Azure Web App托管WCF服务Windows身份认证配置报错求助

Got it, let's unpack this error and get your service working as expected. The core issue here is a mismatch: your Azure Web App is currently set to Anonymous authentication, but your BasicHttpBinding is configured for Negotiate auth. On top of that, your binding's SecurityMode isn't set to a value that supports this auth scheme. Here's how to fix it:

Step 1: Update Azure Web App's Authentication Settings #

First, we need to align the Web App's auth mode with your WCF setup. Since you've already enabled Azure AD (AAD), we need to turn off anonymous access and enforce AAD auth:

• Head to the Azure Portal, find your Web App, and go to the Authentication pane (left sidebar).
• Under Anonymous access, select Require authentication.
• Double-check that your AAD configuration is correct (you should have a registered app, proper tenant settings, etc.).
• Save the changes and restart your Web App to apply them.

Step 2: Correct the BasicHttpBinding Security Configuration #

Next, we need to tweak your WCF binding to match the Web App's AAD setup and fix the SecurityMode issue. Since Azure Web Apps enforce HTTPS by default, we'll use the Transport security mode (the most secure option for production):

Option 1: Configure via Web.config #

Find the <bindings> section in your WCF service's Web.config and update it like this:

<basicHttpBinding>
  <binding name="AADSecureBasicBinding">
    <!-- Use Transport mode for HTTPS (required for Azure production) -->
    <security mode="Transport">
      <!-- Set to UserName to support AAD username/password authentication -->
      <transport clientCredentialType="UserName" />
    </security>
  </binding>
</basicHttpBinding>

Make sure your service endpoint uses this binding configuration:

<services>
  <service name="YourServiceNamespace.YourWcfService">
    <endpoint 
      address="" 
      binding="basicHttpBinding" 
      bindingConfiguration="AADSecureBasicBinding" 
      contract="YourServiceNamespace.IYourWcfContract" 
    />
  </service>
</services>

Option 2: Configure via Code (if using dynamic setup) #

If you're configuring your WCF host in code instead of config files, use this snippet:

// Create a BasicHttpBinding with Transport security (for HTTPS)
var binding = new BasicHttpBinding(BasicHttpSecurityMode.Transport);
// Set credential type to UserName for AAD auth
binding.Security.Transport.ClientCredentialType = HttpClientCredentialType.UserName;

// Attach the binding to your service host
var host = new ServiceHost(typeof(YourWcfService));
host.AddServiceEndpoint(
  typeof(IYourWcfContract), 
  binding, 
  "https://your-web-app-name.azurewebsites.net/YourService.svc"
);

Step 3: Test the Fix #

After making these changes, restart your Web App and test the service:

• Navigate to your service's WSDL URL (e.g., https://your-web-app-name.azurewebsites.net/YourService.svc?wsdl). You should now see either an AAD username/password prompt or be redirected to the AAD login page (depending on your AAD setup).
• If you still run into issues, check the Web App's Authentication Logs to verify AAD auth is triggering correctly, and enable WCF tracing to get more detailed error insights.

A quick note: If you're testing with HTTP (not recommended for production), you can use SecurityMode.TransportCredentialOnly instead—but remember, Azure production environments force HTTPS, so Transport is the right choice for live deployments.

内容的提问来源于stack exchange，提问作者Jim Wilcox