache instead of NetworkCredentials and the
> PreAuthenticate property in true.

Don't bother with PreAuthenticate. To make this work properly you will have
to override the GetWebRequest method in your client proxy.

Add something like this to your code (change "YourReference" to the name of
your Web Reference):

 class OBACnetWSCore : YourReference.BACnetWSCore {
   protected override WebRequest GetWebRequest(Uri uri) {
     HttpWebRequest webRequest = (HttpWebRequest)base.GetWebRequest(uri);
     NetworkCredential creds = Credentials as NetworkCredential;
     if (creds != null) {
       string authStr =
         ((creds.Domain != null) && (creds.Domain.Length > 0) ?
           creds.Domain + @"\" : string.Empty) +
         creds.UserName + ":" + creds.Password;
       authStr = Convert.ToBase64String(Encoding.Default.GetBytes(authStr));
       webRequest.Headers["Authorization"] = "Basic " + authStr;
     }
     return webRequest;
   }
 }

...and then use OBACnetWSCore for your proxy.

/Hans
Hans Liss - 31 Mar 2007 14:00 GMT
> > Just use CredentialCache instead of NetworkCredentials and the
> > PreAuthenticate property in true.
>
> Don't bother with PreAuthenticate. To make this work properly you will have
> to override the GetWebRequest method in your client proxy.

A comment, just to clarify: PreAuthenticate is what you want, it just
doesn't work properly. It causes the authentication header to be sent
automatically only on *subsequent calls*, never on the first one. The
homemade Authorization header technique i described above really is the best
way to do it right now, and let's just hope that Microsoft decides to
implement a proper PreAuthenticate behaviour sometime soon.

Please note also that, when *not* using this trick, in some situations
(talking with an Axis server, for instance) you will get a protocol error on
the second call, because there is something wrong with the .NET
implementation of HTTP 1.1. In these situations you will have to override the
GetWebRequest method anyway, to force it to use HTTP 1.0.

/Hans

Rate this thread:







Free Magazines

Get these publications absolutely FREE for up to 12 months. There are no hidden fees and no obligation. Simply choose a title, complete the application form and submit it. Read more ...

Oracle MagazineNetwork ComputingComputer WorldBio-IT WorldeWeekInformation WeekInfosecurity
 
Sign In
Join
My Latest Posts
My Monitored Threads
My Blog
My Photo Gallery
My Profile
My Homepage

Start New Thread
Enable EMail Alerts
Rate this Thread



©2008 Advenet LLC   Privacy Policy - Terms of Use
This website includes both content owned or controlled by Advenet as well as content owned or controlled by third parties.