web service remote access

Steve_Contris

I am using web services on a Nav 2009 three-tier install and that works well from any computer in our office but I would like to be able to hit those services from outside our domain. I have port 7047 opened on the firewall and using network monitor I can see that my services requests make it through to the server but on my outside test machine I only get "The website cannot display the page" HTTP 500

When I try the connection, I am prompted for my domain login credentials and only allows any connection at all if the credentials are correct.

Is this kind of connection not possible with web services?

jglathe

Hi,

the caller must authenticate itself to the web service. For this the calling machine must be part of the AD domain (or something like it, not an AD expert). We had the same issue, there are also a few blog articles on this topic. To resolve it we have built a WS proxy which is routing the web service calls through and does the authentication on the AD side. The only catch is that you need to change and recompile it when the web service changes.

with best regards

Jens

Steve_Contris

Thanks for the suggestion but I did find a reference to the need for turning on NTLM authentication for web services to be able to be accessed remotely. This is a setting in the CustomSettings.config file. The default is SPNEGO. (I am going to try that after hours when it wont interfere in case it disrupts normal web services access.)

I also found this in wikipedia:

"While Kerberos has replaced NTLM as the default authentication protocol in an Active Directory (AD) based single sign-on scheme, NTLM is still widely used in situations where a domain controller is not available or is unreachable. For example, NTLM would be used if a client is not Kerberos capable, the server is not joined to a domain, or the user is remotely authenticating over the web."

So it seems that NTLM is the only way to access web services over the internet since the domain controller is not reachable.