Could not consume WSS web service in an ASP.NET web service app

[Jude Wong]

Hi,

I built an ASP.NET web service app and configured to consume a WSS v3 web
service. Specifically I wanted to use People.ResolvePrincipals to resolve
the current user in my app code.

The ASP.NET web serivce was deployed on the same box running WSS v3 but was
not configured to operate within the context of WSS v3, i.e. as a plain web
application.

In the Web.config file for the ASP.NET web service, the authentication mode
was set to Windows and identity impersonation was set to true.

From a remote PC, I opened a web browser and accessed the web service. It
could resolve my identity. I am a user in one of the WSS sites.

However when another user, who is not registered as a site user but is from
the same Windows domain, tried it, the following error occurred.

"System.Net.WebException: The request failed with HTTP status 401:
Unauthorized."

I tried setting both People.Credentials =
System.Net.CredentialCache.DefaultNetworkCredentials and People.Credentials =
System.Net.CredentialCache.DefaultCredentials but received the same result.

What we would like is for any authenticated user (from same domain or
trusted domain) to use this web service whether or not he/she is a WSS site
user.

Is there a way to grant an authenticated user to use the WSS web service?

Thanks.

[Jude Wong]

An update: I added the other user to one of the sites in WSS but that user
was still unable to invoke the web service successfully.

One solution I read about was to grant the user the necessary permission via
Central Administration > Application Management > Policy for Web Application.

However this also means that once set, e.g. Full Read permission, the user
will have read access to the sites in the entire web application which is not
desired.

Thanks.

[Jude Wong]

Apologize for another update: After I added the user to a group (with Read
permission) at the top level site, the web service was called successfully.

I removed the user and added NT AUTHORITY\authenticated users to the same
group, the web service was also called successfully.

Therefore it looks like the users must have certain permission to the site
before the web service can be called successfully.

I'm not sure what would be a good approach. Any idea?

Thanks.