title: Problem with WCF + NTLM authentication and load balancing
body: <p>Once again attempting to get my WCF service working in our load balanced environment and I've been hopeful.  I've moved on to using a <code>&lt;customBinding&gt;</code> since it appears that the <a href="http://msdn.microsoft.com/en-us/library/ms730128%28v=VS.90%29.aspx" rel="nofollow">recommendation</a> is to set the <code>keepAliveEnabled</code> directive. </p>
  
  <p>That said, I am having a problem setting up Windows authentication on the server side since the <code>&lt;customBinding&gt;</code> does not seem to function in the same way.  </p>
  
  <p>The server side looks like this:</p>
  
  <pre><code>&lt;system.serviceModel&gt;
  &lt;serviceHostingEnvironment aspNetCompatibilityEnabled="true"/&gt;
  &lt;bindings&gt;
    &lt;customBinding&gt;
      &lt;binding name="HttpBinding" closeTimeout="00:00:45"&gt;
        &lt;textMessageEncoding&gt;
          &lt;readerQuotas maxStringContentLength="200000" maxArrayLength="200000" /&gt;
        &lt;/textMessageEncoding&gt;
        &lt;httpTransport keepAliveEnabled="false" maxReceivedMessageSize="200000" authenticationScheme="Negotiate"/&gt;
      &lt;/binding&gt;
    &lt;/customBinding&gt;
  &lt;/bindings&gt;
  &lt;services&gt;
      &lt;endpoint address="http://svcserv/Services/ReportService/Reports.svc" binding="customBinding"
                bindingConfiguration="HttpBinding" contract="ReportService.IReports" &gt;
      &lt;/endpoint&gt;
      &lt;endpoint address="mex" binding="customBinding" bindingConfiguration="HttpBinding" contract="IMetadataExchange" /&gt;
    &lt;/service&gt;
  &lt;/services&gt;
  &lt;behaviors&gt;
    &lt;serviceBehaviors&gt;
      &lt;behavior name="ReportService.ReportsBehavior"&gt;
        &lt;serviceMetadata httpGetEnabled="true"  /&gt;
        &lt;serviceDebug includeExceptionDetailInFaults="true"/&gt;
      &lt;/behavior&gt;
    &lt;/serviceBehaviors&gt;
  &lt;/behaviors&gt;
  &lt;/system.serviceModel&gt;
  </code></pre>
  
  <p>The client side looks like this:</p>
  
  <pre><code>&lt;system.serviceModel&gt;
  &lt;serviceHostingEnvironment aspNetCompatibilityEnabled="true"/&gt;
  &lt;bindings&gt;
    &lt;basicHttpBinding&gt;
      &lt;binding name="CustomBinding_IReports" maxReceivedMessageSize="200000"&gt;
        &lt;security mode="TransportCredentialOnly"&gt;
          &lt;transport clientCredentialType="Windows"/&gt;
        &lt;/security&gt;
      &lt;/binding&gt;
    &lt;/basicHttpBinding&gt;
  &lt;/bindings&gt;
  &lt;client&gt;
    &lt;endpoint name="CustomBinding_IReports" address="http://omsnetdev/Services/ReportService/Reports.svc"
              binding="basicHttpBinding" bindingConfiguration="CustomBinding_IReports" contract="ReportService.IReports"&gt;
      &lt;identity&gt;
        &lt;servicePrincipalName value="host/svcserv"/&gt;
        &lt;dns value="svcserv"/&gt;
      &lt;/identity&gt;
    &lt;/endpoint&gt;
  &lt;/client&gt;
  &lt;/system.serviceModel&gt;
  </code></pre>
  
  <p>If I leave the authenticationScheme set to "Negotiate" then I receive something along the lines of either <code>SOAP header Action was not understood.</code> or, at one point, <code>Client found response content type of '', but expected 'application/soap+xml'.</code>
  If I change the authenticationScheme to "Ntlm" then I receive <code>Exception: The request failed with HTTP status 401: Unauthorized.</code> but I believe this is due to the negotiation failing (<a href="http://msdn.microsoft.com/en-us/library/bb628618.aspx" rel="nofollow">due to the SPN value?</a>) so it falls back to "Ntlm" and fails.</p>
  
  <p>I would write this off as a configuration on the IIS server but I have verified the settings.  </p>