Web API authentication on server - asp.net-web-api

Question

I am writing an Windows App that will communicate with Web API. Here is how I am making a call :
HttpClient client = null;
HttpClientHandler handler = new HttpClientHandler() { PreAuthenticate = true, Credentials = CredentialCache.DefaultCredentials };
client = new HttpClient();
client.BaseAddress = new Uri(apiBaseAddress);
var byteArray = Encoding.ASCII.GetBytes(Environment.UserName);
client.DefaultRequestHeaders.Accept.Add(new MediaTypeWithQualityHeaderValue("application/json"));
client.DefaultRequestHeaders.Authorization = new AuthenticationHeaderValue("Basic", Convert.ToBase64String(byteArray));
HttpResponseMessage response = client.GetAsync("api/Tickets/AuthenticateUser").Result;
I am passing the currently logged credentials. I have written a filter which connects to db and checks if the username exists. The code :
public class BasicAuthenticationWindowsAppAttribute : System.Web.Http.Filters..AuthorizationFilterAttribute
{
public override void OnAuthorization(System.Web.Http.Controllers.HttpActionContext actionContext)
{
if (actionContext.Request.Headers.Authorization == null)
{
actionContext.Response = new System.Net.Http.HttpResponseMessage(System.Net.HttpStatusCode.Unauthorized);
}
else
{
string authToken = actionContext.Request.Headers.Authorization.Parameter;
string Handle = Encoding.UTF8.GetString(Convert.FromBase64String(authToken));
GenericIdentity gi = new GenericIdentity(Handle);
Thread.CurrentPrincipal = new GenericPrincipal(gi, null);
HttpContext.Current.User = Thread.CurrentPrincipal;
Amo_MasterDataEntities amoMasterDataContext = new Amo_MasterDataEntities();
var query = from a in amoMasterDataContext.allassociatemasters
where a.Handle == Handle
select a;
//If Handle is present in AMOMasterData.AllAssociatemaster table
if (query.Count() > 0)
{
//TicketsController tc = new TicketsController();
string assocId = "", fName ="", lName = "";
bool authenticated = false;
foreach (var item in query)
{
assocId = item.AssociateID;
fName = item.FirstName;
lName = item.LastName;
authenticated = true;
}
AuthInfo info = new AuthInfo();
info.AssociateId = assocId;
info.FirstName = fName;
info.LastName = lName;
info.IsAuthenticated = authenticated;
actionContext.Request.Properties.Add(new KeyValuePair<string, object>("AuthInfo", info));
base.OnAuthorization(actionContext);
}
//else return error
else
actionContext.Response = new System.Net.Http.HttpResponseMessage(System.Net.HttpStatusCode.Unauthorized);
}
}
}
When I run the web service in my local system it works. But when I deploy the web service on server it is giving me 401 Unauhorized Message.
I have enabled both Basic and Windows Authentication in IIS and Web.config contains <authentication mode="Windows" />
Edit :
I am able to access the Web API Methods from the server where I have deployed.
But When I am calling the Web API from a windows client on another Machine it is throwing 401 error.
Should I use CORS? If yes please let me know how?
Can anybody give me a solution for this.

Answer 1

I found the reason,..
I was not passing the handler to constructor of HttpClient that was the problem. So in above code replace :
client = new HttpClient();
with :
client = new HttpClient(handler);
Such a silly mistake. Sorry for the trouble.