title: Metadata request requires authentication in WCF even though service description page doesn't
body: <p>I've set up a WCF service to require NTLM authentication using the following configuration:</p>
  
  <pre><code>&lt;system.serviceModel&gt;
      &lt;bindings&gt;
          &lt;customBinding&gt;
              &lt;binding name="BinarySecurityBinding"&gt;
                  &lt;binaryMessageEncoding/&gt;
                  &lt;httpTransport authenticationScheme="Ntlm"/&gt;
              &lt;/binding&gt;
          &lt;/customBinding&gt;
      &lt;/bindings&gt;
  
      &lt;services&gt;
          &lt;service name="Services.LogisticsServices" behaviorConfiguration="ServiceBehavior"&gt;
              &lt;endpoint address="" binding="customBinding" bindingConfiguration="BinarySecurityBinding" contract="Services.ILogisticsServices" /&gt;
              &lt;endpoint address="mex" binding="mexHttpBinding" contract="IMetadataExchange"/&gt;
          &lt;/service&gt;
      &lt;/services&gt;
  
      &lt;behaviors&gt;
          &lt;serviceBehaviors&gt;
              &lt;behavior name="ServiceBehavior"&gt;
                  &lt;serviceMetadata httpGetEnabled="true"/&gt;
                  &lt;serviceDebug includeExceptionDetailInFaults="true"/&gt;
              &lt;/behavior&gt;
          &lt;/serviceBehaviors&gt;
      &lt;/behaviors&gt;
  &lt;/system.serviceModel&gt;
  </code></pre>
  
  <p>I did this so that the applications that consume the web service are forced to log in because all my service's operations use impersonation (<code>[OperationBehavior(Impersonation = ImpersonationOption.Required)]</code>).</p>
  
  <p>In IIS 7 I've enabled anonymous and Windows authentication.</p>
  
  <p>When I visit <code>http://test.server/LogisticsServices.svc</code>, which hosts the service described above, I can see the default service description page anonymously. However, when Visual Studio tries to access <code>http://test.server/LogisticsServices.svc/$metadata</code> to generate a client proxy, the server is responding with HTTP code 401 and expecting authentication. Not only would I've expected the metadata to be available anonymously, but additionally, the server is not accepting the credentials I am giving it (even though, I know for a fact that they are correct).</p>
  
  <p>Testing different configuration, I tried removing the <code>authenticationScheme</code> from my binding's transport, just to be able to generate the client proxy, but that results in an exception because the service's operations require impersonation (<code>[OperationBehavior(Impersonation = ImpersonationOption.Required)]</code>).</p>
  
  <p>What am I missing in my service's configuration that would make the service's metadata available anonymously? I'm also open to suggestions if I'm approaching the whole thing wrong.</p>