title: WCF Service Authorizing with Active Directory - Access Denied Error
body: <p>I have a question around WCF authorization against a domain account over HTTP traffic hosted on IIS (none production so no ssl cert was available to use over the internet)</p>
  
  <p>I'd like to know how to set up windows authentication from a client to my web service. currently I'm testing on the same LAN so proxies are not a problem</p>
  
  <p>I have included a list of tried steps at the end of this post</p>
  
  <p><strong>Edit:</strong> The error that is occurring is just Access is denied, nothing else, given from the
  try, catch in the Client Application. If there is a way to get more detailed information, please let me know and ill add the result to the post.</p>
  
  <p>WCF Service code:</p>
  
  <pre><code>[AspNetCompatibilityRequirements(RequirementsMode = AspNetCompatibilityRequirementsMode.Allowed)]  
  
  ServiceBehavior(InstanceContextMode = InstanceContextMode.Single, ConcurrencyMode = ConcurrencyMode.Single, IncludeExceptionDetailInFaults = true)]    
  
  public class Data : IData
      {
          [PrincipalPermission(SecurityAction.Demand, Role=@"Administrators")]
  
          public List&lt;Incident&gt; GetCases()
          {            
  
              Queries query = new Queries();
  
              List&lt;Incident&gt; iList = query.CallCases();
  
              return iList;
  
           }
     }
  </code></pre>
  
  <p>WCF Web Config Bindings:</p>
  
  <pre><code>&lt;wsHttpBinding&gt;
      &lt;binding name="TransportSecurity"&gt;
          &lt;security mode="None"&gt;
              &lt;message clientCredentialType="Windows" algorithmSuite="Default"/&gt;
          &lt;/security&gt;
      &lt;/binding&gt;
  &lt;/wsHttpBinding&gt;
  </code></pre>
  
  <p>WCF Web Config Behavior:</p>
  
  <pre><code>&lt;behavior name="Behaviour1"&gt;
      &lt;serviceMetadata httpGetEnabled="true" httpGetUrl=""/&gt;
      &lt;serviceDebug includeExceptionDetailInFaults="true" /&gt;
      &lt;useRequestHeadersForMetadataAddress&gt;
          &lt;defaultPorts&gt;
              &lt;add scheme="http" port="9577" /&gt; ///This port is correct
          &lt;/defaultPorts&gt;
      &lt;/useRequestHeadersForMetadataAddress&gt;
  &lt;/behavior&gt;
  </code></pre>
  
  <p>WCF Web Config Service:</p>
  
  <pre><code>&lt;service behaviorConfiguration="Behaviour1" name="WebService1.Data"&gt;
      &lt;endpoint address="" binding="wsHttpBinding" bindingConfiguration="TransportSecurity" contract="WebService1.IData"&gt;
           &lt;identity&gt;
                &lt;dns value="demo.DomainName.co.uk" /&gt;
           &lt;/identity&gt;
      &lt;/endpoint&gt;
      &lt;endpoint address="mex" binding="mexHttpBinding" contract="IMetadataExchange" /&gt;
  &lt;/service&gt;
  </code></pre>
  
  <p>Client Application (Has Service reference added)</p>
  
  <pre><code>            DataClient client = new DataClient();
  
          AppDomain.CurrentDomain.SetPrincipalPolicy(PrincipalPolicy.WindowsPrincipal);
          PrincipalPermission principalPerm = new PrincipalPermission(null, "Administrators");
          principalPerm.Demand();
          Console.WriteLine("Demand succeeded.");
  
          client.ClientCredentials.Windows.ClientCredential.Domain = "Domain Name";
          client.ClientCredentials.Windows.ClientCredential.UserName = "User Account";
          client.ClientCredentials.Windows.ClientCredential.Password = "Password";
  
          //client.ClientCredentials.UserName.UserName = @"UserAccount@domain.com";
          //client.ClientCredentials.UserName.Password = "Password";
          //client.ClientCredentials.UseIdentityConfiguration = true;
  
          try
          {
              List&lt;Incident&gt; cases = client.GetCases().ToList();
  
              foreach (Incident Inc in cases)
              {
                  Console.WriteLine(Inc.CaseID);
              }
  
          }
  
          catch (Exception ex)
          {
              Console.WriteLine(ex.Message);
          }
  </code></pre>
  
  <p>Attempted Resolutions:</p>
  
  <ul>
  <li>Using Domain and Local Users</li>
  <li>Modifying the Client Credential type to basic, NTLM and Windows</li>
  <li>using setting IIS to use </li>
  <li>IIS has Basic and Windows Authentication Enabled</li>
  </ul>
  
  <p>if you need any more information please don't hesitate to ask.</p>
  
  <p>Thanks for any help you can provide</p>