title: Getting 403 Forbidden error. The HTTP request was forbidden with client authentication scheme 'Anonymous'
body: <p>This issue that I am having doesn't happen for all of the clients that are accessing our services but what is consistent is that when the error does occur, it is happening on the same service call for a handful of clients.</p>
  
  <p>Here are the details of the exception:</p>
  
  <blockquote>
    <p>System.ServiceModel.Security.MessageSecurityException The HTTP request
    was forbidden with client authentication scheme 'Anonymous'.
    System.ServiceModel.Security.MessageSecurityException: The HTTP
    request was forbidden with client authentication scheme 'Anonymous'.
    <strong>> ---> System.Net.WebException: The remote server returned an error: (403) Forbidden.     at System.Net.HttpWebRequest.GetResponse()</strong>     at
    System.ServiceModel.Channels.HttpChannelFactory.HttpRequestChannel.HttpChannelRequest.WaitForReply(TimeSpan
    timeout)     --- End of inner exception stack trace ---    Server
    stack trace:      at
    System.ServiceModel.Security.IssuanceTokenProviderBase<code>1.DoNegotiation(TimeSpan
    timeout)     at
    System.ServiceModel.Security.SspiNegotiationTokenProvider.OnOpen(TimeSpan
    timeout)     at
    System.ServiceModel.Security.TlsnegoTokenProvider.OnOpen(TimeSpan
    timeout)     at
    System.ServiceModel.Security.WrapperSecurityCommunicationObject.OnOpen(TimeSpan
    timeout)     at
    System.ServiceModel.Channels.CommunicationObject.Open(TimeSpan
    timeout)     at
    System.ServiceModel.Security.CommunicationObjectSecurityTokenProvider.Open(TimeSpan
    timeout)     at
    System.ServiceModel.Security.SecurityUtils.OpenTokenProviderIfRequired(SecurityTokenProvider
    tokenProvider, TimeSpan timeout)     at
    System.ServiceModel.Security.SymmetricSecurityProtocol.OnOpen(TimeSpan
    timeout)     at
    System.ServiceModel.Security.WrapperSecurityCommunicationObject.OnOpen(TimeSpan
    timeout)     at
    System.ServiceModel.Channels.CommunicationObject.Open(TimeSpan
    timeout)     at
    System.ServiceModel.Channels.SecurityChannelFactory</code>1.ClientSecurityChannel<code>1.OnOpen(TimeSpan
    timeout)     at
    System.ServiceModel.Channels.CommunicationObject.Open(TimeSpan
    timeout)     at
    System.ServiceModel.Security.SecuritySessionSecurityTokenProvider.DoOperation(SecuritySessionOperation
    operation, EndpointAddress target, Uri via, SecurityToken
    currentToken, TimeSpan timeout)     at
    System.ServiceModel.Security.SecuritySessionSecurityTokenProvider.GetTokenCore(TimeSpan
    timeout)     at
    System.IdentityModel.Selectors.SecurityTokenProvider.GetToken(TimeSpan
    timeout)     at
    System.ServiceModel.Security.SecuritySessionClientSettings</code>1.ClientSecuritySessionChannel.OnOpen(TimeSpan
    timeout)     at
    System.ServiceModel.Channels.CommunicationObject.Open(TimeSpan
    timeout)     at
    System.ServiceModel.Channels.ServiceChannel.OnOpen(TimeSpan timeout)<br>
    at System.ServiceModel.Channels.CommunicationObject.Open(TimeSpan
    timeout)     at
    System.ServiceModel.Channels.ServiceChannel.CallOpenOnce.System.ServiceModel.Channels.ServiceChannel.ICallOnce.Call(ServiceChannel
    channel, TimeSpan timeout)     at
    System.ServiceModel.Channels.ServiceChannel.CallOnceManager.CallOnce(TimeSpan
    timeout, CallOnceManager cascade)     at
    System.ServiceModel.Channels.ServiceChannel.EnsureOpened(TimeSpan
    timeout)     at
    System.ServiceModel.Channels.ServiceChannel.Call(String action,
    Boolean oneway, ProxyOperationRuntime operation, Object[] ins,
    Object[] outs, TimeSpan timeout)     at
    System.ServiceModel.Channels.ServiceChannel.Call(String action,
    Boolean oneway, ProxyOperationRuntime operation, Object[] ins,
    Object[] outs)     at
    System.ServiceModel.Channels.ServiceChannelProxy.InvokeService(IMethodCallMessage
    methodCall, ProxyOperationRuntime operation)     at
    System.ServiceModel.Channels.ServiceChannelProxy.Invoke(IMessage
    message)    Exception rethrown at [0]:      at
    System.Runtime.Remoting.Proxies.RealProxy.HandleReturnMessage(IMessage
    reqMsg, IMessage retMsg)     at
    System.Runtime.Remoting.Proxies.RealProxy.PrivateInvoke(MessageData&amp;
    msgData, Int32 type)     at 
    <strong>> Proxy.FileTransferService.IFileTransferService.EstablishProxy(DownloadRequest
    request)</strong>     at  Proxy.FileTransferService.FileTransferServiceClient.
    Proxy.FileTransferService.IFileTransferService.EstablishProxy(DownloadRequest
    request)     at  NormalFileTransferServiceClient.Download(Int32
    packageId, IStreamWriter downloader, Archiver archiver)     at 
    LoggingFileTransferServiceClient.Download(Int32 packageId, ISt</p>
  </blockquote>
  
  <p>That exception is being thrown by the client.</p>
  
  <p>The client proxy configuration for IFileTransferService is:</p>
  
  <pre><code>&lt;binding name="WSHttpBinding_IFileTransferService" closeTimeout="00:01:00"
    openTimeout="00:01:00" receiveTimeout="00:10:00" sendTimeout="00:01:00"
    bypassProxyOnLocal="false" transactionFlow="false" hostNameComparisonMode="StrongWildcard"
    maxBufferPoolSize="524288" maxReceivedMessageSize="65536" messageEncoding="Mtom"
    textEncoding="utf-8" useDefaultWebProxy="true" allowCookies="false"&gt;
    &lt;readerQuotas maxDepth="32" maxStringContentLength="8192" maxArrayLength="16384"
      maxBytesPerRead="4096" maxNameTableCharCount="16384" /&gt;
    &lt;reliableSession ordered="true" inactivityTimeout="00:10:00"
      enabled="false" /&gt;
    &lt;security mode="Message"&gt;
      &lt;transport clientCredentialType="Windows" proxyCredentialType="None"
        realm="" /&gt;
      &lt;message clientCredentialType="UserName" negotiateServiceCredential="true"
        algorithmSuite="Default" establishSecurityContext="true" /&gt;
    &lt;/security&gt;
  &lt;/binding&gt;
  
    &lt;endpoint address="http://[hostname]/FileTransferService.svc/FileTransfer"
      binding="wsHttpBinding" bindingConfiguration="WSHttpBinding_IFileTransferService"
      contract="Proxy.FileTransferService.IFileTransferService"
      name="WSHttpBinding_IFileTransferService"&gt;
      &lt;identity&gt;
        &lt;certificate encodedValue="a long string"/&gt;
      &lt;/identity&gt;
    &lt;/endpoint&gt;
  </code></pre>
  
  <p>The service configuration is</p>
  
  <pre><code>&lt;service behaviorConfiguration="ServiceBehavior" 
      name="Services.FileTransferService"&gt;
          &lt;endpoint name="WSHttpBinding_IFileTransferService" 
         binding="wsHttpBinding" 
         bindingConfiguration="MtomWSHttpBinding" 
         contract="Services.IFileTransferService" 
         address="/FileTransfer"/&gt;
          &lt;endpoint binding="basicHttpBinding" 
         bindingConfiguration="FileTransferServicesBinding" 
         contract="Services.IFileTransferService"/&gt;
          &lt;host&gt;
            &lt;baseAddresses&gt;
              &lt;add baseAddress="http://[hostname]/FileTransferService.svc"/&gt;
            &lt;/baseAddresses&gt;
          &lt;/host&gt;
  &lt;/service&gt;
  
  &lt;binding name="wsHttpBinding" 
           maxReceivedMessageSize="2147483647" 
           receiveTimeout="5" 
           useDefaultWebProxy="false"&gt;
        &lt;readerQuotas maxDepth="2147483647" 
               maxStringContentLength="2147483647" 
               maxArrayLength="2147483647" 
               maxBytesPerRead="2147483647" 
               maxNameTableCharCount="2147483647" /&gt;
    &lt;security mode="Message"&gt;
      &lt;message clientCredentialType="UserName" /&gt;
    &lt;/security&gt;
  &lt;/binding&gt;
  
  &lt;basicHttpBinding&gt;
      &lt;binding name="FileTransferServicesBinding" 
             maxReceivedMessageSize="10067108864" 
             messageEncoding="Mtom" 
             transferMode="Streamed" 
             useDefaultWebProxy="false"&gt;
        &lt;security mode="None"&gt;
          &lt;message clientCredentialType="UserName" /&gt;
        &lt;/security&gt;
      &lt;/binding&gt;
    &lt;/basicHttpBinding&gt;
  </code></pre>
  
  <p>Note: A few clients are using the basicHttpBinding (if I set everything up correctly).  In later release of the client, which may not have been fully distributed (which is why I have to support 2 version), I changed the proxy to use the wsHttpBinding endpoint instead.  I'm wondering if this error that I'm getting is specific to basicHttp and if so, maybe I don't have these configurations set up properly.  I'm under the assumption that the clients that are getting this 403 error are using the wsHttpBinding.</p>
  
  <p>Here is the code for the service:</p>
  
  <pre><code>public RemoteBinaryInfo EstablishProxy(DownloadRequest request)
  {
      int packageId = request.PackageId;
  
      System.IO.MemoryStream stream = new System.IO.MemoryStream(packageRepository.GetPackageBinary(packageId));
  
      DisposeStreamWhenOperationIsComplete(stream, OperationContext.Current);
  
      RemoteBinaryInfo result = new RemoteBinaryInfo();
      result.Length = stream.Length;
      result.MemoryByteStream = stream;
      return result;
  
  }
  
  private static void DisposeStreamWhenOperationIsComplete(System.IO.MemoryStream stream, OperationContext clientContext)
  {
      clientContext.OperationCompleted += new EventHandler(delegate(object sender, EventArgs args)
      {
          if (stream != null)
              stream.Dispose();
      });
  }
  </code></pre>
  
  <p>Does any one know if getting rid of this exception is something within my control? Are there any configuration changes that I can make on either the client or service config files?</p>
  
  <p>If you need anymore information from me please let me know.</p>