Allow anonymous to ASP.NET Web API controller while rest of the application runs under windows authentication

user_1432835 0
Viewed 38706

I have an ASP.NET web application that has Windows authentication enabled. I need to write an ASP.NET Web API controller in that application that uses some of the data access logic of the application. I don't want to create a new project for the Web API alone as I need to expose just a small end point that handles a couple of requests.

The Web API clients would consume the service anonymously. To allow this, I tried using AllowAnonymous action filter on both controller as well as the actions. But, when I try hitting the API using Fiddler, the request fails with status 401 saying "401 - Unauthorized: Access is denied due to invalid credentials".

Is there a way to achieve this?

iis-7.5 asp.net-web-api authentication asp.net
4 Answers

If after changing the settings are not working, try iisreset /start .

It worked for me: health webapi controller enabled to anonymous while all other webapi controllers and mvc controllers remained with ntlm windows authentication enabled. web config doesn't contain tag at all because the settings was done in IIS level. Windows authentication was enabled and Anonymous was disabled. (site level, authentication settings). webconfig:

<location path="api/health">
    <system.web>
      <authorization>
        <allow users="?" />
      </authorization>
    </system.web>
  </location>
user_78804290
Related