I have a web apps on a win 2003 server that access a web services on a different web server 2003. When everything is on the same machine it works but when I split them I got a HTTP status 401: Unauthorized. I have impersonate set to true and using   <authentication mode="Windows"/>. The apps has its own web site and owns application pool running with a domain account identity. I have done the delegation (setspn -a http/servername domainname\myaccount)  of the account and I have also done the aspnet_regiis - ga domainname\myaccount.

If fact I have two apps, one is working and the other one not. They both work with basic authentication. It is really a kerberos security contaxt not transfer. The only different between the 2 appps is one we use the "add web reference" which create the wdsl stuff and the other one is the manuual way of doing it by using the SoapHttpClientProtocol. At the webservice server it seen the failing apps present itself with no credential because in the event log I have fail logon mentioning bad username or password and the username field is empty.

 here the stack trace:

[WebException: The request failed with HTTP status 401: Unauthorized.]
   System.Web.Services.Protocols.SoapHttpClientProtocol.ReadResponse(SoapClientMessage message, WebResponse response, Stream responseStream, Boolean asyncCall) +533199
   System.Web.Services.Protocols.SoapHttpClientProtocol.Invoke(String methodName, Object[] parameters) +204
   NPG.Framework.EntityWSProxy.EntityWSProxy.InvokeWebMethod(String name, Object[] parameters) +664
   CSA.MDB.EntityWSProxy.EntityWSProxy.GetMissionBrowserPages(String fileName) +79
   CSA.MDB.WebIntranet.TestWS.Button1_Click(Object sender, EventArgs e) +506
   System.Web.UI.WebControls.Button.OnClick(EventArgs e) +105
   System.Web.UI.WebControls.Button.RaisePostBackEvent(String eventArgument) +107
   System.Web.UI.WebControls.Button.System.Web.UI.IPostBackEventHandler.RaisePostBackEvent(String eventArgument) +7
   System.Web.UI.Page.RaisePostBackEvent(IPostBackEventHandler sourceControl, String eventArgument) +11
   System.Web.UI.Page.RaisePostBackEvent(NameValueCollection postData) +33
   System.Web.UI.Page.ProcessRequestMain(Boolean includeStagesBeforeAsyncPoint, Boolean includeStagesAfterAsyncPoint) +5102

Anyone has hint for me. I'm not a programmer so be indulgent. I'm a system admin helping our programmers.

 Hi Groslot,

Well, I don't work alot with webservices so I'm a complete noob when it comes to that.

But I had a problem once with account credentials who weren't forwarded to another server. But you have kerebos right? or not? If you have, then the following is probably useless to you but let me give it a try ...

When you authenticate to an IIS server using Integrated Windows, the type of logon is called a “Network” logon. With this kind of logon the credentials cannot be forwarded to another server, unless Kerberos is used in the intranet.

More about this in this thread: http://forums.asp.net/t/1141540.aspx 

Read it all the way through!

I truely hope this will help you

Kind regards,
Wim