title: call lists.asmx getting 'http request is unauthorized with client authentication scheme 'ntlm'
body: <p>Using console app in C# to call lists.asmx getting <strong><em>'http request is unauthorized with clien tauthentication scheme 'ntlm'. The authentication header received from the server was 'Negotiate, NTLM'.</em></strong></p>
  
  <p>Environment: </p>
  
  <ul>
  <li>Kerberos turned on in QA &amp; Production, not in Dev (stupid I know, but I don't admin any of the boxes)</li>
  <li>Hitting a sharepoint webservice to GET data from a sharepoint list (lists.asmx). </li>
  <li>Server uses ssl. </li>
  </ul>
  
  <p>I get an error message in my qa environment as follows (can't paste the stacktrace as it's in a picture only): </p>
  
  <pre><code>System.ServiceModel.Security.MessageSecurityException: The HTTP request is unauthorized with client authentication scheme 'Ntlm'. The authentication header received from the server was 'Negotiate,NTLM'. ---&gt; System.Net.WebException: The remote server returned an error: (401) Unauthorized.
  </code></pre>
  
  <p>Direct navigation to the list works fine from every machine.</p>
  
  <ul>
  <li>Code works in a development environment (on the server) which does not have kerberos enabled (should be, but isn't. I CANNOT change this).</li>
  <li>Code works against production from a desktop machine which does have kerberos enabled</li>
  <li>Code does not work in a QA environment which does have kerberos enabled. This is where I get the error</li>
  </ul>
  
  <p>To call the webservice I do this (no other security-related code involved)</p>
  
  <pre><code>XmlElement element = this.LIstsServiceClient.GetListItems(listName, '', query, fields, '300', null, null);
  </code></pre>
  
  <p>My app.config is as follows </p>
  
  <pre><code>    &lt;configuration&gt;
      &lt;system.serviceModel&gt;
        &lt;behaviors&gt;
          &lt;endpointBehaviors&gt;
            &lt;behavior name="clientEndpointBehavior"&gt;
              &lt;clientCredentials&gt;
                &lt;windows allowedImpersonationLevel="Delegation"/&gt;
              &lt;/clientCredentials&gt;
            &lt;/behavior&gt;
          &lt;/endpointBehaviors&gt;
        &lt;/behaviors&gt;
        &lt;bindings&gt;
              &lt;basicHttpBinding&gt;
                  &lt;binding name="ListsSoap" closeTimeout="00:01:00" openTimeout="00:01:00"
                      receiveTimeout="00:10:00" sendTimeout="00:01:00" allowCookies="false"
                      bypassProxyOnLocal="false" hostNameComparisonMode="StrongWildcard"
                      maxBufferSize="999999999" maxBufferPoolSize="524288" maxReceivedMessageSize="999999999"
                      messageEncoding="Text" textEncoding="utf-8" transferMode="Buffered"
                      useDefaultWebProxy="true"&gt;
                      &lt;readerQuotas maxDepth="32" maxStringContentLength="8192" maxArrayLength="16384"
                          maxBytesPerRead="999999" maxNameTableCharCount="16384" /&gt;
                      &lt;security mode="Transport"&gt;
                        &lt;transport clientCredentialType="Ntlm" proxyCredentialType="Ntlm" realm="" /&gt;
                        &lt;message clientCredentialType="UserName" algorithmSuite="Default" /&gt;
                      &lt;/security&gt;
                  &lt;/binding&gt;
  &lt;/basicHttpBinding&gt;
  &lt;client&gt;
           &lt;endpoint address="https://servername/sitecollectionname/_vti_bin/Lists.asmx"
                binding="basicHttpBinding" bindingConfiguration="ListsSoap"
                contract="ListsService.ListsSoap" name="ListsSoap" behaviorConfiguration="clientEndpointBehavior"  &gt;
              &lt;identity&gt;
                &lt;servicePrincipalName value="spn" /&gt;
              &lt;/identity&gt;
            &lt;/endpoint&gt;
  &lt;/client&gt;
      &lt;/system.serviceModel&gt;
  &lt;/configuration&gt;
  </code></pre>